joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c404
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x14001c434
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x14001c416
mov rax, r8
ret

Function at 0x14001dfbc
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
jmp 0x14001e02e
cmp ecx, 0x7c
je 0x14001e033
cmp ecx, 0x29
jne 0x14001e03e
cmp dword [rbx + 0x1c], 0
jne 0x14001e033
test dword [rbx + 0x80], 0x10000000
je 0x14001e179
cmp ecx, 0x5d
jne 0x14001e005
test dword [rbx + 0x80], 0x10000000
je 0x14001e142
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14001f3b4
mov dil, 1
mov rcx, rbx
call fcn.14001df70
test dil, dil
je 0x14001e029
mov rcx, rbx
call fcn.14001f26c
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x14001dfd0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x2e
jne 0x14001e05b
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.14001e278
mov rcx, rbx
call fcn.14001df70
jmp 0x14001e021
cmp ecx, 0x5c
jne 0x14001e0b9
mov rcx, rbx
call fcn.14001df70
test byte [rbx + 0x80], 0x80
je 0x14001e0ac
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x14001e090
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.14001e278
mov rcx, rbx
call fcn.14001df70
jmp 0x14001e029
cmp al, 0x42
jne 0x14001e0ac
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.14001e278
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x14001e086
mov rcx, rbx
call fcn.14001f028
jmp 0x14001e021
cmp ecx, 0x5b
jne 0x14001e0d9
mov rcx, rbx
call fcn.14001df70
mov rcx, rbx
call fcn.14001eec8
cmp dword [rbx + 0x7c], 0x5d
jne 0x14001e14d
jmp 0x14001e051
cmp ecx, 0x28
jne 0x14001e0fc
mov rcx, rbx
call fcn.14001df70
mov rcx, rbx
call fcn.14001f170
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x14001e158
jmp 0x14001e014
cmp ecx, 0x5e
jne 0x14001e109
lea edx, [rcx - 0x5c]
jmp 0x14001e07d
cmp ecx, 0x24
jne 0x14001e116
lea edx, [rcx - 0x21]
jmp 0x14001e07d
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14001e16e
cmp ecx, 0x3f
je 0x14001e16e
cmp ecx, 0x7b
je 0x14001e16e
cmp ecx, 0x7d
jne 0x14001dff0
test dword [rbx + 0x80], 0x10000000
je 0x14001e163
jmp 0x14001e005
mov edx, 4
call fcn.14001cadc
int3
mov edx, 4
call fcn.14001cadc
int3
mov edx, 5
call fcn.14001cadc
int3
mov edx, 6
call fcn.14001cadc
int3
mov edx, 0xa
call fcn.14001cadc
int3
mov edx, 5
call fcn.14001cadc
int3
Function at 0x1400314d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140031504
cvtsi2ss xmm0, rdx
jmp 0x140031519
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400ab2b8
movss xmm1, dword [0x1400fc2e4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140031547
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140031547
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140031575
cmp rbx, 0x200
jae 0x140031572
shl rbx, 3
cmp rbx, rcx
jae 0x140031575
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x1400316e3
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140025730
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400316a7
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [rax + r9 + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x1400315ed
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x14003162c
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x14003169b
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x140031670
mov r10, qword [r10]
cmp r10, rax
je 0x140031625
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140031625
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x1400316bd
cmp qword [rdi + r11*8], r10
jne 0x140031666
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400315dd
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14003169b
lea rcx, str.invalid_hash_bucket_count
call fcn.1400805b0
int3

Function at 0x140035c10
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test r8, r8
je 0x140035c3c
movsx rax, byte [rdx]
movabs r9, 0x100000001b3
imul rcx, r9
dec r8
xor rcx, rax
inc rdx
call fcn.140035c10
mov rcx, rax
mov rax, rcx
add rsp, 0x28
ret
Function at 0x14003d4b0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14003d4de
xor eax, eax
jmp 0x14003d5c4
cmp qword [rcx + 0x68], 0
je 0x14003d4ef
call fcn.140016e40
jmp 0x14003d5c4
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003d506
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003d508
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003d53a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400ab490
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14003d5be
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14003d571
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14003d59a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140095cb0
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14003d5be
cmp rsi, rbx
ja 0x14003d578
test rsi, rsi
je 0x14003d5be
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140095cb0
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140040b48
Capabilities:
Load windows common language runtime

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp qword [0x1401205a0], rbx
jne 0x140040bf4
and qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, [0x1400f4218]
lea rcx, [0x1400f4208]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
mov ebx, eax
test eax, eax
js 0x140040bf4
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
and qword [rsp + 0x30], 0
lea r8, [0x1400f41f8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140040be9
mov rcx, qword [rsp + 0x30]
lea r9, [0x1401205a0]
lea r8, [0x1400f41e8]
lea rdx, [0x1400f41d8]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x140040bde
mov rcx, qword [0x1401205a0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140040bfc
Capabilities:
Load windows common language runtime

Disassembly:
sub rsp, 0x38
cmp qword [0x1401205a0], 0
jne 0x140040c57
call fcn.140040b48
test eax, eax
jns 0x140040c57
cmp qword [0x1401205a0], 0
jne 0x140040c57
lea rax, [0x1401205a0]
xor edx, edx
lea r9, [0x1400f41e8]
mov qword [rsp + 0x20], rax
lea r8, [0x1400f41d8]
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x140040c5e
mov rcx, qword [0x1401205a0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
add rsp, 0x38
ret
xor r9d, r9d
lea r8, [0x1400f3b28]
lea rdx, [0x1400f3b40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x140040c59
Function at 0x140041998
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14010c0c0]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov esi, r8d
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x48], rdx
xor r15d, r15d
mov edi, 0x2710
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400419e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x70]
call fcn.1400abb30
mov r8d, esi
lea rdx, [0x1400f0738]
lea rcx, [rbp - 0x70]
call fcn.14003e034
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x140041bb0
mov rax, rbx
mov esi, 7
cmp qword [rbx + 0x18], rsi
jbe 0x140041a33
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str..pipe_
lea rcx, [rsp + 0x70]
call fcn.14003e594
nop
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140041a60
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.14003e6ac
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rsi
mov word [rax], r15w
lea rcx, [rsp + 0x70]
call fcn.140018668
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0xa
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], rsi
cmova rcx, qword [rsp + 0x50]
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x140041aed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140041aed
test edi, edi
jg 0x140041ab1
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], rsi
cmova rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
setne dil
mov rdx, qword [rsp + 0x68]
cmp rdx, rsi
jbe 0x140041b6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041b67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041baa
call fcn.1400826b0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x50], r15w
mov rcx, rbx
call fcn.140018668
mov al, dil
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140082690
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400897a0
nop
call fcn.140001784
int3
Function at 0x140041bb8
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [r11 - 0x18]
and dword [rsp + 0x30], 0
mov rbx, rdx
and qword [r11 - 0x28], 0
lea rdx, [r11 - 0x14]
mov rdi, rcx
mov dword [rsp + 0x34], eax
mov rcx, qword [rcx + 8]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x140041c00
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140041c4f
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140041c4a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140041c6a
mov rcx, r8
call fcn.1400826b0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400897a0
int3

Function at 0x140041c70
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [r11 - 0x18]
and dword [rsp + 0x30], 0
add eax, eax
and qword [r11 - 0x28], 0
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x34], eax
mov rcx, qword [rcx + 8]
lea rdx, [r11 - 0x14]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbx + 0x10]
mov rdx, rbx
add r8d, r8d
cmp qword [rbx + 0x18], 7
jbe 0x140041cc1
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140018668
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140041d5c
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xc8]
sub rsp, 0x1c0
mov rax, qword [0x14010c0c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x30], esi
lea rcx, [rbp + 0x70]
call fcn.140050e70
nop
lea r8d, [rsi + 0xe]
lea rdx, str.debug_log.txt
mov rcx, rax
call fcn.14003e6ac
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or edi, 2
lea rcx, [rbp + 0x70]
call fcn.140018668
lea rdx, [rbp + 0x90]
lea rcx, [0x140120ed0]
call fcn.14004a48c
mov rbx, rax
or edi, 1
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rdx, qword [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.14004a62c
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
cmp qword [rbp - 0x38], rsi
jne 0x140041e6d
lea rcx, [rbp - 0x18]
call fcn.14003dc04
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.140081398
nop
jmp 0x140041ed6
lea rcx, [rsp + 0x40]
call fcn.14003e0ec
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140041e9c
lea r8, [rax + rax]
cmp qword [rbx + 0x18], 7
jbe 0x140041e8e
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14004a340
nop
lea rcx, [rbp - 0x18]
call fcn.14003dc04
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.140081398
nop
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov bl, 1
jne 0x140041ed9
mov bl, sil
test dil, 1
je 0x140041eeb
lea rcx, [rbp + 0x90]
call fcn.140018668
test bl, bl
je 0x140041f1d
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r8, qword [rbp + 0x50]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140041f59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041f54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041f81
call fcn.1400826b0
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140082690
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400897a0
int3
Function at 0x140043c64
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14010c0c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r9
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], rdx
xor r12d, r12d
mov rdi, qword [rcx]
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140043ca8
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140043cdb
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbx
call fcn.140003d3c
jmp 0x140043df0
mov ecx, 0x208
mov r13d, 1
call fcn.140082d04
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea r12, [r14 + 8]
mov r14d, 0x104
mov rax, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140043d21
mov rax, qword [rdi]
mov r8, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140043d2e
mov r8, qword [rsi]
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x140043d3b
mov rdx, qword [r15]
mov rcx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140043d4a
mov rcx, qword [r12]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r14 - 1]
cmp eax, ecx
jb 0x140043dca
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140043d72
mov rcx, qword [rsi]
mov rax, rbp
sub rcx, rbp
movzx edx, word [rax]
movzx r8d, word [rax + rcx]
sub edx, r8d
jne 0x140043d8e
add rax, 2
test r8d, r8d
jne 0x140043d78
test edx, edx
je 0x140043dca
mov rcx, rbp
call fcn.1400826b0
inc r13d
imul r14d, r13d, 0x104
mov ecx, r14d
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140082d04
mov rbp, rax
jmp 0x140043d14
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.140017be8
mov rcx, rbp
call fcn.1400826b0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140082690
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140043ff0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x8f8
mov rax, qword [0x14010c0c0]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
call fcn.14005d360
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x800
call fcn.1400abb30
mov r8d, 0x400
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
lea rcx, [rsp + 0x74]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
lea r8d, [rax + 0x64]
call fcn.1400abb30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
and qword [rsp + 0x38], 0
xor edx, edx
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400440ba
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.140096d0c
int3
Function at 0x14004506c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
xor ebp, ebp
lea rbx, [rcx + 0x80]
mov rcx, rbx
call fcn.14005f404
mov ecx, dword [rbx + 0x60]
test ecx, ecx
je 0x1400450b8
cmp dword [0x140120eb8], ecx
je 0x1400450b6
mov dword [0x140120eb8], ecx
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400450da
test ecx, ecx
setne al
mov byte [rbx + 0xa8], al
test ecx, ecx
je 0x1400450da
cmp qword [rdi + 0xe8], 0x10000
jae 0x1400450da
mov rcx, rbx
call fcn.14005f964
mov eax, dword [rdi + 0x330]
cmp byte [rdi + 0x128], bpl
je 0x140045213
cmp eax, 1
je 0x14004524c
mov dword [rdi + 0x330], 1
call fcn.1400430c4
test al, al
je 0x140045261
cmp byte [rdi + 0x4b8], bpl
jne 0x140045269
mov byte [rdi + 0x4b8], 1
cmp qword [0x1401210a8], rbp
je 0x140045157
lea rbx, [rdi + 0x80]
mov rcx, rbx
call fcn.14005f924
mov rcx, rbx
call fcn.14005f964
mov rcx, qword [0x1401210a8]
test rcx, rcx
je 0x14004526f
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
mov rcx, rdi
call fcn.14004884c
mov rcx, rdi
call fcn.1400481a4
lea rcx, [rdi + 0x10]
call fcn.14005ca3c
test al, al
je 0x140045261
lea rcx, [rdi + 0x10]
call fcn.14005cb04
lea rbx, [rdi + 0x550]
cmp byte [rbx + 8], bpl
jne 0x140045207
cmp qword [rbx + 0x18], rbp
je 0x140045207
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.1400826e4
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x14004bff8]
xor edx, edx
xor ecx, ecx
call fcn.140096704
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140045280
cmp dword [rsp + 0x38], ebp
je 0x140045275
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140081a20
test eax, eax
jne 0x140045275
mov dl, 1
mov rcx, rdi
call fcn.14004884c
jmp 0x14004524c
test eax, eax
je 0x14004524c
mov dword [rdi + 0x330], ebp
mov rcx, rdi
call fcn.1400481a4
mov byte [rdi + 0x558], bpl
mov ebx, 0x1388
jmp 0x140045243
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 0x32
js 0x14004524c
cmp byte [rdi + 0x559], bpl
jne 0x140045233
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.140096d0c
int3
call fcn.140043ff0
int3
call fcn.14008056c
nop
mov ecx, 1
call fcn.1400815b0
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.1400815b0
int3