joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c90
Capabilities:
Terminate process

Disassembly:
push rbp
push r13
push r12
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, 1
call sym._configure_wide_argv
call sym._initialize_wide_environment
call sym.__p___argc
mov r12d, dword [rax]
call sym.__p___wargv
mov r13, qword [rax]
call sym._get_initial_wide_environment
xor ecx, ecx
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
cmp word [rax + rdx + 0x5c], 2
sete cl
inc ecx
call sym._set_app_type
mov ecx, r12d
mov r8, rbx
mov rdx, r13
call sym.wmain
mov ecx, eax
call sym.exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00a17480]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00a17490]
mov dword [rax], 1
mov rax, qword [0x00a174a0]
mov dword [rax], 1
mov rax, qword [0x00a17470]
mov dword [rax], 1
mov rax, qword [0x00a17360]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00a17460]
mov dword [0x00a1a008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00a17420]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00a17310]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401550
Capabilities:
Encrypt data using xtea

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x18]
mov eax, dword [rax + 4]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x14], 0x9e3779b9
mov eax, dword [rbp - 0x14]
imul eax, dword [rbp + 0x10]
mov dword [rbp - 0x10], eax
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x10]
jae 0x40161a
mov eax, dword [rbp - 8]
shl eax, 4
mov edx, eax
mov eax, dword [rbp - 8]
shr eax, 5
xor edx, eax
mov eax, dword [rbp - 8]
add edx, eax
mov eax, dword [rbp - 0x10]
shr eax, 0xb
mov eax, eax
and eax, 3
lea rcx, [rax*4]
mov rax, qword [rbp + 0x20]
add rax, rcx
mov ecx, dword [rax]
mov eax, dword [rbp - 0x10]
add eax, ecx
xor eax, edx
sub dword [rbp - 0xc], eax
mov eax, dword [rbp - 0x14]
sub dword [rbp - 0x10], eax
mov eax, dword [rbp - 0xc]
shl eax, 4
mov edx, eax
mov eax, dword [rbp - 0xc]
shr eax, 5
xor edx, eax
mov eax, dword [rbp - 0xc]
add edx, eax
mov eax, dword [rbp - 0x10]
and eax, 3
lea rcx, [rax*4]
mov rax, qword [rbp + 0x20]
add rax, rcx
mov ecx, dword [rax]
mov eax, dword [rbp - 0x10]
add eax, ecx
xor eax, edx
sub dword [rbp - 8], eax
add dword [rbp - 4], 1
jmp 0x40158e
mov rax, qword [rbp + 0x18]
mov edx, dword [rbp - 8]
mov dword [rax], edx
mov rax, qword [rbp + 0x18]
add rax, 4
mov edx, dword [rbp - 0xc]
mov dword [rax], edx
nop
add rsp, 0x20
pop rbp
ret
Function at 0x401da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00a1a624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x401f28
mov rax, qword [0x00a1a628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x401dec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x401e75
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x401dd0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401f5d
mov rax, qword [0x00a1a628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00a1a628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401f40
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401e6e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401ed0
add dword [0x00a1a624], 1
cmp edi, 8
jae 0x401ea3
test dil, 4
jne 0x401f14
test edi, edi
je 0x401e98
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x401f2f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x401e98
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x401ebc
jmp 0x401e98
add rsi, qword [0x00a1a628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401e6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x401e98
xor esi, esi
jmp 0x401df7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x401e98
mov rax, qword [0x00a1a628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x4026b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00a1a900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00a1a8e0]
test rbx, rbx
je 0x402704
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4026fb
test rsi, rsi
je 0x4026fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4026e0
lea rcx, [0x00a1a900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402940
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402950
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402960
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4029a1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402998
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x4029a3
add rax, 0x28
cmp rax, r9
jne 0x402984
xor eax, eax
ret

Function at 0x402a40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00a17360]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402aad
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402aad
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402aad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402aa4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402aaf
add rax, 0x28
cmp rax, r9
jne 0x402a90
xor eax, eax
add rsp, 0x28
ret

Function at 0x402bb0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00a17360]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x402bd0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402bc8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402c2d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402c24
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402c34
add rax, 0x28
cmp rax, r9
jne 0x402c10
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402c50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00a17360]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x402cbe
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402cbe
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x402cbe
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402cbe
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x402cb5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x402cc5
add rcx, 0x28
cmp rcx, rax
jne 0x402ca0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x402cd8
jmp 0x402cbe
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402ce6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x402cbe
test r9d, r9d
jg 0x402cd0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x403360
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1800046d0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r15
sub rsp, 0x1f8
mov rax, qword [0x18006e240]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rbp, rcx
mov qword [rsp + 0x68], rcx
mov rcx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
xor r15d, r15d
cmp rax, 2
jb 0x18000495e
cmp qword [rdx + 0x18], 0xf
mov r9, rdx
mov qword [rsp + 0x1e0], r14
jbe 0x180004728
mov r9, qword [rdx]
lea rax, [0x180062c48]
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], rax
mov r8, rdx
movzx edx, byte [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.18000a7d0
cmp qword [rsp + 0x60], 0xf
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x90]
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, qword [rsp + 0x60]
mov r14, rax
cmp rdx, 0xf
jbe 0x1800047b3
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047ae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004964
call fcn.180022550
movdqa xmm0, xmmword [0x180063080]
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1e8], rdi
mov byte [rsp + 0x48], r15b
movdqu xmmword [rsp + 0x58], xmm0
cmp r14, 0xffffffffffffffff
je 0x1800048d9
nop dword [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x80], r15
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x88], r15
lea rax, [rsp + 0xbc]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x180004817
lea rdx, [rsp + 0xbc]
lea rcx, [rsp + 0x70]
call fcn.180009cf0
mov rsi, qword [rsp + 0x88]
lea rdi, [rsp + 0x70]
mov rbx, qword [rsp + 0x70]
cmp rsi, 0xf
mov r8, qword [rsp + 0x80]
cmova rdi, rbx
test r8, r8
je 0x180004938
mov edx, 0x2e
mov rcx, rdi
call fcn.18004dac0
test rax, rax
je 0x180004938
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x180004938
cmp rsi, 0xf
jbe 0x1800048b7
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800048af
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004958
mov rcx, rbx
call fcn.180022550
lea rdx, [rsp + 0x90]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800047f0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
xorps xmm0, xmm0
lea rdx, [0x180062a08]
movups xmmword [rbp], xmm0
xor r8d, r8d
mov qword [rbp + 0x10], r15
mov rcx, rbp
mov qword [rbp + 0x18], r15
call fcn.180009cf0
mov rdi, qword [rsp + 0x1e8]
mov rax, rbp
mov rsi, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x220]
mov r14, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180022530
add rsp, 0x1f8
pop r15
pop rbp
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
jmp 0x1800048fa
call fcn.180031af4
int3
call fcn.180001630
int3
call fcn.180031af4
int3
Function at 0x14000fdb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14000fdfc
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000fe4a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000fe45
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fe69
mov rcx, r8
call fcn.14003e800
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400457dc
int3

Function at 0x14000fe70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbx + 0x10]
mov rdx, rbx
add r8d, r8d
cmp qword [rbx + 0x18], 7
jbe 0x14000fec5
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000ff14
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000ff0f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ff33
mov rcx, r8
call fcn.14003e800
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400457dc
int3
Function at 0x140011e30
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14008a040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
xor edi, edi
cmp qword [rcx + 0x18], 7
jbe 0x140011e7a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140011eae
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140004b70
jmp 0x140011fe4
mov ebp, 1
mov ecx, 0x208
call fcn.14003eab8
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdi, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x140011efd
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140011f0a
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140011f19
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x140011f27
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x140011fa8
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140011f4f
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140011f74
add rax, 2
test ecx, ecx
jne 0x140011f60
test edx, edx
je 0x140011fa8
mov rcx, rsi
call fcn.14003e800
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14003eab8
mov rsi, rax
jmp 0x140011ef0
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x140011fb0
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140004770
mov rcx, rsi
call fcn.14003e800
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003e7e0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014680
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x14008d8a0]
call fcn.14003e004
test eax, eax
jne 0x14001472f
cmp dword [0x14008d8ec], 0x7fffffff
je 0x14001471a
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xb0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x14008d8a0]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.14003e00c
mov ecx, 6
mov dword [0x14008d8ec], 0x7ffffffe
call fcn.14003dec8
int3
mov ecx, 5
call fcn.14003dec8
int3

Function at 0x140015de0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov rdi, qword [0x14008d358]
lea r14, [0x14008d8a0]
mov qword [rsp + 0x58], r14
mov rcx, r14
call fcn.14003e004
test eax, eax
jne 0x140015f38
cmp dword [0x14008d8ec], 0x7fffffff
je 0x140015f23
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400043f0
mov rdx, rax
mov rcx, rdi
call fcn.14000fdb0
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x40], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x140015edb
mov rcx, rbx
call fcn.14000d9b0
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140015ee8
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.14003e00c
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [0x14008d8ec], 0x7ffffffe
mov ecx, 6
call fcn.14003dec8
int3
mov ecx, 5
call fcn.14003dec8
int3
Function at 0x140016d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov ebx, ecx
mov rsi, r8
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140016eac
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test rbx, rbx
je 0x140016eac
test eax, eax
je 0x140016eac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140016eac
mov rcx, qword [rsi]
mov dword [rbp - 0x20], 0x15c93a0c
mov dword [rbp - 0x1c], 0x18d415
mov dword [rbp - 0x18], 0x9f37f7fb
mov dword [rbp - 0x14], 0x6fc82de
mov dword [rbp - 0x10], 0xb4b2e23e
mov dword [rbp - 0xc], 0x169f9f8a
mov dword [rbp - 8], 0xc324821d
mov dword [rbp - 4], 0xeea780ad
cmp rcx, qword [rsi + 8]
je 0x140016e4b
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
sub rax, rcx
mov qword [rbp + 0x38], rdi
cmp rdi, rax
jbe 0x140016e67
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.140016ed0
xor ebx, ebx
test rdi, rdi
je 0x140016ea8
nop
mov rdx, qword [rsi + 8]
mov rax, rbx
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x20]
xor cl, byte [r14 + rbx]
mov byte [rbp + 0x20], cl
cmp rdx, qword [rsi + 0x10]
je 0x140016e94
mov byte [rdx], cl
inc qword [rsi + 8]
jmp 0x140016ea0
lea r8, [rbp + 0x20]
mov rcx, rsi
call fcn.140016fc0
inc rbx
cmp rbx, rdi
jb 0x140016e70
mov al, 1
jmp 0x140016eae
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400176b0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x14008d360], 0
jne 0x1400177a2
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x140077bc8]
mov qword [rsp + 0x48], rbx
lea rcx, [0x140077bb8]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x14008d360]
test eax, eax
js 0x140017765
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x140077ba8]
lea rdx, [0x1400774c0]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140017756
mov rcx, qword [rsp + 0x40]
lea r8, [0x140073e40]
mov r9, rdi
lea rdx, [0x140073e50]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14001774b
mov rcx, qword [0x14008d360]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x1400177a2
cmp qword [0x14008d360], 0
jne 0x1400177a2
lea r9, [0x140073e40]
mov qword [rsp + 0x20], rdi
lea r8, [0x140073e50]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x1400177af
mov rcx, qword [0x14008d360]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x1400774f0]
lea rdx, [0x140077510]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret