joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400423a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
add rax, 0x68
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
call fcn.140029f40
nop
mov rax, qword [rsp + 0x30]
mov edx, dword [rax]
lea rcx, [rsp + 0x58]
call fcn.140046650
lea rcx, [rsp + 0x58]
call fcn.1400466c0
cdqe
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov dword [rsp + 0x24], 0
jmp 0x140042427
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
cmp dword [rsp + 0x24], eax
jge 0x14004248b
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
call fcn.14002a0b0
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x58]
call fcn.1400466a0
mov ecx, dword [rsp + 0x38]
mov dword [rax + 4], ecx
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
call fcn.14002a0b0
movzx eax, word [rax + 2]
mov dword [rsp + 0x3c], eax
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x58]
call fcn.1400466a0
mov ecx, dword [rsp + 0x3c]
mov dword [rax + 8], ecx
jmp 0x14004241d
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400466a0
mov r8d, dword [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14002dad0
mov dword [rsp + 0x20], 0
jmp 0x1400424bd
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x20], eax
jge 0x14004259d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400466a0
cmp dword [rax + 0x14], 0
je 0x140042598
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400466a0
movzx eax, word [rax + 0xc]
mov word [rsp + 0x28], ax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call fcn.14002a0b0
movzx ecx, word [rsp + 0x28]
mov word [rax + 4], cx
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400466a0
movzx eax, word [rax + 0x10]
mov word [rsp + 0x2a], ax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call fcn.14002a0b0
movzx ecx, word [rsp + 0x2a]
mov word [rax + 6], cx
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400466a0
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400466a0
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x10]
add ecx, dword [rax + 8]
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x44], eax
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call fcn.14002c4e0
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x44], eax
jmp 0x1400424b3
lea rcx, [rsp + 0x58]
call fcn.140029f10
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006f180
add rsp, 0x78
ret
Function at 0x140049510
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140049536
mov dword [rsp + 0x20], 1
jmp 0x14004953e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400527d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3c08]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x3c10]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
call fcn.140001140
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
cmp qword [rsp + 0x30], rax
jae 0x140052920
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x1400528e2
movss xmm1, dword [rsp + 0x20]
movss xmm0, dword [rsp + 0x60]
call fcn.14002c3f0
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xb0]
test eax, eax
je 0x1400528e0
jmp 0x140052920
jmp 0x140052864
cmp dword [rsp + 0x28], 0xd
jne 0x1400528ee
jmp 0x140052864
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.14004c320
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x140052864
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rsp + 0x60]
jbe 0x140052939
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x60], xmm0
cmp qword [rsp + 0xa8], 0
je 0x140052971
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140001140
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x14008e470]
ja 0x140052991
movss xmm0, dword [rsp + 0x64]
ucomiss xmm0, dword [0x14008e470]
jp 0x1400529a3
jne 0x1400529a3
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
cmp qword [rsp + 0xa0], 0
je 0x1400529be
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006f180
add rsp, 0x78
ret
Function at 0x140066dd0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140066e6f
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140066e5b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x140066e7c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140066e33
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14006f180
add rsp, 0x280
pop rdi
ret

Function at 0x140068f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140068f7c
xor al, al
jmp 0x140068ff2
mov r8d, 0x1e
lea rdx, [0x1400927d0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x24], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [rsp + 0x24], 0
jle 0x140068fe8
mov byte [rsp + 0x20], 1
jmp 0x140068fed
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140069090
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x2d8
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
mov dword [rsp + 0x2b0], 1
mov dword [rsp + 0x2b4], 1
mov eax, 0xc
imul rax, rax, 0
lea rax, [rsp + rax + 0x2b8]
mov r8, rax
lea rdx, str.SeTcbPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400692bd
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x1400692b1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x60], 0x238
mov dword [rsp + 0x30], 0x490
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [rsp + 0x34], eax
jmp 0x140069157
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400692a4
lea rdx, str.winlogon.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14006917d
jmp 0x140069143
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140069296
lea r8, [rsp + 0x50]
mov edx, 0xa
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14006928b
lea r8, [rsp + 0x2a0]
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
je 0x14006927d
cmp dword [rsp + 0x2a0], 0
je 0x14006927d
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x2a4]
mov edx, 0xc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14006927d
mov eax, dword [rsp + 0x2e0]
cmp dword [rsp + 0x2a4], eax
jne 0x14006927d
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 2
xor r8d, r8d
mov edx, dword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140069273
mov dword [rsp + 0x30], 0
jmp 0x14006927d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x38], 0
je 0x14006929f
jmp 0x1400692a4
jmp 0x140069143
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400692bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
jmp 0x1400692c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.14006f180
add rsp, 0x2d8
ret
Function at 0x140069520
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x128
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x110], rax
lea rdx, [rsp + 0x94]
lea rcx, [rsp + 0x90]
call fcn.140069460
test eax, eax
je 0x140069648
cmp dword [rsp + 0x94], 0
je 0x140069570
mov dword [rsp + 0x90], 0
jmp 0x140069648
lea rcx, [rsp + 0x70]
call fcn.1400692f0
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0
jne 0x140069648
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140069630
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.14006f180
add rsp, 0x128
ret
Function at 0x14006a020
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x100
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x90], 0x50
mov dword [rsp + 0x94], 0
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], 0
mov dword [rsp + 0xa4], 0
mov qword [rsp + 0xa8], 0
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0xb0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
lea rax, str.GayWindowClass
mov qword [rsp + 0xd0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov word [rsp + 0x70], ax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rax, qword [0x1400926e0]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x60], 2
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, str.GayWindowTitle
movzx edx, word [rsp + 0x70]
xor ecx, ecx
call qword [rsp + 0x78]
mov qword [0x140092778], rax
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140092778]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x140092778]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov dword [rsp + 0xe0], 0xffffffff
lea rax, [rsp + 0xe4]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
lea rdx, [rsp + 0xe0]
mov rcx, qword [0x140092778]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x140092778]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140092778]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14006f180
add rsp, 0x100
pop rdi
ret
Function at 0x14006e520
Capabilities:
Enumerate gui resources

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x50
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.14006f130
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.14006e680
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x14006e5a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14006e5a3
cmp qword [rsp + 0x30], 0
je 0x14006e5a3
mov rax, qword [rsp + 0x30]
jmp 0x14006e5a5
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006f180
add rsp, 0x50
pop rdi
ret
Function at 0x14006ec40
Capabilities:
Execute command
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, str.Waiting_for_Fortnite...
call fcn.140001bd0
cmp qword [0x140092740], 0
jne 0x14006ec9d
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [0x140092788]
call fcn.140066dd0
mov dword [0x140092790], eax
mov ecx, dword [0x140092790]
call fcn.14006e520
mov qword [0x140092740], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006ec50
lea rcx, [0x140079964]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140066d00
movzx eax, al
test eax, eax
jne 0x14006ecd5
lea rcx, str.The_librarys_was_not_initialized_
call fcn.140001bd0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.140068ed0
movzx eax, al
test eax, eax
jne 0x14006ed00
lea rcx, str.The_input_was_not_initialized_
call fcn.140001bd0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.140069670
movzx eax, al
test eax, eax
jne 0x14006ed2b
lea rcx, str.The_gui_was_not_initialized_
call fcn.140001bd0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, [0x140092788]
call fcn.140066ea0
movzx eax, al
test eax, eax
jne 0x14006ed5d
lea rcx, str.The_driver_was_not_initialized_
call fcn.140001bd0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, [0x140092788]
call fcn.140066f10
mov qword [0x140092798], rax
cmp qword [0x140092798], 0
jne 0x14006ed99
lea rcx, str.The_driver_couldnt_get_the_base_address
call fcn.140001bd0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.14006a020
call fcn.140069780
call fcn.14006e690
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x28
ret

Function at 0x14006fcac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006fcf6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006fcf6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006fcf6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006fcf6
cmp dword [rcx + 0x84], 0xe
jbe 0x14006fcf6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006fcf8
xor al, al
add rsp, 0x28
ret
Function at 0x140002070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.1400f3500
sub rsp, rax
mov rax, qword [0x140235cc0]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call fcn.1400f5260
mov dword [rsp + 0x24], eax
mov r9d, 1
mov r10d, 0x270
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, r10
jb 0x1400020c3
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], r10d
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140002192
lea r8, [rsp + 0x28]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140002120
mov r10d, dword [rsp + 0x20]
mov ecx, dword [rsp + r10*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor edx, ecx
jmp 0x1400021c9
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x1400021b0
lea rcx, [rsp + 0x20]
call fcn.1400079f0
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x1400021c9
cmp r9d, ebx
jne 0x140002195
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400f2840
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400079f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140007a51
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140007a10
mov ecx, dword [r10]
jmp 0x140007b3a
cmp ecx, 0x4e0
jb 0x140007b3a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140007a70
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140007ac0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret