joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d004
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001d1f5
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001d0a6
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001d0c8
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x14003cc50]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001d1e8
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001d116
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001d11a
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001c76c
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.14001cba4
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001d105
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001d054
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001e35c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140049ae8]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140008bcc
mov rcx, qword [0x14004a2e8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x14004a2f0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14004a2f8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x14004a2f0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.140008bcc
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14001e485
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x14004a2e8]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14004a2e8]
jne 0x14001e4da
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001e4da
mov rcx, qword [0x14004a2e8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001e4da
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14001e4e8
or eax, 0xffffffff
jmp 0x14001e4ed
call fcn.140008c08
cmp dword [0x140048138], eax
je 0x14001e500
mov dword [0x140048138], eax
call fcn.14001e528
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400397f0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140028ce4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x140028e34
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call fcn.140032eec
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140028d88
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
jmp 0x140028e36
mov eax, dword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x140028df1
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
je 0x140028e0b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x140028e36
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
jmp 0x140028e36
xor eax, eax
add rsp, 0x88
ret
Function at 0x140032eec
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000023
je 0x140032f3d
cmp dword [rsp + 0x30], 0x80000005
jne 0x140032f43
mov eax, dword [rsp + 0x34]
jmp 0x140032f45
xor eax, eax
add rsp, 0x48
ret

Function at 0x14003318c
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140049ae8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x1400331e5
cmp dword [rsp + 0x90], 0x7c
jge 0x1400331e5
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x140048770]
call fcn.14003368c
lea rcx, [rsp + 0x50]
call fcn.14002b368
nop
cmp qword [rsp + 0x30], 0
jne 0x14003320b
lea rdx, [0x140042048]
lea rcx, [rsp + 0x50]
call fcn.14002c3b8
jmp 0x14003321a
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002c3b8
cmp dword [rsp + 0xa0], 1
jne 0x140033235
lea rdx, [0x140042058]
lea rcx, [rsp + 0x50]
call fcn.14002c3b8
movss xmm2, dword [0x140040d70]
movss xmm1, dword [0x140042460]
lea rcx, [rsp + 0x48]
call fcn.14002b884
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.140036130
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140021cec
movzx eax, al
test eax, eax
je 0x1400332aa
cmp dword [rsp + 0xa0], 0
jne 0x1400332aa
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.14002be88
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400397f0
add rsp, 0x88
ret
Function at 0x14003354c
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x140041200]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400411f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400335d5
lea rcx, [0x140041218]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400335d5
lea rcx, [0x14004122c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400335d5
xor al, al
jmp 0x140033687
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041238]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140033657
lea rcx, [0x140041270]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140033657
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041278]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140033657
xor al, al
jmp 0x140033687
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14004a880]
call fcn.14003a37a
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x14004a8a0]
call fcn.14003a37a
mov al, 1
add rsp, 0x38
ret

Function at 0x1400341b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400341e2
xor eax, eax
jmp 0x140034238
mov r8d, 0x1e
lea rdx, [0x14004a8a0]
mov rcx, qword [rsp + 0x28]
call fcn.14003a37a
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140034e14
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x44], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034eea
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034eda
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
jmp 0x140034f7c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034f71
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034f71
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov al, byte [rsp + 0x40]
add rsp, 0x88
ret
Function at 0x140036a0c
Capabilities:
Delete file
Execute command

Disassembly:
push rdi
sub rsp, 0x210
mov rax, qword [0x140049ae8]
xor rax, rsp
mov qword [rsp + 0x200], rax
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140040e5c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.__1__Load_Cheat_n__2__Load_Driver_n_n__
call fcn.140039064
lea rdx, [rsp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 2
je 0x140036a8e
jmp 0x140036be5
lea rcx, [0x140040e90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.14002c654
mov rcx, rax
call fcn.14002c468
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x21]
call fcn.14002c680
mov rcx, rax
call fcn.14002c468
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x22]
call fcn.14002c6ac
mov rcx, rax
call fcn.14002c448
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x23]
call fcn.14002c6d8
mov rcx, rax
call fcn.14002c428
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x24]
call fcn.14002c704
mov rcx, rax
call fcn.14002c428
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x25]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x25]
call fcn.14002c730
mov rcx, rax
call fcn.14002c408
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, [0x140040e98]
lea rdx, str.Loaded
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140036a27
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400397f0
add rsp, 0x210
pop rdi
ret
Function at 0x14003807c
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140034804]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x140034cbc]
mov qword [rsp + 0x78], rax
lea rax, [0x140040f78]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x140038134
lea rdx, str._n_n_notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028764
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, [0x140040f90]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14004a8f0], rax
mov edx, 5
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140040f68]
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x140038e94
Capabilities:
Create thread
Execute command
Hide graphical window
Set console window title

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140049ae8]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [0x140040e94]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x40], rax
call fcn.14003354c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140034154]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.YomaiCheats___Join_the_Discord_to_buy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.140036a0c
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140040ed8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140040edc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140040ee0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x140040ee4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x14004a340], 0
jne 0x140038fc5
lea rdx, str.Fortnite
lea rcx, [rsp + 0x68]
call fcn.14002ac4c
lea rcx, [rsp + 0x68]
call fcn.140036524
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14004a340], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140038f81
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rdx, [0x140040ef8]
mov rcx, qword [rsp + 0x30]
call fcn.14002b310
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140035420
mov dword [0x14004a334], eax
xor edx, edx
mov rcx, qword [0x14004a820]
call fcn.1400332cc
movzx eax, al
test eax, eax
je 0x140039036
mov edx, dword [0x14004a334]
mov rcx, qword [0x14004a820]
call fcn.14002c9c8
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, qword [0x14004a820]
call fcn.140032f4c
mov qword [0x14004a338], rax
call fcn.14003807c
call fcn.140038208
call fcn.140038a14
call fcn.140038d7c
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400397f0
add rsp, 0x88
ret

Function at 0x140039ef4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140039f3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140039f3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140039f3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140039f3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140039f3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140039f40
xor al, al
add rsp, 0x28
ret
Function at 0x13a489c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13a48a6
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x13a48cf
pop rbp
sub rbp, 0x33
sub rbp, 0xfa489c
sub rsp, 0x20
jmp 0x13a48ee
mov rax, 0xfa489c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x25eafa3
xor byte [rax], dl
inc rax
dec rcx
jne 0x13a490d
jmp 0x13a4924
jmp 0x13a4950
movabs dword [0xbf1bebf3f34ba2eb], eax
mov byte fs:[rbx - 0x5c5c5c5d], ah
jmp 0x13a497c
mov bpl, 0xa3
movabs dword [0x22ebb292a14b62a3], eax
invalid
Function at 0x180001000
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x18001f018]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r15d, r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], r15
mov r14, rdx
mov qword [rsp + 0x50], r15
mov rdi, rcx
mov qword [rsp + 0x48], r15
xor r9d, r9d
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], r15
mov rcx, r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18000119e
mov qword [rsp + 0x1a8], rbp
mov ebp, r15d
cmp dword [rsp + 0x60], r15d
jbe 0x180001196
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x160], r12
lea r12, [r15 - 1]
mov qword [rsp + 0x1a0], rbx
lea rax, [rsp + 0x64]
mov dword [rsp + 0x68], 0x64
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x64], 4
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x80]
lea rax, [rsp + 0x6c]
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x180001172
cmp dword [rsp + 0x6c], 4
jne 0x180001172
mov edx, dword [rdi]
mov eax, r15d
mov esi, dword [rsp + 0x70]
mov ecx, edx
test edx, edx
je 0x180001121
mov r8, qword [rdi + 8]
mov ecx, eax
cmp dword [r8 + rcx*4], esi
je 0x180001172
inc eax
cmp eax, edx
jb 0x180001111
mov ecx, dword [rdi]
mov eax, dword [rdi + 4]
cmp edx, eax
jne 0x180001169
add eax, 0x10
mov ecx, eax
mov dword [rdi + 4], eax
mov eax, 4
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180008424
mov r8d, dword [rdi]
mov rcx, rax
mov rdx, qword [rdi + 8]
mov rbx, rax
shl r8, 2
call fcn.180009450
mov rcx, qword [rdi + 8]
mov qword [rdi + 8], rbx
call fcn.1800083e0
mov ecx, dword [rdi]
mov rax, qword [rdi + 8]
mov dword [rax + rcx*4], esi
inc dword [rdi]
inc ebp
cmp ebp, dword [rsp + 0x60]
jb 0x1800010a0
mov r12, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800083c0
add rsp, 0x170
pop r15
pop r14
pop rdi
ret