joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d4e2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [0x4770b4], 0x812
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, 0xfffff75d
mov esi, dword [ebp - 8]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [0x4770b4], 0xfffff75d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jmp 0x40d5b3
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x40d661
jmp 0x40d652
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x40d5fd
jmp 0x40d652
mov eax, dword [ebp - 0x24]
mov dword [0x4770b8], 0xcc3
mov dword [0x4770b4], 0x782
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x40d54e
jmp 0x40d652
mov dword [0x4770b8], 0x1e62
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x40d635
jmp 0x40d652
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp word [edx + ecx*2], 0
mov esi, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], esi
je 0x40d566
mov eax, dword [ebp - 0x2c]
add eax, 1
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffff7d9
mov dword [0x4770b4], ecx
cmp eax, 0x104
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jl 0x40d5b3
jmp 0x40d566
mov dword [0x4770b4], 0xa79
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x40d652
mov dword [0x4770b8], 0x1791
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x40d591
jmp 0x40d652
mov dword [0x4770b8], 0x209c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x40d52e
xor eax, eax
mov dword [0x4770b4], 0x240f
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x40db61
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x4770b4], 0xe73
mov dword [0x4770c0], 0
mov byte [0x4770c4], 0
mov dword [0x4770b8], 0x19a7
mov dword [0x4770bc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x40dc83
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
add ecx, 0x72d
mov dword [0x4770c8], 0
mov dword [0x4770b4], 0xc05
mov edi, dword [0x4770c0]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x4770c8], esi
mov dword [0x4770b8], ecx
mov eax, esi
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x4770c0], edx
mov esi, dword [ebp - 0x28]
mov cl, byte [ebx + esi]
mov byte [0x4770c4], cl
mov dword [0x4770b4], 0x2252
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x4770c4]
mov edx, dword [0x4770c0]
mov byte [ebx + edx], cl
mov edx, dword [0x4770b8]
mov ecx, edx
add ecx, 0xffffddf4
mov dword [0x4770b4], ecx
mov ecx, dword [0x4770bc]
add ecx, 1
mov dword [0x4770bc], ecx
cmp ecx, 0x100
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
jl 0x40dbb5
jmp 0x40dcd9
mov eax, dword [ebp - 0x1c]
mov dword [0x4770b4], 0x1441
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x4770bc]
add eax, 1
mov dword [0x4770bc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x40dc83
mov eax, 0x1499
xor ecx, ecx
mov dword [0x4770b8], 0x1499
mov dword [0x4770bc], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x40dbb5
mov dword [0x4770b4], 0x1375
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40df86
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0xffffe76c
xor ebx, ebx
mov dword [0x4770b8], 0x1484
mov dword [0x4770bc], 0
mov dword [0x4770c0], 0
mov dword [0x4770cc], 0
mov dword [0x4770b4], 0x6f3
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
jne 0x40e016
mov eax, dword [ebp - 0x28]
mov dword [0x4770b8], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x4770b4]
add eax, 0xffffe079
mov dword [ebp - 0x28], eax
jmp 0x40dff7
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
mov edi, eax
add edi, 1
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x4770bc], edx
mov dword [0x4770b4], 0x20b
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x4770c0], edx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x4770c4], cl
mov dword [0x4770b4], 0x1eea
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x4770c4]
mov edx, dword [0x4770c0]
mov byte [ebx + edx], cl
mov dword [0x4770b4], 0x2675
mov edx, dword [0x4770bc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x4770c0]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x4770cc], ecx
mov dword [0x4770b4], 0x3536
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x4770b4], 0x12e
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x3c], edi
je 0x40e007
mov eax, dword [0x4770bc]
mov ecx, dword [0x4770c0]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], edx
jmp 0x40e016
Function at 0x40e116
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x4770b4]
add edx, 0xfffff52b
mov dword [0x4770b8], edx
mov dword [0x4770b4], 0x13a1
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.0040d699
mov ecx, 0x27ec
lea edx, [0x40cc38]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x40], 0x132e00
mov esi, dword [0x4770a0]
mov dword [esp + 0x64], esi
mov esi, dword [0x4770a4]
mov dword [esp + 0x44], esi
mov esi, dword [0x4770a8]
mov dword [esp + 0x38], esi
mov esi, dword [0x4770ac]
mov dword [esp + 0x60], esi
mov dword [0x4770b4], 0x27ec
mov esi, dword [0x4770b0]
mov dword [esp + 0x88], esi
mov dword [0x4770b8], 0x2541
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
jmp 0x40e240
mov eax, dword [esp + 0x14]
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x48], edx
mov dword [0x4770b4], 0x44e0
call fcn.0040d4e2
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x40e236
lea eax, [esp + 0x38]
mov dword [0x4770b8], 0x10cd
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0040caf7
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x4770b8], 0xa7a
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
mov dword [esp + 8], ecx
jne 0x40e26f
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x40e1c5
mov eax, dword [esp + 8]
add eax, 0x782
mov ecx, dword [esp + 0x14]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [0x4770b4], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
jmp 0x40e240
Function at 0x100175b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
xor eax, eax
movzx bx, cl
not di
push 0x79bb4d7
pushal
mov ebx, dword [esp + 0x24]
pushfd
mov edi, dword [esp + 0x2c]
movsx si, al
call fcn.1000f328
jp 0x1000e6a4
sub byte [edi], 0xe7
add byte [ebx], ch
xlatb
push cs
invalid
add al, 0x8d
or al, 0x7d
mov esp, 0x66a2137f
bswap ecx
movsx cx, al
movzx cx, al
mov ecx, dword [esp + 8]
jmp 0x10017f88
mov dword [0x871de3f5], eax
mov cl, 0x5c
ficomp dword [esi + 0x4cf51056]
pop es
push edx
mov ecx, 0x4d914a81
xor ebx, ebp
ror dword [eax - 0x17], 1
pushal
jmp 0x10010e06
mov edi, dword [edi + ecx*4]
clc
cmp esp, eax
test edi, edi
call 0x1000f502
mov al, ch
mov byte [edi - 1], 0
pushal
bswap ax
mov dword [esp + 0x1c], ebx
mov byte [esp], bh
sete ah
lea esp, [esp + 0x1c]
jb 0x10010a3d
lahf
lea eax, [0x1000ee09]
pushfd
mov dword [esp], 0x10012ab2
push esi
pushfd
call fcn.1000fd9a
mov eax, 0x145c2863
cmp al, 0x56
add byte [edi], dh
cld
lea edi, [ebp + 0x3d084fb5]
je 0x1000f23b
pop edx
push 0x7c968f3b
sub dword [edx + esi + 0x7f], edi
cdq
imul esp, ebx, 0x5b
call 0xb0a24c05
jmp 0xc2e8d518
lahf
call fcn.10012670
mov byte [esp], 0xb6
push dword [esp]
call fcn.1001941e
mov dword [esp + 4], esi
mov word [esp], di
pushfd
clc
mov dword [esp + 4], edi
clc
mov dword [esp], ebx
test bh, 0xa7
test eax, eax
call fcn.1000e85f
add byte [eax], al
push esi
imul esi, dword [edx + 0x74], 0x506c6175
jb 0x10010ae6
je 0x10010ade
arpl word [eax + eax - 0x64], si
test edx, edx
mov byte [esp + 4], dl
pushfd
pushfd
mov byte [esp + 8], 0xde
lea esp, [esp + 0x18]
je 0x1000e650
stc
cmc
add edx, ebx
sal di, 0xb
test bp, sp
ror edi, 7
mov dword [ebp - 4], edx
push ecx
push edi
add byte [ebx - 0x762b1f37], bh
jns 0x10010b65
mov dword [ecx + 0x7c], edi
xor al, 0xa2
call 0x1f7438f3
mov eax, 0xfe5f357f
daa
and byte [esi], cl
push ebp
sub bl, 0x7f
jmp [eax]
xchg ebp, eax
push 0x76884a40
xchg edi, eax
hlt
pushfd
call fcn.1001042c
lea esp, [esp + 0x2c]
jne 0x1000fc07
movzx eax, dl
jmp 0x1000f266
push 0x156020d
mov esp, ebp
movsx bp, bl
jmp 0x10010d7d
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x207c20fe
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x6ddd100f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0xd7e818
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd7e822
pushal
call 0xd7e828
pop ebp
sub ebp, 0x10
sub ebp, 0x97e818
jmp 0xd7e83e
mov eax, 0x97e818
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d5
mov edx, 0x10a563be
xor byte [eax], dl
inc eax
dec ecx
jne 0xd7e855
jmp 0xd7e868
xor eax, 0x82373573
mov esi, 0x7f3fbebe
inc esi
mov esi, 0x73bdbebe
push es
mov eax, 0x4bebebe
xchg esi, eax
mov esi, 0x5c49bebe
mov ebp, 0xb23f3576
mov esi, 0x7bbdbebe
out dx, al
xor ebx, edx
lcall 0x42d6, 0x9aba3742
rcr dword [esi - 0x3b5d2942], cl
leave
mov esi, 0xd69a92bf
nop
cmp esp, edx
lds edx, [esi - 0x45]
mov esi, 0x8857bebe
mov esi, 0xda33bebe
lcall 0xd233, 0x9a923742
lcall 0xbebe, 0xb63b35be
mov esi, 0xbeb22b35
mov esi, 0xae3335be
mov esi, 0x577fbebe
mov esp, 0x7c3dbc8f
mov edx, 0x4a3bb1f7
inc ecx
inc ecx
inc ecx
xor eax, 0xda339a92
lcall 0x3235, 0xbeb27cba
lcall 0x42d6, 0xbebebeba
rcr dword [esi - 0x3b5d2942], cl
leave
mov esi, 0x339a92bf
ficomp dword [edx - 0x654dc8be]
push esi
mov ebx, 0x57bebebe
cmc
mov esp, 0xda33bebe
lcall 0xe3ea, 0x9a923742
inc ecx
retf
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408e54
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3d804216
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3acf4614
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401560
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x1c], 1
mov edx, 0xc
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [ebp + eax - 0x18], ecx
mov dword [ebp + eax - 0x14], edx
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0x10], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403925
mov esp, ebp
pop ebp
ret

Function at 0x4015f0
Capabilities:
Enumerate processes
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401560
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x4016c8
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x4016c8
push str.EpicGamesLauncher.exe
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4016c3
mov edx, dword [ebp - 0x124]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x134], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TASKKILL__F__IM_EpicGamesLauncher.exe__NUL_2__1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push str._n______Closed_Epic_Games_n
call fcn.00403900
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40163f
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403925
mov esp, ebp
pop ebp
ret
Function at 0x4016f0
Capabilities:
Enumerate processes
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401560
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x4017c8
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x4017c8
push str.UnrealCEFSubProcess.exe
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4017c3
mov edx, dword [ebp - 0x124]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x134], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TASKKILL__F__IM_UnrealCEFSubProcess.exe__NUL_2__1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push str._n______Closed_UnrealCEFSub_n
call fcn.00403900
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40173f
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403925
mov esp, ebp
pop ebp
ret

Function at 0x4017f0
Capabilities:
Enumerate processes
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401560
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x4018c8
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x4018c8
push str.FortniteClient_Win64_Shipping.exe.exe
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4018c3
mov edx, dword [ebp - 0x124]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x134], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TASKKILL__F__IM_FortniteClient_Win64_Shipping.exe__NUL_2__1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push str._n______Closed_FortniteClient_n
call fcn.00403900
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40183f
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403925
mov esp, ebp
pop ebp
ret