joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001d850
Capabilities:
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x180097030]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [0x180099704]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x18001d8e0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18001d8e0
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180096980]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180096980]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180096980]
mov eax, dword [rcx + rax]
xor eax, 0xfffffd3c
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180096980]
mov dword [rdx + rcx], eax
cmp qword [rsp + 0x88], 0
jne 0x18001d931
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x18001da6b
mov qword [rsp + 0x58], 0
lea rax, [0x180099704]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x18001d9a3
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18001d9a3
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180096980]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180096980]
mov dword [rdx + rcx], eax
mov eax, dword [rsp + 0x98]
or eax, 0x20006
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x34], eax
mov eax, 1
mov word [rsp + 0x30], ax
movsx rax, word [rsp + 0x30]
lea rcx, [0x180096980]
cmp dword [rcx + rax*4], 1
jne 0x18001da18
movsx rax, word [rsp + 0x30]
lea rcx, [0x180096980]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x30]
lea rdx, [0x180096980]
mov dword [rdx + rcx*4], eax
cmp dword [rsp + 0x34], 0
jne 0x18001da67
cmp qword [rsp + 0x58], 0
je 0x18001da67
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180096980]
mov eax, dword [rcx + rax]
xor eax, 0xfffffd12
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180096980]
mov dword [rdx + rcx], eax
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x18001da6b
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004b890
add rsp, 0x78
ret
Function at 0x180029ee0
Capabilities:
Get file attributes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0
je 0x180029f0b
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x180029f31
xor al, al
jmp 0x180029f96
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x180029f5c
cmp dword [rsp + 0x20], 0xffffffff
je 0x180029f5c
mov dword [rsp + 0x24], 1
jmp 0x180029f64
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
jmp 0x180029f96
add rsp, 0x38
ret
Function at 0x18003c9d0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x48], 0
je 0x18003c9f0
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x28], 0
je 0x18003cb18
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov rcx, rax
call fcn.18001c8a0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18003cb18
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov rcx, rax
call fcn.18001c8a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x40]
add rcx, 0x28
call fcn.18001c8a0
mov ecx, dword [rsp + 0x28]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov rcx, rax
call fcn.18001c8a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18003caae
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov rcx, rax
call fcn.18001c8a0
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18003caae
mov dword [rsp + 0x24], 0
jmp 0x18003cab6
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x2c], eax
cmp qword [rsp + 0x48], 0
je 0x18003caed
cmp dword [rsp + 0x2c], 0
je 0x18003cad9
mov eax, 0xffffffff
mov word [rsp + 0x20], ax
jmp 0x18003cae0
xor eax, eax
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x48]
movzx ecx, word [rsp + 0x20]
mov word [rax], cx
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
add eax, 0xbad53c
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
xor eax, eax
add rsp, 0x38
ret
Function at 0x180044970
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x180097030]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, str.User_Agent:_Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_535.7__KHTML__like_Gecko__Chrome_16.0.912.75_Safari_535.7_nPragma:_no_cache_nExpect:_100_continue_n
mov qword [rsp + 0x58], rax
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
add eax, 0x26a9da0
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
mov dword [rsp + 0x20], 0
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
add eax, 0x962a068
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.18001b1e0
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.18002cf90
nop
mov eax, 4
imul rax, rax, 1
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff54a
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
lea rax, [0x180084124]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x180044aae
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180044aae
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180096db0]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
lea rcx, [rsp + 0x68]
call fcn.180039b80
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov r8, rax
lea rdx, [0x180084408]
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
call qword [rax]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x180044b07
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x38], eax
lea rcx, [rsp + 0x68]
call fcn.18002dba0
mov eax, dword [rsp + 0x38]
jmp 0x180044b8f
lea rcx, [rsp + 0x68]
call fcn.18001c8a0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x38]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x180044b79
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
add eax, 0x23712e2
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x68]
call fcn.18002dba0
mov eax, dword [rsp + 0x34]
jmp 0x180044b8f
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x68]
call fcn.18002dba0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18004b890
add rsp, 0x88
ret
Function at 0x180045190
Capabilities:
Modify service

Disassembly:
sub rsp, 0x98
mov eax, 0x11
mov word [rsp + 0x60], ax
movsx rax, word [rsp + 0x60]
lea rcx, [0x180096db0]
cmp dword [rcx + rax*4], 1
jne 0x1800451d6
movsx rax, word [rsp + 0x60]
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x60]
lea rdx, [0x180096db0]
mov dword [rdx + rcx*4], eax
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x180045237
jmp 0x180045382
mov r8d, 2
lea rdx, [0x180083470]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x18004528c
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff2cb
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
jmp 0x18004534c
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8d, 2
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x180045341
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
cmp eax, 0x72148129
jne 0x180045319
lea r8, str.Local161489486444159411278948482838013536967794987001215451776x
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0x80], rax
jmp 0x180045341
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 4
imul rax, rax, 1
lea rcx, [0x180096db0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff299
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x180096db0]
mov dword [rdx + rcx], eax
add rsp, 0x98
ret
Function at 0x180056b00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x180056b2c
call fcn.1800500e0
mov dword [rax], SafeArrayCopy
call fcn.180051508
jmp 0x180056c32
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x180056c32
test al, 0x40
jne 0x180056c32
test al, 2
je 0x180056b4e
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x180056c32
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x180056b62
call fcn.18005578c
jmp 0x180056b69
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.180054e54
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.180056e60
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x180056c21
test byte [rdi + 0x18], 0x82
jne 0x180056bef
mov rcx, rdi
call fcn.180054e54
cmp eax, 0xffffffff
je 0x180056bda
mov rcx, rdi
call fcn.180054e54
cmp eax, 0xfffffffe
je 0x180056bda
mov rcx, rdi
call fcn.180054e54
mov rcx, rdi
lea rsi, [0x180121c80]
movsxd rbx, eax
sar rbx, 5
call fcn.180054e54
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x180056be1
lea rax, [0x180097ba0]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x180056bef
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x180056c0e
test byte [rdi + 0x18], 8
je 0x180056c0e
test dword [rdi + 0x18], 0x400
jne 0x180056c0e
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x180056c37
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18005a070
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
xor r9d, r9d
mov r8, qword [rsp + 0xb8]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.180063e60
mov dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.1800645c0
test rax, rax
je 0x18005a13a
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18005af30
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 8
jmp 0x18005a0e2
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x18005a10a
mov eax, dword [rsp + 0x20]
shr eax, 1
mov ecx, dword [rsp + 0x20]
and ecx, 1
xor edx, edx
sub edx, ecx
mov ecx, edx
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp + 0x20], eax
jmp 0x18005a0d8
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180098500]
mov eax, dword [rcx + rax]
add eax, 0xb719950
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
jmp 0x18005a0a3
mov eax, dword [rsp + 0x20]
not eax
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
lea rax, [0x18008ca38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x18005a1b3
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18005a1b3
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180098500]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
xor eax, eax
add rsp, 0xa8
ret
Function at 0x180061f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x180061f79
mov rax, qword [rsp]
add rax, 4
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x180062087
mov eax, 4
imul rax, rax, 1
lea rcx, [0x180098500]
mov eax, dword [rcx + rax]
xor eax, 0xffffe8b4
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
mov rax, qword [rsp]
shr rax, 2
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
and eax, 0xff
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
mov rax, qword [rsp]
shr rax, 2
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
shr eax, 8
and eax, 0xff
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
mov byte [rcx + 1], al
mov rax, qword [rsp]
shr rax, 2
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
shr eax, 0x10
and eax, 0xff
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
mov byte [rcx + 2], al
mov rax, qword [rsp]
shr rax, 2
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
shr eax, 0x18
and eax, 0xff
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
mov byte [rcx + 3], al
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180098500]
mov eax, dword [rcx + rax]
add eax, 0x1e94da29
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
jmp 0x180061f6d
add rsp, 0x18
ret
Function at 0x1800639e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180098500]
mov eax, dword [rcx + rax]
xor eax, 0xffffff03
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
xor ecx, ecx
call fcn.18005a810
mov dword [0x1800984a8], eax
mov qword [rsp + 0x28], 0x100
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
dec rax
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x38], 0
jbe 0x180063b59
lea rax, [0x18007bd70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x180063ab6
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180063ab6
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180098500]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x180098500]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x180098500]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180098500]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x180098500]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x180063b34
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180098500]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
lea rax, [0x1801223e0]
mov rcx, qword [rsp + 0x28]
mov byte [rax + rcx], 0xff
lea rax, [0x1801224e0]
mov rcx, qword [rsp + 0x28]
mov byte [rax + rcx], 0xff
jmp 0x180063a2a
mov qword [rsp + 0x20], 0
jmp 0x180063b71
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x40
jae 0x180063c44
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180098500]
mov eax, dword [rcx + rax]
add eax, 0x16f31a9
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
lea rax, [0x1800984b0]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rax + rcx]
xor rax, qword [rsp + 0x20]
add rax, 0x41
and rax, 0xff
lea rcx, [0x1800984b0]
mov rdx, qword [rsp + 0x20]
mov byte [rcx + rdx], al
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rax + rcx]
lea rcx, [0x1801223e0]
movzx edx, byte [rsp + 0x20]
mov byte [rcx + rax], dl
lea rax, [0x1800984b0]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rax + rcx]
lea rcx, [0x1801224e0]
movzx edx, byte [rsp + 0x20]
mov byte [rcx + rax], dl
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180098500]
mov eax, dword [rcx + rax]
add eax, 0xd9998c
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180098500]
mov dword [rdx + rcx], eax
jmp 0x180063b64
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x180073b90
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add rsp, 0x28
ret
Function at 0x140006380
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140060030]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000643e
mov qword [rsp + 0x170], rbx
lea rcx, [rsp + 0x4c]
mov r8, rsi
sub r8, rcx
nop dword [rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x1400063f3
inc rcx
test eax, eax
jne 0x1400063e0
test edx, edx
jne 0x140006424
mov r8d, dword [rsp + 0x28]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140006424
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400063d2
mov rbx, qword [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14002fd30
mov rsi, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x140006470
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140097ac8]
test rax, rax
je 0x14000659d
xor esi, esi
mov qword [rax + 0x10], rsi
mov rax, qword [0x140097ac8]
mov qword [rax + 0x18], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [0x140093a90], xmm0
movups xmmword [0x140093aa0], xmm0
movups xmmword [0x140093ab0], xmm0
mov qword [0x140093ac0], rsi
mov eax, esi
xchg byte [0x1400623e3], al
mov rcx, qword [0x140063498]
test rcx, rcx
je 0x140006533
call fcn.140027580
mov rbx, qword [0x140063498]
test rbx, rbx
je 0x14000652c
mov rcx, rbx
call fcn.140027580
cmp dword [rbx + 0xa8], esi
je 0x14000650a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea rcx, [rbx + 0x58]
call qword [sym.imp.MSVCP140.dll__Cnd_destroy_in_situ]
lea rcx, [rbx + 8]
call qword [sym.imp.MSVCP140.dll__Mtx_destroy_in_situ]
nop
mov edx, 0xb0
mov rcx, rbx
call fcn.140030764
mov qword [0x140063498], rsi
mov rdi, qword [0x140097ac8]
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x140006559
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x140006559
lea rdx, [rdi + 0x64]
mov ecx, dword [rdi + 0x60]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], 0
mov dword [rdi + 8], esi
mov rdi, qword [0x140097ac8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], 0
mov qword [rdi], rsi
mov qword [0x140097ac8], rsi
lea rcx, str.EpicGamesLauncher.exe
call fcn.140006380
lea rcx, str.FortniteLauncher.exe
call fcn.140006380
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.140006380
lea rcx, str.FortniteClient_Win64_Shipping_BE.exe
call fcn.140006380
lea rcx, str.FortniteClient_Win64_Shipping_EAC.exe
call fcn.140006380
lea rcx, str.EasyAntiCheat.exe
call fcn.140006380
lea rcx, str.BattleEyeAnticheat.exe
call fcn.140006380
lea rcx, str.BattleEye_Launcher
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
jmp fcn.140006380
Function at 0x140006660
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140060030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x68
call fcn.140030254
mov r14, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [r14], 0x68
lea rdi, [rsp + 0x50]
mov ecx, 0x18
xor r9d, r9d
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rdx, rsi
xor eax, eax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140006702
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x50]
jmp 0x140006720
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__X__Failed_to_create_process._n
call fcn.140014900
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002fd30
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret