joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4cfd10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d0df0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d0712
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d07aa
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d078e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d0782
cmp qword [rbp - 0x10], 0
je 0x2fc4d0782
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0748
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d07ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d08b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d08d8
mov eax, 0
jmp 0x2fc4d0926
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0901
mov eax, 0
jmp 0x2fc4d0926
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0921
mov eax, 0
jmp 0x2fc4d0926
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d092c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d09aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d09a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d09a1
mov rax, qword [rbp - 8]
jmp 0x2fc4d09bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0974
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x110010000
Capabilities:
Check mutex on windows
Encode data using xor
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x130
mov r14d, edx
mov edi, ebx
xor edx, edx
lea ecx, [rbx + 2]
call sub.kernel32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rsi, rax
call sub.kernel32.dll_Process32First
test eax, eax
je 0x110010108
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.kernel32.dll_Process32Next
test eax, eax
je 0x1100100ff
mov dword [rsp + 0x20], 0x25262614
mov edx, ebx
mov dword [rsp + 0x24], 0x93f293b
mov dword [rsp + 0x28], 0x2a347e1c
mov word [rsp + 0x2c], 0x36
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rdx + 0x47]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x1100100a0
lea rax, [rsp + 0x6c]
mov byte [rsp + 0x2d], bl
lea rdx, [rsp + 0x20]
sub rdx, rax
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x1100100db
inc rax
test cl, cl
jne 0x1100100c8
mov ecx, ebx
jmp 0x1100100e0
sbb ecx, ecx
or ecx, 1
test ecx, ecx
lea eax, [rdi + 1]
lea rdx, [rsp + 0x40]
mov rcx, rsi
cmovne eax, edi
mov edi, eax
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x110010075
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp edi, r14d
jg 0x110010199
movdqa xmm0, xmmword [0x1100d1330]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x36], al
mov dword [rsp + 0x30], 0x6a776d08
mov word [rsp + 0x34], 0x6975
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ebx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rbx + 0x47]
inc ebx
xor byte [rcx], al
cmp ebx, 0x16
jb 0x110010140
lea r8, [rsp + 0x20]
mov byte [rsp + 0x36], 0
mov edx, 1
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
jne 0x110010183
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x110010199
mov rcx, rbx
call qword [sym.imp.kernel32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x11001019b
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x110011c90
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor eax, eax
lea r9, [r11 - 0x58]
mov qword [r11 - 0x58], rax
lea r8, [0x1100cfce8]
mov qword [r11 - 0x50], rax
lea rdx, [0x1100cfcf4]
mov qword [r11 - 0x48], rax
mov rbx, rcx
mov qword [r11 - 0x40], rax
lea rcx, [0x1100cfcf8]
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
lea rax, [0x1100cfcd0]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x110011d10
lea rcx, [rbx + 0x98]
lea rdx, [rsp + 0x30]
call fcn.1100160a0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x80
pop rbx
ret

Function at 0x11001bdc0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov byte [rcx], 0
lea rbp, [0x1100d14d0]
xor bl, bl
mov qword [rsp + 0x28], rbp
lea r9, [rsp + 0x30]
lea r8, [0x1100cf738]
mov dword [rsp + 0x20], 0x40
lea rdx, [0x1100d14c0]
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x30]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
lea r9, [rdi + 1]
mov qword [rsp + 0x28], rbp
cmove edx, esi
mov dword [rsp + 0x20], 0x20
mov byte [rdi], dl
lea r8, [0x1100d14fc]
lea rdx, [0x1100d1500]
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x11001c410
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x90
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rbp, [0x1100d1658]
mov rcx, rbp
lea rdx, [rsp + 0x30]
movabs rax, 0x14043caa0
call rax
test al, al
je 0x11001c529
mov edx, dword [rdi + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], edx
jne 0x11001c46b
cmp eax, dword [rdi]
je 0x11001c529
mov qword [rsp + 0xa8], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100cf738]
lea rdx, [0x1100d14c0]
mov qword [rsp + 0xb0], rsi
lea rcx, [0x1100d1678]
mov dword [rsp + 0x20], 0x40
xor bl, bl
mov qword [rdi], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x40]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x40]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
lea r9, [rdi + 9]
mov qword [rsp + 0x28], rbp
cmove edx, esi
mov dword [rsp + 0x20], 0x40
mov byte [rdi + 8], dl
lea r8, [0x1100d14fc]
lea rdx, [0x1100d1688]
lea rcx, [0x1100d1678]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.11009af60
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret

Function at 0x11001c550
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x90
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
mov byte [rcx + 8], 0
lea rbp, [0x1100d1658]
movabs rax, 0x14043caa0
mov rcx, rbp
lea rdx, [rsp + 0x30]
call rax
test al, al
je 0x11001c66d
mov ecx, dword [rdi + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], ecx
jne 0x11001c5af
cmp eax, dword [rdi]
je 0x11001c66d
mov qword [rsp + 0xa8], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100cf738]
lea rdx, [0x1100d14c0]
mov qword [rsp + 0xb0], rsi
lea rcx, [0x1100d1678]
mov dword [rsp + 0x20], 0x40
xor bl, bl
mov qword [rdi], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x40]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x40]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
lea r9, [rdi + 9]
mov qword [rsp + 0x28], rbp
cmove edx, esi
mov dword [rsp + 0x20], 0x40
mov byte [rdi + 8], dl
lea r8, [0x1100d14fc]
lea rdx, [0x1100d1688]
lea rcx, [0x1100d1678]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.11009af60
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x11001e1f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
mov r8, qword [rsi + 0x30]
and r8, r9
mov rbx, qword [rsi + 8]
mov rax, r8
add rax, rax
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rdx + rax*8]
cmp rbx, rcx
je 0x11001e2d7
mov rbx, qword [rdx + rax*8 + 8]
mov rbx, qword [rbx]
nop dword [rax + rax]
cmp rbx, rcx
je 0x11001e2d7
mov rbx, qword [rbx + 8]
mov eax, dword [rbx + 0x10]
cmp dword [r10], eax
jne 0x11001e290
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.11009afc0
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x11001e40b
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x11001e311
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
add r8, r8
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x11001e331
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x11001e360
cmp rax, rbx
jne 0x11001e33c
mov qword [rdx + r8*8], rdi
jmp 0x11001e360
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x11001e360
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1100d1820]
test rax, rax
jns 0x11001e381
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x11001e392
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x11001e400
cmp rdx, 0x200
jae 0x11001e3ae
lea rdx, [rdx*8]
jmp 0x11001e3c0
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x11001e3c0
add rdx, rdx
mov rcx, rsi
call fcn.11001eac0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x11001e400
mov r15, qword [rax + 8]
nop word [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.11001e1f0
cmp rbx, r15
jne 0x11001e3e0
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x11001e420
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rdi, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x11001e4b4
cmp rax, r8
jne 0x11001e4aa
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x11001e4bf
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x11001e4bf
cmp rax, r8
jne 0x11001e4bf
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov edx, 0x18
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.11009afc0
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x11001e750
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rdi
sub rsp, 0x48
movzx r8d, byte [rdx]
mov rbp, rcx
movabs rcx, 0x100000001b3
mov qword [rsp + 0x68], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x40], rsi
xor r8, rax
mov r9, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [rbp + 8]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [rbp + 0x30]
and rcx, r8
mov r8, qword [rbp + 0x18]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [r8 + rax*8]
mov r10, qword [r8 + rcx*8]
lea r11, [r8 + rcx*8]
nop dword [rax + rax]
cmp r10, rdx
jne 0x11001e7da
mov rcx, rdx
jmp 0x11001e7e1
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x11001e7f8
mov ecx, dword [r9]
cmp dword [rax + 0x10], ecx
je 0x11001e7f3
mov rax, qword [rax]
jmp 0x11001e7d0
cmp rax, rdx
jne 0x11001e873
mov rbx, qword [rdx]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x70], r9
lea rax, [rsp + 0x70]
lea r9, [0x1100d16db]
mov qword [rsp + 0x20], rax
mov rsi, qword [rbx + 8]
mov rdx, rbx
mov r8, rsi
call fcn.11001e100
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x11001e888
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbp + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.11001e1f0
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rax, 0x14
mov rbx, qword [rsp + 0x68]
add rsp, 0x48
pop rdi
pop rbp
ret
lea rcx, [0x1100d1698]
call fcn.11004c5e4
int3
Function at 0x11001fad0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x90
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rbp, [0x1100d1868]
mov rcx, rbp
lea rdx, [rsp + 0x30]
movabs rax, 0x14043caa0
call rax
test al, al
je 0x11001fcc5
mov edx, dword [rdi + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], edx
jne 0x11001fb2b
cmp eax, dword [rdi]
je 0x11001fcc5
mov qword [rsp + 0xa8], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100cf738]
lea rdx, [0x1100d14c0]
mov qword [rsp + 0xb0], rsi
lea rcx, [0x1100d14f4]
mov dword [rsp + 0x20], 0x40
xor bl, bl
mov qword [rdi], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x40]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x40]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx ecx, bl
mov r9, rbp
lea rdx, [0x1100d1890]
cmove ecx, esi
xor r8d, r8d
mov byte [rdi + 8], cl
lea rcx, [0x1100d18a0]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rbp
lea rdx, [0x1100d18b0]
lea rcx, [0x1100d18a0]
mov byte [rdi + 9], al
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
lea r9, [rdi + 0xb]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100d14fc]
mov byte [rdi + 0xa], al
lea rdx, [0x1100d18c0]
mov dword [rsp + 0x20], 0x40
lea rcx, [0x1100d18a0]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100cf738]
mov dword [rsp + 0x20], 0x40
lea rdx, [0x1100d18d0]
xor bl, bl
lea rcx, [0x1100d18a0]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea r8d, [rsi + 3]
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x40]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov r8d, esi
lea rcx, [rsp + 0x40]
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx ecx, bl
mov r9, rbp
lea rdx, [0x1100d18e0]
cmove ecx, esi
xor r8d, r8d
mov byte [rdi + 0x4b], cl
lea rcx, [0x1100d18e8]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rbp
lea rdx, [0x1100d18f8]
lea rcx, [0x1100d18e8]
mov dword [rdi + 0x4c], eax
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov dword [rdi + 0x50], eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.11009af60
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x110020200
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea r9, [0x1100d1980]
mov rdi, rcx
mov qword [r11 - 0x30], rax
xor ebx, ebx
mov qword [r11 - 0x28], rax
mov dword [rcx], ebx
lea rdx, [0x1100d19a4]
lea rcx, [0x1100d14f4]
mov qword [r11 - 0x20], rax
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi], eax
mov rcx, 0xffffffffffffffff
movsxd r14, eax
mov eax, 0x18
mul r14
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
mov qword [rsp + 0x20], rax
mov rsi, rax
test rax, rax
je 0x1100202a1
test r14, r14
je 0x1100202a4
lea r8, [r14 + r14*2]
xor edx, edx
shl r8, 3
mov rcx, rax
call fcn.11009c5d0
jmp 0x1100202a4
mov rsi, rbx
mov qword [rdi + 8], rsi
cmp dword [rdi], ebx
jle 0x110020378
mov rsi, rbx
nop dword [rax]
nop word [rax + rax]
mov r8d, ebx
lea rdx, [0x1100d19a8]
lea rcx, [rsp + 0x28]
call fcn.110001a70
lea r9, [0x1100d1980]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rcx, qword [rdi + 8]
lea rdx, [0x1100d19b0]
mov r8d, ebx
mov byte [rsi + rcx], al
lea rcx, [rsp + 0x28]
call fcn.110001a70
lea r9, [0x1100d1980]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov ecx, eax
mov r8d, ebx
mov rax, qword [rdi + 8]
lea rdx, [0x1100d19c0]
mov qword [rsi + rax + 8], rcx
lea rcx, [rsp + 0x28]
call fcn.110001a70
lea r9, [0x1100d1980]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rcx, qword [rdi + 8]
lea rsi, [rsi + 0x18]
inc ebx
mov dword [rsi + rcx - 8], eax
cmp ebx, dword [rdi]
jl 0x1100202c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.11009af60
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1100203a0
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor eax, eax
lea r14, [0x1100d1658]
mov rdi, rcx
mov qword [r11 - 0x60], rax
xor ebx, ebx
mov qword [r11 - 0x58], rax
mov dword [rcx], ebx
lea rdx, [0x1100d19c8]
lea rcx, [0x1100d19d0]
mov qword [r11 - 0x50], rax
mov r9, r14
mov qword [r11 - 0x48], rax
xor r8d, r8d
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi], eax
mov rcx, 0xffffffffffffffff
movsxd rbp, eax
mov eax, 8
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
mov qword [rsp + 0x30], rax
mov rsi, rax
test rax, rax
je 0x110020455
test rbp, rbp
je 0x110020458
lea r8, [rbp*8]
xor edx, edx
mov rcx, rax
call fcn.11009c5d0
jmp 0x110020458
mov rsi, rbx
mov qword [rdi + 8], rsi
cmp dword [rdi], ebx
jle 0x11002050b
mov rsi, rbx
nop word [rax + rax]
mov r8d, ebx
lea rdx, [0x1100d19e0]
lea rcx, [rsp + 0x38]
call fcn.110001a70
mov r9, r14
lea rdx, [rsp + 0x38]
xor r8d, r8d
lea rcx, [0x1100d19d0]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rcx, qword [rdi + 8]
lea rdx, [0x1100d19f0]
mov r8d, ebx
mov byte [rsi + rcx], al
lea rcx, [rsp + 0x38]
call fcn.110001a70
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], r14
lea r8, [0x1100d1a00]
mov dword [rsp + 0x20], 0x20
lea rdx, [rsp + 0x38]
lea rcx, [0x1100d19d0]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x58]
call fcn.1100b2100
mov rax, qword [rdi + 8]
lea rsi, [rsi + 8]
xorps xmm1, xmm1
inc ebx
cvtsd2ss xmm1, xmm0
movss dword [rsi + rax - 4], xmm1
cmp ebx, dword [rdi]
jl 0x110020470
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret