joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406c88
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
mov edx, 0x20
mov ecx, 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea rax, [rbp - 0x60]
mov r8d, edx
lea rdx, str.info.txt
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
lea rdx, str.We_have_detected_that_your_using_En_gameloop............_n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Please_do_not_use_En_gameloop................._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.If_you_use_En_gameloop_your_id_will_be_banned_for_10_years............_n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
mov edx, 0
lea rcx, str.cmd.exe__c_notepad.exe_info.txt
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
jmp 0x406d43
add rsp, 0x1f8
pop rbx
pop rbp
ret

Function at 0x406e21
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x51]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, [0x0049648c]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp - 0x45]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x45]
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str.https:__www.googleapis.com_drive_v3_files_1_wirQEcupNYd6_WUFjWCTbti20Ir7UWM_altmediakeyAIzaSyD_QWLVRGx58NvbEhXEH5kknnFYpH20wmw
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.downloadFile_std::string__std::string_
mov dword [rbp - 0x44], eax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x45]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x51]
mov rcx, rax
call sym.std::allocator_char_::allocator__
cmp dword [rbp - 0x44], 0
js 0x406ee0
lea rcx, [0x0049648c]
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
call sym.ban_ad_blockers__
call sym.load_new_ads__
jmp 0x406ee5
call sym.start_key_check_new__
jmp 0x406f2f
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x406fef
Capabilities:
Create process on windows
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1c0], ecx
lea rax, [rbp + 0x190]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x50]
mov r8d, 8
lea rdx, str.ad.txt
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x50]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x407074
mov byte [0x004bb048], 1
lea rdx, str.Failed_to_open_file.............._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
lea rcx, [0x00496003]
call sym.system
mov dword [rbp + 0x19c], 1
jmp 0x407149
lea rdx, str.Your_keyboard_will_be_freezed_for_few_minutes.............._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, str.Showing_ad
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x19c]
mov edx, eax
call method.std::ostream.operator___int_
lea rdx, str................._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, [rbp + 0x190]
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::basic_istream_char__std::char_traits_char____std::getline_char__std::char_traits_char___std.allocator_char____std::basic_istream_char__std::char_traits_char_____std::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::string.c_str___const
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0xbb8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.wait_10_sec__
lea rcx, [0x00496003]
call sym.system
add dword [rbp + 0x19c], 1
mov eax, dword [rbp + 0x19c]
cmp eax, dword [rbp + 0x1c0]
jle 0x40708f
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00467540
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00459260
jmp 0x4071a7
add rsp, 0x228
pop rbx
pop rbp
ret
Function at 0x4071b1
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x18c], 0
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.ad.txt
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x407233
lea rdx, str.Failed_to_open_file.............._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
jmp 0x40723c
add dword [rbp + 0x18c], 1
lea rdx, [rbp + 0x180]
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_istream_char__std::char_traits_char____std::getline_char__std::char_traits_char___std.allocator_char____std::basic_istream_char__std::char_traits_char_____std::basic_string_char__std::char_traits_char___std::allocator_char____
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
jne 0x407235
mov ebx, dword [rbp + 0x18c]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00459260
mov eax, ebx
jmp 0x4072c1
add rsp, 0x218
pop rbx
pop rbp
ret

Function at 0x4072cb
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x004bb040]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_IsWindow]
call rax
test eax, eax
sete al
test al, al
je 0x40734e
mov byte [0x004bb048], 1
mov r9d, 0x41010
lea r8, str.BYPASS..........
lea rdx, str.Chrome_or_msedge_is_closed...........
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, [0x00496003]
call sym.system
lea rdx, str.Chrome_or_msedge_window_is_closed..................._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
nop
add rsp, 0x20
pop rbp
ret
Function at 0x407354
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
cmp eax, 1
sete al
test al, al
je 0x4073fd
jmp 0x4073e0
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x4073e0
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x407415
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
cmp eax, 1
sete al
test al, al
jne 0x4073a8
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret

Function at 0x40741e
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
cmp eax, 1
sete al
test al, al
je 0x4074c9
jmp 0x4074ac
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x4074ac
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x4074e1
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
cmp eax, 1
sete al
test al, al
jne 0x407472
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x40780a
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov eax, dword [rbp + 0x10]
mov rdx, rax
lea rcx, [sym.EnumWindowsProc_HWND____long_long_]
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
add rsp, 0x20
pop rbp
ret

Function at 0x407831
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
mov ecx, 0x100
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
mov dword [rbp + 0xac], eax
cmp dword [rbp + 0xac], 0
jle 0x4078c7
lea rax, [rbp + 0xab]
mov rcx, rax
call fcn.0044fb90
mov eax, dword [rbp + 0xac]
movsxd rdx, eax
lea rcx, [rbp + 0xab]
lea rax, [rbp - 0x60]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call method.std::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__unsigned_long_long__std::allocator_char__const_
lea rax, [rbp + 0xab]
mov rcx, rax
call sym.std::allocator_char_::allocator__
jmp 0x4078f2
mov rcx, qword [rbp + 0xd0]
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x4078f2
mov rax, qword [rbp + 0xd0]
add rsp, 0x138
pop rbx
pop rbp
ret

Function at 0x407a3c
Capabilities:
Execute command
Log keystrokes via application hook

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov r9d, 0
mov r8d, 0
lea rdx, [sym.KeyboardProc_int__unsigned_long_long__long_long_]
mov ecx, 0xd
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExA]
call rax
mov qword [0x004bb050], rax
mov rax, qword [0x004bb050]
test rax, rax
jne 0x407ab1
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_install_hook_
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
nop
add rsp, 0x20
pop rbp
ret
Function at 0x4080b3
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov eax, dword [rbp + 0x10]
mov rdx, rax
lea rcx, [sym.EnumWindowsProcforvis_HWND____long_long_]
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
test eax, eax
sete al
add rsp, 0x20
pop rbp
ret

Function at 0x4080df
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x40817f
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, rax
mov rcx, qword [rbp + 0xf0]
call method.bool_std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
test al, al
je 0x408163
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x408197
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x408130
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret

Function at 0x40846f
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [0x004bb030]
add eax, 1
mov dword [0x004bb030], eax
call sym.IsDebuggerAttached__
test al, al
je 0x4084b3
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x408486

Function at 0x4084c3
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [0x004bb030]
add eax, 1
mov dword [0x004bb030], eax
call sym.IsDebuggerAttached__
test al, al
je 0x408507
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x4084da

Function at 0x408517
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [0x004bb030]
add eax, 1
mov dword [0x004bb030], eax
call sym.IsDebuggerAttached__
test al, al
je 0x40855b
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x40852e
Function at 0x40856b
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [0x004bb030]
add eax, 1
mov dword [0x004bb030], eax
call sym.IsDebuggerAttached__
test al, al
je 0x4085af
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x408582

Function at 0x4085bf
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [0x004bb030]
add eax, 1
mov dword [0x004bb030], eax
call sym.IsDebuggerAttached__
test al, al
je 0x408603
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x4085d6

Function at 0x4087a6
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
cmp eax, 1
sete al
test al, al
je 0x40883c
jmp 0x40881f
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x40881f
mov eax, dword [rbp - 0x58]
jmp 0x40884f
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
cmp eax, 1
sete al
test al, al
jne 0x4087fa
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
add rsp, 0x160
pop rbp
ret
Function at 0x408858
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1f0], ecx
mov qword [rbp + 0x1f8], rdx
mov edx, dword [rbp + 0x1f0]
mov ecx, 0x18
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x1d8], rax
cmp qword [rbp + 0x1d8], 0xffffffffffffffff
jne 0x4088bf
lea rdx, str.Unable_to_create_snapshot
mov rcx, qword [0x0049c9b0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 0
jmp 0x40893d
mov eax, 0x238
mov dword [rbp - 0x60], eax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
call sym.Module32First
test eax, eax
setne al
test al, al
je 0x408925
mov rax, qword [rbp + 0x1f8]
lea rdx, [rbp - 0x60]
lea rcx, [rdx + 0x30]
mov rdx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x408909
mov rax, qword [rbp - 0x48]
jmp 0x40893d
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
call sym.Module32Next
test eax, eax
setne al
test al, al
jne 0x4088e3
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x260
pop rbp
ret
Function at 0x408d6a
Capabilities:
Execute command
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], rcx
lea rax, [rbp + 0xde]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0xde]
lea rax, [rbp + 0xc0]
mov r8, rdx
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePCUI
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xde]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0xc0]
mov rcx, rax
call method.std::string.c_str___const
mov rdx, rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp + 0xec], eax
mov dword [rbp + 0xbc], 0xff
cmp dword [rbp + 0xec], 0
jne 0x408f0f
mov rax, qword [rbp + 0xd0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.InstallPath
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp + 0xec], eax
lea rax, [rbp + 0xdf]
mov rcx, rax
call fcn.0044fb90
lea rcx, [rbp + 0xdf]
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0xb0]
mov r8, rcx
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xdf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0xb0]
lea r8, str.AndroidEmulatorEx.exe
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rdx, [rbp + 0xe0]
lea rax, [rbp + 0xb0]
mov rcx, rax
call method.std::string.operator_std::string_
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0xb0]
mov rdx, rax
mov rcx, qword [rbp + 0x110]
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std::string_
nop
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.00459260
jmp 0x408fae
lea rdx, str.Failed_to_get_Gameloop_path............_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
mov rbx, rax
lea rax, [rbp + 0xde]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov rax, rbx
mov rcx, rax
call dbg._Unwind_Resume
mov rbx, rax
lea rax, [rbp + 0xdf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
jmp 0x408f94
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.00459260
mov rax, rbx
mov rcx, rax
call dbg._Unwind_Resume
mov rax, qword [rbp + 0x110]
add rsp, 0x178
pop rbx
pop rbp
ret
Function at 0x408fbf
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rdx, str.Starting_Global................._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.adb_kill_server
call sym.system
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs__NUL_2_1
call sym.system
call sym.decrypt_lib__
lea rcx, str.adb_push_a.so__data_app_com.tencent.ig_1_lib_arm_libmarsxlog.so__NUL_2_1
call sym.system
lea rcx, str.adb_push_b.so__data_app_com.tencent.ig_1_lib_arm_libCrashSight.so__NUL_2_1
call sym.system
call sym.delete_lib__
lea rcx, str.adb_shell_am_start__n_com.tencent.ig_com.epicgames.ue4.SplashActivity__NUL_2_1
call sym.system
lea rcx, str.adb_kill_server
call sym.system
mov ecx, 1
call sym.BlockInput
mov ecx, 0xfa0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0
call sym.BlockInput
lea rdx, str.BYPASS_DONE........_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
nop
add rsp, 0x20
pop rbp
ret

Function at 0x409076
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rdx, str.Starting_VNG................._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.adb_kill_server
call sym.system
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs__NUL_2_1
call sym.system
call sym.decrypt_lib__
lea rcx, str.adb_push_a.so__data_app_com.vng.pubgmobile_1_lib_arm_libmarsxlog.so__NUL_2_1
call sym.system
lea rcx, str.adb_push_b.so__data_app_com.vng.pubgmobile_1_lib_arm_libCrashSight.so__NUL_2_1
call sym.system
call sym.delete_lib__
lea rcx, str.adb_shell_am_start__n_com.vng.pubgmobile_com.epicgames.ue4.SplashActivity__NUL_2_1
call sym.system
lea rcx, str.adb_kill_server
call sym.system
mov ecx, 1
call sym.BlockInput
mov ecx, 0xfa0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0
call sym.BlockInput
lea rdx, str.BYPASS_DONE........_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
nop
add rsp, 0x20
pop rbp
ret