joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140050e70]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000e8c9
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000e8d4
lea rdx, [0x140042b44]
mov rcx, rbx
mov rdi, rax
call fcn.14000934c
mov rbx, rax
test rax, rax
je 0x14000e8c9
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001cf88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001d179
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001d02a
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001d04c
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x140042cc0]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001d16c
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001d09a
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001d09e
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001c6bc
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.14001cb08
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001d089
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001cfd8
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001e2dc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140050ac8]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140008bcc
mov rcx, qword [0x1400512f8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x140051300]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140051308]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x140051300], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.140008bcc
mov rbx, rax
cmp byte [rax + 0x3a7], 0
je 0x14001e405
cvttss2si ecx, dword [rax + 0x110]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], ecx
cvttss2si ecx, dword [rax + 0x114]
mov dword [rbp - 0x2c], ecx
mov rcx, qword [0x1400512f8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx + 0x110], eax
mov dword [rbx + 0x114], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x1400512f8]
jne 0x14001e468
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001e468
mov rcx, qword [0x1400512f8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001e468
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x110], xmm0
movss dword [rbx + 0x114], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14001e476
or eax, 0xffffffff
jmp 0x14001e47b
call fcn.140008c08
cmp dword [0x14004f138], eax
je 0x14001e48e
mov dword [0x14004f138], eax
call fcn.14001e4b8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003f700
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1400291dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002932c
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call fcn.140037fa4
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140029280
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
jmp 0x14002932e
mov eax, dword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x1400292e9
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
je 0x140029303
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x14002932e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
jmp 0x14002932e
xor eax, eax
add rsp, 0x88
ret
Function at 0x140037fa4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000023
je 0x140037ff5
cmp dword [rsp + 0x30], 0x80000005
jne 0x140037ffb
mov eax, dword [rsp + 0x34]
jmp 0x140037ffd
xor eax, eax
add rsp, 0x48
ret

Function at 0x14003818c
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140050ac8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x1400381e5
cmp dword [rsp + 0x90], 0x7c
jge 0x1400381e5
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x14004f750]
call fcn.140038710
lea rcx, [rsp + 0x50]
call fcn.14002bbd0
nop
cmp qword [rsp + 0x30], 0
jne 0x14003820b
lea rdx, [0x140047f38]
lea rcx, [rsp + 0x50]
call fcn.14002ce24
jmp 0x14003821a
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002ce24
cmp dword [rsp + 0xa0], 1
jne 0x140038235
lea rdx, [0x140047f48]
lea rcx, [rsp + 0x50]
call fcn.14002ce24
movss xmm2, dword [0x140046de0]
movss xmm1, dword [0x140048618]
lea rcx, [rsp + 0x48]
call fcn.14002c180
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.14003b9c0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140021cb0
movzx eax, al
test eax, eax
je 0x1400382aa
cmp dword [rsp + 0xa0], 0
jne 0x1400382aa
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.14002c83c
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003f700
add rsp, 0x88
ret
Function at 0x14003854c
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x140046e40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140046e30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400385d5
lea rcx, [0x140046e58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400385d5
lea rcx, [0x140046e6c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400385d5
xor al, al
jmp 0x140038687
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140046e78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140038657
lea rcx, [0x140046eb0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140038657
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140046eb8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140038657
xor al, al
jmp 0x140038687
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x140051890]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x1400518b0]
call sub.VCRUNTIME140.dll_memcpy
mov al, 1
add rsp, 0x38
ret

Function at 0x140039364
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140039396
xor eax, eax
jmp 0x1400393ec
mov r8d, 0x1e
lea rdx, [0x1400518b0]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14003a15c
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x44], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14003a232
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14003a222
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
jmp 0x14003a2c4
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14003a2b9
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14003a2b9
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov al, byte [rsp + 0x40]
add rsp, 0x88
ret
Function at 0x14003c1c0
Capabilities:
Delete file
Execute command

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x140050ac8]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x30]
call fcn.14002bbd0
nop
lea rcx, [0x1400471a0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140046e8f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028db0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400289b4
lea rdx, [0x140047034]
lea rcx, [rsp + 0x30]
call fcn.1400291b8
movzx eax, al
test eax, eax
jne 0x14003c27b
lea rdx, [0x140047044]
lea rcx, [rsp + 0x30]
call fcn.1400291b8
movzx eax, al
test eax, eax
jne 0x14003c27b
lea rdx, [0x140047054]
lea rcx, [rsp + 0x30]
call fcn.1400291b8
movzx eax, al
test eax, eax
jne 0x14003c27b
lea rdx, [0x140047064]
lea rcx, [rsp + 0x30]
call fcn.1400291b8
movzx eax, al
test eax, eax
je 0x14003c3e1
lea rcx, [0x140047074]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x20]
call fcn.14002d168
mov rcx, rax
call fcn.14002cf14
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x21]
call fcn.14002d1c0
mov rcx, rax
call fcn.14002cef4
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x22]
call fcn.14002d0c8
mov rcx, rax
call fcn.14002ced4
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x23]
call fcn.14002d194
mov rcx, rax
call fcn.14002ce94
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x24]
call fcn.14002d00c
mov rcx, rax
call fcn.14002ceb4
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x25]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x25]
call fcn.14002d038
mov rcx, rax
call fcn.14002ce74
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
xor r9d, r9d
lea r8, [0x1400471b0]
lea rdx, str.Loaded
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rsp + 0x30]
call fcn.14002c83c
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14003f700
add rsp, 0x240
pop rdi
ret
Function at 0x14003de0c
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140039afc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x14003a004]
mov qword [rsp + 0x78], rax
lea rax, [0x1400478d0]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x14003dec4
lea rdx, str._n_n_notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028db0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, [0x140047908]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140051908], rax
mov edx, 5
mov rcx, qword [0x140051908]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140047898]
mov rcx, qword [0x140051908]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140051908]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140051908]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x14003ed54
Capabilities:
Create thread
Execute command
Set console window title

Disassembly:
sub rsp, 0x98
mov rax, qword [0x140050ac8]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [0x140047638]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140046fd6]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str._n_________________________n__Y_______________________n________OREO.WTF____QQ__n_____________________n______________________________________________________________________________________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028db0
mov dl, 0xa
mov rcx, rax
call fcn.1400289e0
lea rcx, str.color_F0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.___Load_Driver__Y_N_:__n
call fcn.14003ef78
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14003c1c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x30], rax
call fcn.14003854c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140039308]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dx, 4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0x12c
mov ecx, 0x145
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___Waiting_for_Fortnite.._n
call fcn.140038750
cmp qword [0x140051318], 0
jne 0x14003ee81
lea rdx, [0x1400477f0]
lea rcx, [rsp + 0x68]
call fcn.14002b40c
lea rcx, [rsp + 0x68]
call fcn.14003bee0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140051318], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003ee3d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x140051318], 0
jne 0x14003eed6
lea rdx, str.Fortnite
lea rcx, [rsp + 0x78]
call fcn.14002b40c
lea rcx, [rsp + 0x78]
call fcn.14003bee0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140051318], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003ee92
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rdx, [0x140047668]
mov rcx, qword [rsp + 0x38]
call fcn.14002bb58
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.14003a9ac
mov dword [0x140051320], eax
xor edx, edx
mov rcx, qword [0x140051838]
call fcn.1400382cc
movzx eax, al
test eax, eax
je 0x14003ef47
mov edx, dword [0x140051320]
mov rcx, qword [0x140051838]
call fcn.14002d4f4
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, qword [0x140051838]
call fcn.140038004
mov qword [0x140051310], rax
call fcn.14003de0c
call fcn.14003df98
call fcn.14003e8d4
call fcn.14003ec3c
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14003f700
add rsp, 0x98
ret
Function at 0x14000f830
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x28
cmp byte [reloc.WS2_32.dll_gethostname], 0
mov eax, dword [str.U_K9BVKRQRPQ]
mov dword [rsp + 0x30], eax
je 0x14000f91c
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000f8e6
movdqa xmm3, xmmword [0x140065890]
lea rcx, [rsp + 0x30]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400658e0]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400658e0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 1
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400658b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400658d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400658f0]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
ret
lea r8, [rsp + 0x30]
nop dword [rax + rax]
mov eax, 0x94f2095
lea r8, [r8 + 1]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x37
movzx eax, cl
inc ecx
sub al, dl
add al, 0x36
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x14000f8f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
ret