joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004660
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004733
cmp byte [rcx + 0x71], 0
je 0x140004733
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000472f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400046f4
sub eax, 1
je 0x1400046f8
cmp eax, 2
jne 0x14000472f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400056f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004726
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000472f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400046dc
xor al, al
jmp 0x1400046dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400056f0
add rsp, 0x60
pop rbx
ret

Function at 0x140006110
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000615a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000615a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000615a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000615a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000615a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000615c
xor al, al
add rsp, 0x28
ret
Function at 0x180001240
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002c60
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.180002800
xor edx, edx
test al, al
je 0x180002cb0
mov r8d, 0x79c90
lea rcx, [0x18007ee70]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.1800028c0
mov rsi, rax
test rax, rax
jne 0x180002ce4
xor bl, bl
jmp 0x180002e9a
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002d20
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x180005604]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x180002ddd
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Create_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002e92
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x79c90
lea rdx, [0x18007ee70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180002e2b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Write_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002e92
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180002e40
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180003208
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002a80
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x180002e8a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002e92
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x18007ee70]
mov r8d, 0x79c90
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
Function at 0x180001250
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002ee0
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.180002800
xor edx, edx
test al, al
je 0x180002f30
mov r8d, 0x76890
lea rcx, [0x1800085e0]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.1800028c0
mov rsi, rax
test rax, rax
jne 0x180002f64
xor bl, bl
jmp 0x18000311a
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002fa0
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x180005604]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x18000305d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180003112
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x76890
lea rdx, [0x1800085e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800030ab
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005650]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180003112
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800030c0
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180003208
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002a80
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x18000310a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180003112
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x1800085e0]
mov r8d, 0x76890
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
Function at 0x180002800
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x3c], 0x400
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x38], eax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], eax
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1800028a9
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.FCHACK
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800028a9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0x2537
mov ecx, 1
movzx eax, bl
cmove eax, ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180003170
add rsp, 0x50
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180003170
add rsp, 0x50
pop rbx
ret
Function at 0x180002a80
Capabilities:
Create service
Modify service
Start service

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x70
mov rbp, r8
mov rdi, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x180002ace
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800029c0
xor al, al
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0x90], rsi
mov r9d, 0xf01ff
mov qword [rsp + 0x98], r12
mov r8, rbp
mov qword [rsp + 0xa0], r15
mov r12d, 1
xor r15d, r15d
mov rdx, rdi
mov qword [rsp + 0x60], r15
mov rcx, rbx
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
test rax, rax
jne 0x180002bf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x180002bdc
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x180002b88
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800029c0
xor al, al
jmp 0x180002c34
mov qword [rsp + 0x50], rbp
xor r9d, r9d
mov qword [rsp + 0x48], r15
mov edx, r12d
mov qword [rsp + 0x40], r15
mov rcx, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r8d, [r9 + 3]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test al, al
jne 0x180002bf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800029c0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x180002c34
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Failed_to_open_the_service_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x180002c34
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test al, al
jne 0x180002c1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
movzx edi, dil
cmove edi, r12d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r14
pop rdi
pop rbp
ret
Function at 0x180002c60
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002c60
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.180002800
xor edx, edx
test al, al
je 0x180002cb0
mov r8d, 0x79c90
lea rcx, [0x18007ee70]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.1800028c0
mov rsi, rax
test rax, rax
jne 0x180002ce4
xor bl, bl
jmp 0x180002e9a
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002d20
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x180005604]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x180002ddd
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Create_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002e92
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x79c90
lea rdx, [0x18007ee70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180002e2b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Write_File_Faild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180002e92
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180002e40
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180003208
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002a80
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x180002e8a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002e92
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x18007ee70]
mov r8d, 0x79c90
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
Function at 0x180002ee0
Capabilities:
Write file on windows

Disassembly:
jmp 0x180002ee0
sub rsp, 0x178
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.180002800
xor edx, edx
test al, al
je 0x180002f30
mov r8d, 0x76890
lea rcx, [0x1800085e0]
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
mov qword [rsp + 0x180], rbx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x188], rsi
call sub.VCRUNTIME140.dll_memset
call fcn.1800028c0
mov rsi, rax
test rax, rax
jne 0x180002f64
xor bl, bl
jmp 0x18000311a
mov r8d, 0x104
mov qword [rsp + 0x170], rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002fa0
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [0x180005604]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
jne 0x18000305d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180003112
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x76890
lea rdx, [0x1800085e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800030ab
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x180005650]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x180003112
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800030c0
inc ebx
movsxd rbx, ebx
mov rcx, rbx
call fcn.180003208
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.180002a80
movzx ebx, al
mov rcx, rsi
test al, al
jne 0x18000310a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180003112
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov bl, 1
mov rdi, qword [rsp + 0x170]
xor edx, edx
lea rcx, [0x1800085e0]
mov r8d, 0x76890
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x188]
movzx eax, bl
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180003170
add rsp, 0x178
ret
Function at 0x41d537
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00441fa0]
jne 0x419e2a
rol rcx, 0x10
test cx, 0xffff
jne 0x419e26
repz ret
ror rcx, 0x10
jmp 0x41d490
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00447460]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x00447558]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x41d515
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00447460]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x41d537
mov rax, qword [rsp + 0x88]
mov qword [0x00447558], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x004474f8], rax
mov rax, qword [0x00447558]
mov qword [0x004473d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x004474e0], rax
mov dword [0x004473c0], 0xc0000409
mov dword [0x004473c4], 1
mov rax, qword [0x00441fa0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00441fa8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x00447458], eax
mov ecx, 1
call fcn.00428090
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00435b48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x00447458], 0
jne 0x41d5be
mov ecx, 1
call fcn.00428090
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x429430
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0041d650
xor ebx, ebx
cmp qword [0x004481b8], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x429561
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x429493
xor eax, eax
jmp 0x429641
lea rdx, [0x00436d00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x42948c
mov rcx, rax
call fcn.0041d5e0
lea rdx, [0x00436cf0]
mov rcx, rbp
mov qword [0x004481b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d5e0
lea rdx, [0x00436cd8]
mov rcx, rbp
mov qword [0x004481c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d5e0
lea rcx, [rsp + 0x30]
mov qword [0x004481c8], rax
call fcn.0041b130
test eax, eax
je 0x429517
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041efa0
cmp dword [rsp + 0x30], 2
jne 0x429561
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d5e0
test rax, rax
mov qword [0x004481d8], rax
je 0x429561
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d5e0
mov qword [0x004481d0], rax
mov rcx, qword [0x004481d0]
cmp rcx, rsi
je 0x4295f3
cmp qword [0x004481d8], rsi
je 0x4295f3
call fcn.0041d6b0
call rax
test rax, rax
mov rbp, rax
je 0x4295be
mov rcx, qword [0x004481d8]
call fcn.0041d6b0
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4295be
test byte [rsp + 0x48], 1
jne 0x4295f3
lea rcx, [rsp + 0x34]
call fcn.0041b180
test eax, eax
je 0x4295e0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041efa0
cmp dword [rsp + 0x34], 4
jb 0x4295ed
bts edi, 0x15
jmp 0x429627
bts edi, 0x12
jmp 0x429627
mov rcx, qword [0x004481c0]
cmp rcx, rsi
je 0x429627
call fcn.0041d6b0
call rax
test rax, rax
mov rbx, rax
je 0x429627
mov rcx, qword [0x004481c8]
cmp rcx, rsi
je 0x429627
call fcn.0041d6b0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x004481b8]
call fcn.0041d6b0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret