joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016410
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rsi
test rax, rax
je 0x140016458
mov rcx, rbx
mov qword [dbg.init_rand_s], rax
add rsp, 0x28
pop rbx
pop rsi
jmp rax
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rsi
mov qword [0x1402e9c20], rax
lea rax, [dbg.mingw_rand_s]
jmp 0x14001643e

Function at 0x140018aa0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x140018acc
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140019740
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x1402bc160], 0
jne 0x140019846
mov byte [0x1402bc160], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x14001981c
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [dbg.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14001980d
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x1402bf001]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x140019808
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x1400197d7
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x1400198db
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x140019841
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x140019841
Function at 0x1400798c0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140079908
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400798da
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14008d2e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x14008d308
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x14008d350
cdqe
add rsi, rax
sub rbx, rax
jne 0x14008d320
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14008d35c
call rbp
cmp dword [rax], 4
je 0x14008d320
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b41f0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1402bc180]
jmp sym.__emutls_get_address

Function at 0x1400b4200
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1402bc180]
jmp sym.__emutls_get_address
Function at 0x14002a67c
Capabilities:
Create process on windows
Terminate process

Disassembly:
jmp 0x14006dec0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x488]
mov rax, qword [0x1400a1080]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400b11be]
call fcn.14002b720
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14006dfa7
mov dword [rbp + 0x240], 0x70
lea rax, [rbp + 0x244]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
lea rax, str.runas
mov qword [rbp + 0x250], rax
lea rax, [rbp + 0x10]
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x248], 0
mov dword [rbp + 0x270], 1
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14006dfa7
mov rax, qword [rbp + 0x460]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rbp + 0x460]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp - 0x20]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.14002b2e8
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.14002ab77
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret

Function at 0x14002ad1b
Capabilities:
Terminate process

Disassembly:
jmp 0x140079570
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14002aefb
Capabilities:
Get geographical location

Disassembly:
jmp 0x140070e90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140070ecd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14002b70c
add rsp, 0x58
ret
Function at 0x14002aff5
Capabilities:
Parse pe header

Disassembly:
jmp 0x14007a3f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14007a410
xor al, al
jmp 0x14007a491
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14007a423
xor al, al
jmp 0x14007a491
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14007a44d
xor al, al
jmp 0x14007a491
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14007a461
xor al, al
jmp 0x14007a491
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14007a473
xor al, al
jmp 0x14007a491
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14007a48f
xor al, al
jmp 0x14007a491
mov al, 1
add rsp, 0x38
ret
Function at 0x14002b4e1
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14006faf0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x518]
mov rax, qword [0x1400a1080]
xor rax, rbp
mov qword [rbp + 0x4b0], rax
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rcx, qword [rbp + 0x4e0]
call fcn.14002b090
mov dword [rbp + 0x494], eax
xor edx, edx
mov rcx, qword [rbp + 0x4e0]
call fcn.14002a08c
mov qword [rbp + 0x498], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x494]
mov r8, qword [rbp + 0x498]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 4], eax
movsxd rax, dword [rbp + 4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14002a901
nop
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.14002a2c1
mov qword [rbp + 0x498], rax
mov rcx, qword [rbp + 0x4e0]
call fcn.14002b090
mov dword [rbp + 0x4a0], eax
xor edx, edx
mov rcx, qword [rbp + 0x4e0]
call fcn.14002a08c
mov qword [rbp + 0x4a8], rax
mov eax, dword [rbp + 4]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x498]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x4a0]
mov r8, qword [rbp + 0x4a8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov ecx, 2
call fcn.14002ab3b
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
jne 0x14006fc2f
lea rcx, [rbp + 0x28]
call fcn.14002b3ab
jmp 0x14006fd39
mov dword [rbp + 0x90], 0x238
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x68]
call fcn.14002ae24
test eax, eax
jne 0x14006fc66
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x28]
call fcn.14002b3ab
jmp 0x14006fd39
lea rdx, [rbp + 0xbc]
lea rcx, [rbp + 0x28]
call fcn.14002a7cb
movzx eax, al
test eax, eax
je 0x14006fd0d
mov r8d, dword [rbp + 0x98]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2e8], rax
cmp qword [rbp + 0x2e8], 0
jne 0x14006fca8
jmp 0x14006fd0d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtSuspendProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
jne 0x14006fce5
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006fd0d
mov rax, qword [rbp + 0x308]
mov qword [rbp + 0x498], rax
mov rcx, qword [rbp + 0x2e8]
call qword [rbp + 0x498]
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x68]
call fcn.14002b3d8
test eax, eax
jne 0x14006fc66
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x28]
call fcn.14002b3ab
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.14002b2e8
mov rcx, qword [rbp + 0x4b0]
xor rcx, rbp
call fcn.14002ab77
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret
Function at 0x14002b928
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x1400733d0
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rdx, qword [rsp + 0x70]
mov ecx, 0x105
call fcn.14002aa19
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14007340f
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
jmp 0x1400734b0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0xffffffff
je 0x140073430
mov eax, dword [rsp + 0x24]
and eax, 0x10
test eax, eax
jne 0x140073447
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 0xffffffff
mov rax, qword [rsp + 0x34]
jmp 0x1400734b0
mov eax, dword [rsp + 0x24]
and eax, 0x400
test eax, eax
je 0x14007349b
mov r9d, 0x2000000
mov r8d, 0x80
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14002aba9
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x50]
call fcn.14002a348
cmp dword [rsp + 0x28], 0
je 0x14007349b
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], 0xffffffff
mov rax, qword [rsp + 0x3c]
jmp 0x1400734b0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0
mov rax, qword [rsp + 0x44]
add rsp, 0x68
ret
Function at 0x14005e710
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x20]
mov dword [rbp + 0x1e4], 0
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rax, qword [rbp + 0x248]
add rax, 0x40
mov qword [rbp + 0x1f8], rax
lea rdx, [rbp + 0xe8]
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x200], rax
mov eax, dword [rbp + 0x1e4]
or eax, 1
mov dword [rbp + 0x1e4], eax
lea rdx, str.shutdown
mov rcx, qword [rbp + 0x200]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005e7ce
mov rax, qword [rbp + 0x248]
add rax, 0xd0
mov qword [rbp + 0x208], rax
mov rdx, qword [0x1400a2b50]
mov rcx, qword [rbp + 0x208]
call fcn.14002b58b
movzx eax, al
test eax, eax
je 0x14005e7ce
mov dword [rbp + 0x210], 1
jmp 0x14005e7d8
mov dword [rbp + 0x210], 0
movzx eax, byte [rbp + 0x210]
mov byte [rbp + 0xc4], al
mov eax, dword [rbp + 0x1e4]
and eax, 1
test eax, eax
je 0x14005e805
and dword [rbp + 0x1e4], 0xfffffffe
lea rcx, [rbp + 0xe8]
call fcn.14002a44c
movzx eax, byte [rbp + 0xc4]
test eax, eax
je 0x14005e89d
lea rax, [rbp + 0x128]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x200]
mov qword [rbp + 0x208], rax
lea rdx, str.executing
lea rcx, [rbp + 0x1a8]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0x208]
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x1a8]
call fcn.14002a44c
lea rcx, str.shutdown__s__f__t_0
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14005e8b0
lea rdx, str.not_for_me__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rsp, [rbp + 0x228]
pop rdi
pop rbp
ret
Function at 0x14005e930
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x20]
mov dword [rbp + 0x1e4], 0
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rax, qword [rbp + 0x248]
add rax, 0x40
mov qword [rbp + 0x1f8], rax
lea rdx, [rbp + 0xe8]
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x200], rax
mov eax, dword [rbp + 0x1e4]
or eax, 1
mov dword [rbp + 0x1e4], eax
lea rdx, str.restart
mov rcx, qword [rbp + 0x200]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005e9ee
mov rax, qword [rbp + 0x248]
add rax, 0xd0
mov qword [rbp + 0x208], rax
mov rdx, qword [0x1400a2b50]
mov rcx, qword [rbp + 0x208]
call fcn.14002b58b
movzx eax, al
test eax, eax
je 0x14005e9ee
mov dword [rbp + 0x210], 1
jmp 0x14005e9f8
mov dword [rbp + 0x210], 0
movzx eax, byte [rbp + 0x210]
mov byte [rbp + 0xc4], al
mov eax, dword [rbp + 0x1e4]
and eax, 1
test eax, eax
je 0x14005ea25
and dword [rbp + 0x1e4], 0xfffffffe
lea rcx, [rbp + 0xe8]
call fcn.14002a44c
movzx eax, byte [rbp + 0xc4]
test eax, eax
je 0x14005eabd
lea rax, [rbp + 0x128]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x200]
mov qword [rbp + 0x208], rax
lea rdx, str.executing
lea rcx, [rbp + 0x1a8]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0x208]
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x1a8]
call fcn.14002a44c
lea rcx, str.shutdown__r__f__t_0
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14005ead0
lea rdx, str.not_for_me__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rsp, [rbp + 0x228]
pop rdi
pop rbp
ret
Function at 0x14005efd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x20]
mov dword [rbp + 0x1e4], 0
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rax, qword [rbp + 0x248]
add rax, 0x40
mov qword [rbp + 0x1f8], rax
lea rdx, [rbp + 0xe8]
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x200], rax
mov eax, dword [rbp + 0x1e4]
or eax, 1
mov dword [rbp + 0x1e4], eax
lea rdx, str.kill
mov rcx, qword [rbp + 0x200]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005f08e
mov rax, qword [rbp + 0x248]
add rax, 0xd0
mov qword [rbp + 0x208], rax
mov rdx, qword [0x1400a2b50]
mov rcx, qword [rbp + 0x208]
call fcn.14002b58b
movzx eax, al
test eax, eax
je 0x14005f08e
mov dword [rbp + 0x210], 1
jmp 0x14005f098
mov dword [rbp + 0x210], 0
movzx eax, byte [rbp + 0x210]
mov byte [rbp + 0xc4], al
mov eax, dword [rbp + 0x1e4]
and eax, 1
test eax, eax
je 0x14005f0c5
and dword [rbp + 0x1e4], 0xfffffffe
lea rcx, [rbp + 0xe8]
call fcn.14002a44c
movzx eax, byte [rbp + 0xc4]
test eax, eax
je 0x14005f17f
lea rax, [rbp + 0x128]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x200]
mov qword [rbp + 0x208], rax
lea rdx, str.Exiting
lea rcx, [rbp + 0x1a8]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0x208]
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x1a8]
call fcn.14002a44c
mov rax, qword [rbp + 0x240]
mov rax, qword [rax]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rbp + 0x240]
mov rax, qword [rax]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x14005f192
lea rdx, str.not_for_me__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rsp, [rbp + 0x228]
pop rdi
pop rbp
ret
Function at 0x1cdc6c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1cdc6ca
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1cdc6f3
pop rbp
sub rbp, 0x33
sub rbp, 0x18dc6c0
sub rsp, 0x20
jmp 0x1cdc712
mov rax, 0x18dc6c0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x2d6b8c2c
xor byte [rax], dl
inc rax
dec rcx
jne 0x1cdc731
jmp 0x1cdc748
movsd dword [rdi], dword fs:[rsi]
invalid
Function at 0x14012d5b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14012d5bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14012d5cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14012d5b5
lea eax, [rcx + 1]
jmp 0x14012d5db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14012d5ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14012d5d4
sub eax, 3
jb 0x14012d60e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14012d65d
sar eax, 1
movsxd rbp, eax
jb 0x14012d644
jmp 0x14012d61c
add ebx, ebx
jne 0x14012d61a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14012d644
inc ecx
add ebx, ebx
jne 0x14012d62a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14012d644
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14012d63d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14012d62c
add ecx, 2
jmp 0x14012d649
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14012d572
jmp 0x14012d5bd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xb5000
mov dl, 0xa
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14012d6ad
cmp rsi, rcx
jae 0x14012d6b5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14012d694
cmp al, 0x8f
ja 0x14012d694
cmp byte [rsi - 2], 0xf
je 0x14012d69a
sub al, 0xe8
cmp al, 1
ja 0x14012d67e
cmp rsi, rcx
jae 0x14012d6b5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14012d684
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14012d6b5
lodsb al, byte [rsi]
jmp 0x14012d694
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x12a000]
mov eax, dword [rdi]
or eax, eax
je 0x14012d712
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x12d000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14012d6c2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14012d70c
mov qword [rbx], rax
add rbx, 8
jmp 0x14012d6e2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14012d74c
cmp al, 0xef
ja 0x14012d73e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14012d71e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14012d72d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14012d7cb], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14012d7cb
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14012d7bb
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0