joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009b790
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x538
mov rax, qword [0x1800fd900]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov r15d, ecx
mov rbp, rdx
mov rcx, qword [0x18019f998]
test rcx, rcx
jne 0x18009b7eb
call fcn.18009db10
mov rcx, rax
lea rdx, str._create_locale
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
mov qword [0x18019f998], rcx
xor ebx, ebx
cmp rcx, 0xffffffffffffffff
mov edi, ebx
cmovne rdi, rcx
test rdi, rdi
je 0x18009b935
test rbp, rbp
je 0x18009b83e
lea edx, [rbx + 0x2d]
mov rcx, rbp
call sub.msvcrt.dll_strchr
test rax, rax
je 0x18009b83e
mov ecx, ebx
lea r8, [rsp + 0x120]
mov rdx, rbp
movsx eax, byte [rdx]
test al, al
je 0x18009b84b
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x18009b822
mov rdx, rbp
mov ecx, r15d
call rdi
jmp 0x18009ba12
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x18009ba2f
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x18009b83e
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18009b83e
lea ecx, [rax - 1]
mov r9d, 0x100
movsxd rdx, ecx
lea r8, [rsp + 0x320]
sub r9d, eax
mov ecx, 0x5f
cdqe
mov word [rsp + rdx*2 + 0x320], cx
mov edx, 0x1002
lea rcx, [rsp + 0x120]
lea r8, [r8 + rax*2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18009b83e
lea rax, [rsp + 0x320]
lea rcx, [rsp + 0x20]
movzx edx, word [rax]
test dx, dx
je 0x18009b91b
mov byte [rcx], dl
inc ebx
inc rcx
add rax, 2
cmp ebx, 0x100
jne 0x18009b8f3
mov rdx, rbp
mov ecx, r15d
call rdi
jmp 0x18009ba12
movsxd rax, ebx
lea rbp, [rsp + 0x20]
mov rdx, rbp
mov ecx, r15d
mov byte [rsp + rax + 0x20], 0
call rdi
jmp 0x18009ba12
cmp r15d, 5
ja 0x18009ba04
test rbp, rbp
je 0x18009ba04
call fcn.18009bb70
mov rdi, rax
test rax, rax
je 0x18009ba0f
mov qword [rsp + 0x570], rsi
mov qword [rsp + 0x530], r14
call fcn.18008ea90
mov rdx, rbp
mov rsi, rax
mov r14d, dword [rax + 0xc8]
mov ecx, r14d
or ecx, 2
mov dword [rax + 0xc8], ecx
mov ecx, r15d
call fcn.18009bcd0
test rax, rax
je 0x18009b9af
mov rax, qword [rsi + 0xc0]
mov ecx, dword [rax + 4]
call sub.msvcrt.dll__setmbcp
test eax, eax
jne 0x18009b9af
call fcn.18009bb70
mov rbx, rax
mov rcx, qword [rsi + 0xc0]
mov dword [rsi + 0xc8], r14d
mov rax, qword [rdi]
mov r14, qword [rsp + 0x530]
cmp rax, rcx
je 0x18009b9d7
mov qword [rdi], rcx
mov qword [rsi + 0xc0], rax
mov rax, qword [rdi + 8]
mov rcx, qword [rsi + 0xb8]
cmp rax, rcx
je 0x18009b9f2
mov qword [rdi + 8], rcx
mov qword [rsi + 0xb8], rax
mov rcx, rdi
call fcn.18009ba40
mov rsi, qword [rsp + 0x570]
jmp 0x18009ba0f
call sub.msvcrt.dll__errno
mov dword [rax], 0x16
mov rax, rbx
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.18008d950
add rsp, 0x538
pop r15
pop rdi
pop rbp
pop rbx
ret
call fcn.18008df50
int3
Function at 0x18009bcd0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x1800fd900]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor ebx, ebx
mov rdi, rdx
mov esi, ecx
test rdx, rdx
je 0x18009bd3c
lea edx, [rbx + 0x2d]
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x18009bd3c
mov ecx, ebx
lea r8, [rsp + 0x120]
mov rdx, rdi
nop dword [rax]
movsx eax, byte [rdx]
test al, al
je 0x18009bd8f
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x18009bd20
mov rcx, qword [0x18019f9a8]
test rcx, rcx
jne 0x18009bd72
call fcn.18009db10
mov rcx, rax
lea rdx, str.setlocale
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
mov qword [0x18019f9a8], rcx
cmp rcx, 0xffffffffffffffff
cmovne rbx, rcx
test rbx, rbx
je 0x18009be73
mov rdx, rdi
mov ecx, esi
call rbx
jmp 0x18009be75
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x18009be9a
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x18009bd3c
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18009bd3c
lea ecx, [rax - 1]
mov r9d, 0x100
movsxd rdx, ecx
lea r8, [rsp + 0x320]
sub r9d, eax
mov ecx, 0x5f
cdqe
mov word [rsp + rdx*2 + 0x320], cx
mov edx, 0x1002
lea rcx, [rsp + 0x120]
lea r8, [r8 + rax*2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18009bd3c
lea rcx, [rsp + 0x320]
mov eax, ebx
lea rdx, [rsp + 0x20]
movzx r8d, word [rcx]
test r8w, r8w
je 0x18009be63
mov byte [rdx], r8b
inc eax
inc rdx
add rcx, 2
cmp eax, 0x100
jne 0x18009be41
jmp 0x18009bd3c
cdqe
lea rdi, [rsp + 0x20]
mov byte [rsp + rax + 0x20], bl
jmp 0x18009bd3c
xor eax, eax
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.18008d950
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18008df50
int3
Function at 0x180001220
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002a20
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.1800025c0
xor edx, edx
test al, al
je 0x180002a70
mov r8d, 0x7b290
lea rcx, [0x18007d090]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.180002680
mov rsi, rax
test rax, rax
jne 0x180002aa4
xor bl, bl
jmp 0x180002c5a
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002ae0
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1800055f4]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x180002b9d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Create_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002c52
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x7b290
lea rdx, [0x18007d090]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180002beb
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Write_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002c52
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180002c00
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180002fc8
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002840
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x180002c4a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002c52
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x18007d090]
mov r8d, 0x7b290
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
Function at 0x180001230
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002ca0
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.1800025c0
xor edx, edx
test al, al
je 0x180002cf0
mov r8d, 0x74b98
lea rcx, [0x1800084f0]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.180002680
mov rsi, rax
test rax, rax
jne 0x180002d24
xor bl, bl
jmp 0x180002eda
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002d60
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1800055f4]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x180002e1d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005630]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002ed2
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x74b98
lea rdx, [0x1800084f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180002e6b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002ed2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180002e80
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180002fc8
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002840
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x180002eca
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002ed2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x1800084f0]
mov r8d, 0x74b98
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
Function at 0x1800025c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x3c], 0x400
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x38], eax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], eax
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x180002669
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.FCHACK
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180002669
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0x2537
mov ecx, 1
movzx eax, bl
cmove eax, ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x50
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x50
pop rbx
ret
Function at 0x180002840
Capabilities:
Create service
Modify service
Start service

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x70
mov rbp, r8
mov rdi, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x18000288e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180002780
xor al, al
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0x90], rsi
mov r9d, 0xf01ff
mov qword [rsp + 0x98], r12
mov r8, rbp
mov qword [rsp + 0xa0], r15
mov r12d, 1
xor r15d, r15d
mov rdx, rdi
mov qword [rsp + 0x60], r15
mov rcx, rbx
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
test rax, rax
jne 0x1800029b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x18000299c
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x180002948
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180002780
xor al, al
jmp 0x1800029f4
mov qword [rsp + 0x50], rbp
xor r9d, r9d
mov qword [rsp + 0x48], r15
mov edx, r12d
mov qword [rsp + 0x40], r15
mov rcx, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r8d, [r9 + 3]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test al, al
jne 0x1800029b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180002780
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1800029f4
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Failed_to_open_the_service_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x1800029f4
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test al, al
jne 0x1800029de
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
movzx edi, dil
cmove edi, r12d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r14
pop rdi
pop rbp
ret
Function at 0x180002a20
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002a20
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.1800025c0
xor edx, edx
test al, al
je 0x180002a70
mov r8d, 0x7b290
lea rcx, [0x18007d090]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.180002680
mov rsi, rax
test rax, rax
jne 0x180002aa4
xor bl, bl
jmp 0x180002c5a
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002ae0
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1800055f4]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x180002b9d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Create_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002c52
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x7b290
lea rdx, [0x18007d090]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180002beb
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Write_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002c52
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180002c00
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180002fc8
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002840
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x180002c4a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002c52
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x18007d090]
mov r8d, 0x7b290
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
Function at 0x180002ca0
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002ca0
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.1800025c0
xor edx, edx
test al, al
je 0x180002cf0
mov r8d, 0x74b98
lea rcx, [0x1800084f0]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.180002680
mov rsi, rax
test rax, rax
jne 0x180002d24
xor bl, bl
jmp 0x180002eda
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002d60
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1800055f4]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x180002e1d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005630]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002ed2
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x74b98
lea rdx, [0x1800084f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180002e6b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002ed2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180002e80
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180002fc8
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002840
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x180002eca
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002ed2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x1800084f0]
mov r8d, 0x74b98
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002f30
add rsp, 0x178
ret
Function at 0x14000c170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14002f1c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000c1ad
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000c1b4
mov al, 1
jmp 0x14000c30c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14000eb80
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14000eb80
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.14000eba0
movzx eax, al
test eax, eax
je 0x14000c209
xor al, al
jmp 0x14000c30c
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000c279
cmp dword [rsp + 0x30], 1
je 0x14000c285
cmp dword [rsp + 0x30], 3
je 0x14000c2fa
jmp 0x14000c30a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000c2d1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14000c2d1
xor al, al
jmp 0x14000c30c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000c2eb
mov dword [rsp + 0x34], 1
jmp 0x14000c2f3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14000c30c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000c30c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400227b0
add rsp, 0xa8
ret