joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d660
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14005f650]
xor rax, rsp
mov qword [rbp + 0x170], rax
and dword [rsp + 0x40], 0
and qword [rsp + 0x30], 0
mov r9, rcx
lea rcx, [rsp + 0x60]
lea r8, str.SYSTEMCurrentControlSetServicesEventLogApplication_s
mov edx, 0x104
call fcn.14002933c
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14001d7dc
mov rcx, qword [0x140061ff0]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x60]
call fcn.1400285ac
lea rdx, str.EventMessageFile
mov r9d, 2
lea ecx, [rax*2 + 2]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001d7dc
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
lea rdx, str.TypesSupported
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001d7dc
cmp dword [rsp + 0x40], eax
jbe 0x14001d7d1
lea rcx, [rsp + 0x60]
call fcn.1400285ac
lea rdx, str.CategoryMessageFile
mov r9d, 2
lea ecx, [rax*2 + 2]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001d7dc
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea rdx, str.CategoryCount
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001d7dc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140027b60
add rsp, 0x280
pop rbp
ret
Function at 0x14001f460
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd r14, edx
mov rsi, r8
lea r8, str.bad_pack_level
lea eax, [r14 - 1]
mov rbx, rcx
cmp eax, 7
setbe dl
call fcn.14001dd2c
xor edi, edi
mov dword [rcx + 0x6afc0], edi
cmp dword [rcx + 0x6afb8], edi
jne 0x14001f4bc
mov dword [rcx + 0x6afc0], 1
mov dword [rcx + 0x6afb8], 0x10000
mov dword [rcx + 0x6afb4], edi
add rcx, 0x4afb8
xor edx, edx
mov r8d, 0x1fffc
call fcn.140028890
lea rdx, [0x140053d90]
mov ebp, 2
movzx eax, word [rdx + r14*8 + 2]
mov dword [rbx + 0x6afe0], eax
movzx eax, word [rdx + r14*8]
mov dword [rbx + 0x6afe4], eax
movzx eax, word [rdx + r14*8 + 4]
mov dword [rbx + 0x6afe8], eax
movzx eax, word [rdx + r14*8 + 6]
mov dword [rbx + 0x6afdc], eax
cmp r14d, ebp
jg 0x14001f51c
or word [rsi], 4
jmp 0x14001f525
cmp r14d, 8
jl 0x14001f525
or word [rsi], bp
lea rsi, [rbx + 0x1afb8]
mov r8d, 0x10000
mov rcx, rbx
mov rdx, rsi
mov dword [rbx + 0x6afcc], edi
mov dword [rbx + 0x6afbc], edi
call qword [rbx + 0x10]
mov dword [rbx + 0x6afd8], eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x14001f58e
mov dword [rbx + 0x6afd4], edi
cmp eax, 0x106
jae 0x14001f56a
mov rcx, rbx
call fcn.14001f7c8
mov dword [rbx + 0x6afc4], edi
movzx eax, byte [rsi]
shl edi, 5
inc rsi
xor edi, eax
and edi, 0x7fff
mov dword [rbx + 0x6afc4], edi
dec rbp
jne 0x14001f570
jmp 0x14001f599
mov qword [rbx + 0x6afd4], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001f920
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov dword [rcx + 0x6afc8], 2
mov ebp, edi
mov esi, edi
cmp dword [rcx + 0x6afd8], edi
je 0x14001fb56
mov r12d, 0x7fff
cmp dword [rbx + 0x6afd8], 3
jb 0x14001f9b5
mov r8d, dword [rbx + 0x6afcc]
lea eax, [r8 + 2]
movzx edx, byte [rax + rbx + 0x1afb8]
mov eax, dword [rbx + 0x6afc4]
shl eax, 5
xor edx, eax
and edx, r12d
and r8, r12
mov eax, edx
mov dword [rbx + 0x6afc4], eax
mov ebp, dword [rbx + rdx*4 + 0x4afb8]
mov dword [rbx + r8*4 + 0x2afb8], ebp
mov ecx, dword [rbx + 0x6afc4]
mov eax, dword [rbx + 0x6afcc]
mov dword [rbx + rcx*4 + 0x4afb8], eax
test ebp, ebp
je 0x14001f9f3
mov eax, dword [rbx + 0x6afcc]
sub eax, ebp
cmp eax, 0x7efa
ja 0x14001f9f3
mov eax, dword [rbx + 0x6afd8]
cmp dword [rbx + 0x6afe8], eax
jbe 0x14001f9dc
mov dword [rbx + 0x6afe8], eax
mov edx, ebp
mov rcx, rbx
call fcn.14001f5b4
mov ecx, dword [rbx + 0x6afd8]
cmp eax, ecx
mov esi, eax
cmova esi, ecx
mov rcx, rbx
cmp esi, 3
jb 0x14001fad2
mov edx, dword [rbx + 0x6afcc]
lea r8d, [rsi - 3]
sub edx, dword [rbx + 0x6afd0]
call fcn.14001ed38
sub dword [rbx + 0x6afd8], esi
mov r9d, eax
cmp esi, dword [rbx + 0x6afe0]
ja 0x14001fa8a
cmp dword [rbx + 0x6afd8], 3
jb 0x14001fa8a
dec esi
inc dword [rbx + 0x6afcc]
mov r8d, dword [rbx + 0x6afcc]
lea eax, [r8 + 2]
and r8, r12
movzx edx, byte [rax + rbx + 0x1afb8]
mov eax, dword [rbx + 0x6afc4]
shl eax, 5
xor edx, eax
and edx, r12d
mov eax, edx
mov dword [rbx + 0x6afc4], eax
mov ebp, dword [rbx + rdx*4 + 0x4afb8]
mov dword [rbx + r8*4 + 0x2afb8], ebp
mov ecx, dword [rbx + 0x6afc4]
mov eax, dword [rbx + 0x6afcc]
mov dword [rbx + rcx*4 + 0x4afb8], eax
dec esi
jne 0x14001fa30
jmp 0x14001faf1
add dword [rbx + 0x6afcc], esi
mov ecx, dword [rbx + 0x6afcc]
lea r8, str.Call_UPDATE_HASH___MIN_MATCH_3_more_times
movzx edx, byte [rcx + rbx + 0x1afb8]
lea eax, [rcx + 1]
mov rcx, rbx
mov dword [rbx + 0x6afc4], edx
movzx eax, byte [rax + rbx + 0x1afb8]
shl edx, 5
xor eax, edx
mov dl, 1
mov esi, edi
and eax, r12d
mov dword [rbx + 0x6afc4], eax
call fcn.14001dd2c
jmp 0x14001faf7
mov eax, dword [rbx + 0x6afcc]
xor edx, edx
movzx r8d, byte [rax + rbx + 0x1afb8]
call fcn.14001ed38
dec dword [rbx + 0x6afd8]
mov r9d, eax
inc dword [rbx + 0x6afcc]
test r9d, r9d
je 0x14001fb36
mov ecx, dword [rbx + 0x6afbc]
test ecx, ecx
js 0x14001fb12
lea rdx, [rbx + 0x1afb8]
add rdx, rcx
jmp 0x14001fb15
mov rdx, rdi
mov r8d, dword [rbx + 0x6afcc]
xor r9d, r9d
sub r8d, ecx
mov rcx, rbx
call fcn.14001eae4
mov eax, dword [rbx + 0x6afcc]
mov dword [rbx + 0x6afbc], eax
cmp dword [rbx + 0x6afd8], 0x106
jae 0x14001fb4a
mov rcx, rbx
call fcn.14001f7c8
cmp dword [rbx + 0x6afd8], edi
jne 0x14001f95e
mov ecx, dword [rbx + 0x6afbc]
test ecx, ecx
js 0x14001fb6a
lea rdi, [rbx + 0x1afb8]
add rdi, rcx
mov r8d, dword [rbx + 0x6afcc]
mov r9d, 1
mov rdx, rdi
sub r8d, ecx
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
jmp fcn.14001eae4
Function at 0x1400209f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140020a09
xor eax, eax
jmp 0x140020a7a
not r9d
lea rdi, [0x140053990]
cmp r8, 8
jb 0x140020a50
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
mov ebx, 8
movzx ecx, byte [r11]
mov eax, r9d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec rbx
jne 0x140020a2c
dec r10
jne 0x140020a27
test r8, r8
je 0x140020a74
movzx ecx, byte [r11]
mov eax, r9d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r8
jne 0x140020a55
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140020c3c
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x88
mov rax, qword [0x14005f650]
xor rax, rsp
mov qword [rbp + 7], rax
mov r12, qword [rbp + 0x7f]
mov r14, r9
mov r15, r8
mov r13, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov esi, 1
cmp eax, esi
je 0x140020c8c
mov eax, 0x1000000
jmp 0x140020e2c
lea rdx, [rbp - 0x31]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x140020ca7
mov eax, 0x200
jmp 0x140020e2c
mov eax, dword [rbp - 0x31]
mov ebx, 0
mov edx, eax
and edx, esi
cmovne ebx, esi
test al, 2
je 0x140020cbd
or ebx, 2
test al, 4
je 0x140020cc4
or ebx, 4
mov ecx, eax
and ecx, 0x10
je 0x140020cce
or ebx, 0x10
test al, 0x20
je 0x140020cd5
or ebx, 0x20
test ecx, ecx
je 0x140020cdf
bts ebx, 0x1e
jmp 0x140020ce3
bts ebx, 0x1f
bts ebx, 0x18
test edx, edx
jne 0x140020cef
bts ebx, 0x17
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0x28
jbe 0x140020dc6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x39]
lea rdx, [rbp - 0x41]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x39]
lea rdx, [rbp - 0x3d]
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [rbp - 0x41], ax
jne 0x140020dc6
mov edx, dword [rbp - 0x3d]
lea eax, [rdx + 0x34]
cmp esi, eax
jbe 0x140020dc6
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x39]
lea rdx, [rbp - 0x35]
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x35]
cmp eax, 0x5a4d
je 0x140020dc2
add eax, 0xffffbab4
cmp eax, 4
ja 0x140020dc6
mov ecx, 0x15
bt ecx, eax
jae 0x140020dc6
bts ebx, 0x16
test r13, r13
je 0x140020dcf
mov dword [r13], ebx
test r15, r15
je 0x140020dd7
mov dword [r15], esi
test r14, r14
je 0x140020e02
mov rcx, qword [rbp - 0x25]
call fcn.140020b6c
mov rcx, qword [rbp - 0x1d]
mov qword [r14], rax
call fcn.140020b6c
mov rcx, qword [rbp - 0x2d]
mov qword [r14 + 8], rax
call fcn.140020b6c
mov qword [r14 + 0x10], rax
test r12, r12
je 0x140020e2a
lea r8, [rbp - 0x3d]
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x1d]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx ecx, word [rbp - 0x41]
movzx eax, word [rbp - 0x3d]
shl ecx, 0x10
or ecx, eax
mov dword [r12], ecx
xor eax, eax
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140027b60
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140020efc
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
jne 0x140020f04
xor eax, eax
ret
jmp fcn.140020f0c
Function at 0x140020f0c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov edi, r8d
mov rbx, rcx
je 0x140020f4a
mov ecx, dword [rcx + 0x28]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x2c]
jb 0x140020f37
mov dword [rbx + 0x14], 0x30000
jmp 0x140020f73
add rcx, qword [rbx + 0x20]
mov r8, rdi
call fcn.140027d80
add dword [rbx + 0x28], edi
mov eax, edi
jmp 0x140020f75
mov rcx, qword [rcx]
test rcx, rcx
je 0x140020f6c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
jmp 0x140020f75
mov dword [rbx + 0x14], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140021254
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x88]
mov rbp, rdx
test rcx, rcx
je 0x1400212c0
mov eax, dword [rdi + 0x94]
mov esi, dword [rdi + 0x90]
cmp eax, esi
jae 0x140021301
sub esi, eax
lea rdx, [rcx + rax]
mov rcx, rbp
cmp esi, r8d
cmova esi, r8d
mov r8d, esi
call fcn.140027d80
mov ecx, dword [rdi + 0x70]
add dword [rdi + 0x94], esi
add dword [rdi + 0x6c], esi
mov r8d, esi
mov rdx, rbp
call fcn.1400209f0
mov dword [rdi + 0x70], eax
mov eax, esi
jmp 0x140021303
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x1400212fa
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140021301
mov ebx, dword [rsp + 0x40]
mov ecx, dword [rdi + 0x70]
mov rdx, rbp
add dword [rdi + 0x6c], ebx
mov r8d, ebx
call fcn.1400209f0
mov dword [rdi + 0x70], eax
mov eax, ebx
jmp 0x140021303
mov dword [rdi + 0x14], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140029360
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140029376
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140029378
xor eax, eax
test eax, eax
je 0x140029388
mov ecx, eax
call fcn.14002e584
or eax, 0xffffffff
jmp 0x14002938a
xor eax, eax
add rsp, 0x28
ret
jmp 0x140029360

Function at 0x140029390
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140029376
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140029378
xor eax, eax
test eax, eax
je 0x140029388
mov ecx, eax
call fcn.14002e584
or eax, 0xffffffff
jmp 0x14002938a
xor eax, eax
add rsp, 0x28
ret
jmp 0x140029360
Function at 0x180093b94
Capabilities:
Terminate process

Disassembly:
jmp 0x1801b5390
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x30007ea0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x3000a228]
jne 0x30007eab
repz ret
jmp 0x30008480
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x3000c300]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x3000c3f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x30008505
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x3000c300]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x30008527
mov rax, qword [rsp + 0x88]
mov qword [0x3000c3f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x3000c398], rax
mov rax, qword [0x3000c3f8]
mov qword [0x3000c270], rax
mov rax, qword [rsp + 0x90]
mov qword [0x3000c380], rax
mov dword [0x3000c260], 0xc0000409
mov dword [0x3000c264], 1
mov rax, qword [0x3000a228]
mov qword [rsp + 0x68], rax
mov rax, qword [0x3000c1f8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x3000c2f8], eax
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x3000a268]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x3000c2f8], 0
jne 0x300085ae
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1400045f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140032040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400046ae
mov qword [rsp + 0x170], rbx
lea rcx, [rsp + 0x4c]
mov r8, rsi
sub r8, rcx
nop dword [rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140004663
inc rcx
test eax, eax
jne 0x140004650
test edx, edx
jne 0x140004694
mov r8d, dword [rsp + 0x28]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140004694
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140004642
mov rbx, qword [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400230b0
mov rsi, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret

Function at 0x140004980
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.1400045f0
lea rcx, str.EpicGamesLauncher.exe
call fcn.1400045f0
lea rcx, str.FortniteLauncher.exe
call fcn.1400045f0
lea rcx, str.FortniteClient_Win64_Shipping_BE.exe
call fcn.1400045f0
lea rcx, str.FortniteClient_Win64_Shipping_EAC.exe
call fcn.1400045f0
lea rcx, str.FortniteClient_Win64_Shipping_EAC_EOS.exe
call fcn.1400045f0
lea rcx, str.EasyAntiCheat.exe
call fcn.1400045f0
lea rcx, str.BattleEyeAnticheat.exe
call fcn.1400045f0
lea rcx, str.BattleEye_Launcher
add rsp, 0x28
jmp fcn.1400045f0
Function at 0x140004a50
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140032040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x68
call fcn.140023458
mov r14, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [r14], 0x68
lea rdi, [rsp + 0x50]
mov ecx, 0x18
xor r9d, r9d
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rdx, rsi
xor eax, eax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004af2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x50]
jmp 0x140004b10
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__X__Failed_to_create_process._n
call fcn.140011820
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400230b0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x140005080
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140032040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, ecx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edi, edi
mov word [rsp + 0x22], bx
mov word [rsp + 0x20], di
mov rcx, rax
mov ebx, dword [rsp + 0x20]
mov rsi, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebp, word [rsp + 0x30]
mov eax, 0xfff0
movzx edx, bp
mov rcx, rsi
and dx, ax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp di, word [rsp + 0x36]
jge 0x14000511e
nop dword [rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140026ef0]
call fcn.140011820
movsx eax, word [rsp + 0x36]
inc edi
cmp edi, eax
jl 0x140005100
movzx edx, bp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400230b0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000a6e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14000a701
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000a72e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000a730
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000a789
test ecx, ecx
jle 0x14000a769
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000a789
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000a789
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14000a7b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000a7d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14000a7e1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000a804
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000a806
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000a842
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000a8de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000a87d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000a8be
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000a8de
cmp rbx, rax
ja 0x14000a890
test rbx, rbx
je 0x14000a8de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret