joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400023c4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, [rsp + 0x58]
call fcn.140001c74
lea rcx, [rsp + 0x58]
call fcn.140002dbc
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jne 0x14000243c
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140001270
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140003c74
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000242d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x58]
call fcn.140004320
mov rbx, qword [rsp + 0x58]
and dword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
jne 0x140002460
call fcn.140003d5c
mov edi, eax
jmp 0x14000247a
mov edx, dword [rsp + 0x50]
mov r8, rsi
mov rcx, rdi
call fcn.1400024a8
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002494
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140003e68
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140001918
xor esi, esi
mov rcx, rax
test rax, rax
je 0x140003f31
mov rax, qword [rax]
call qword [rax + 0x18]
xor r8d, r8d
lea rcx, str.SystemDrive
add rax, 0x18
xor edx, edx
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x140003f19
test eax, eax
js 0x140003f3c
mov rax, qword [rbx]
lea edx, [rsi + 1]
sub edx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or edx, eax
jge 0x140003ed6
mov edx, edi
mov rcx, rbx
call fcn.140001e7c
mov rdx, qword [rbx]
lea rcx, str.SystemDrive
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140003ef5
mov eax, esi
jmp 0x140003f02
movsxd rdx, dword [rcx - 0xc]
call fcn.14000a2f8
test eax, eax
js 0x140003f47
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x140003f47
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], si
jmp 0x140003f1e
call fcn.140003d5c
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140001f58
int3
mov ecx, 0x80070057
call fcn.140001f58
int3
mov ecx, 0x80070057
call fcn.140001f58
int3
Function at 0x140004ca4
Capabilities:
Open clipboard
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x140026028]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov esi, r9d
mov edi, ecx
cmp ecx, 0x80000003
jne 0x140004cfc
xor eax, eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140005f10
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x802
call fcn.140007550
mov rbx, qword [0x140028ae8]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140001370
mov r9, qword [rsp + 0x40]
lea rax, str.baselogging.cc
mov dword [rsp + 0x38], esi
lea rdx, str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
and dword [rsp + 0x28], 0
mov r8d, edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004d74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140004d99
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140004dd4
mov r9d, 0x250012
lea r8, str.Exception
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
je 0x140004dc8
cmp eax, 1
jne 0x140004dbe
int3
mov eax, 1
jmp 0x140004cd7
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140004dd4
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [rbx + 1]
mov ecx, 0x2002
movsxd rdi, eax
add rdi, rdi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140004e24
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.140007100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x140004e49
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x140004ed0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x140026028]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor ebx, ebx
lea r8, [rcx + 0x10]
mov r9, rcx
mov ecx, ebx
movzx edx, byte [r8]
movzx eax, byte [r8 + 1]
lea r8, [r8 + 4]
shl eax, 0x10
shl edx, 0x18
or edx, eax
movzx eax, byte [r8 - 2]
shl eax, 8
or edx, eax
movzx eax, byte [r8 - 1]
or edx, eax
mov dword [rsp + rcx*4 + 0x20], edx
inc rcx
cmp rcx, 0x10
jl 0x140004f0c
lea r10, [rsp + 0x58]
mov r11d, 0x30
mov ecx, dword [r10 - 0x34]
mov r8d, ecx
mov edx, dword [r10]
mov eax, ecx
rol r8d, 0xe
lea r10, [r10 + 4]
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 - 0x3c]
add r8d, dword [r10 - 0x18]
mov dword [r10 + 4], r8d
sub r11, 1
jne 0x140004f4a
mov esi, dword [r9 + 0x5c]
mov ebp, dword [r9 + 0x6c]
mov r12d, ebp
mov r13d, dword [r9 + 0x50]
mov r11d, dword [r9 + 0x54]
mov edi, dword [r9 + 0x58]
mov r10d, dword [r9 + 0x60]
mov r14d, dword [r9 + 0x68]
mov dword [rsp + 8], esi
mov r15d, dword [rsp + 8]
mov esi, dword [r9 + 0x64]
mov eax, r13d
mov r8d, r13d
rol eax, 0xa
mov ecx, r11d
xor ecx, r13d
ror r8d, 0xd
xor r8d, eax
and ecx, edi
mov eax, r13d
mov edx, r10d
ror eax, 2
xor r8d, eax
ror edx, 0xb
mov eax, r11d
and eax, r13d
xor ecx, eax
mov eax, r10d
rol eax, 7
add r8d, ecx
xor edx, eax
mov ecx, r10d
mov eax, r10d
not ecx
ror eax, 6
and ecx, r14d
xor edx, eax
mov eax, esi
and eax, r10d
xor ecx, eax
lea rax, [0x140021330]
add edx, ecx
add edx, dword [rbx + rax]
add edx, dword [rsp + rbx + 0x20]
add rbx, 4
add edx, r12d
mov r12d, r14d
mov r14d, esi
mov esi, r10d
lea r10d, [rdx + r15]
mov r15d, edi
mov edi, r11d
mov r11d, r13d
lea r13d, [rdx + r8]
cmp rbx, 0x100
jl 0x140004fbc
add dword [r9 + 0x50], r13d
lea eax, [r12 + rbp]
add dword [r9 + 0x54], r11d
add dword [r9 + 0x58], edi
add dword [r9 + 0x5c], r15d
add dword [r9 + 0x60], r10d
add dword [r9 + 0x64], esi
add dword [r9 + 0x68], r14d
mov dword [r9 + 0x6c], eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140005f10
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400052fc
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140026028]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r10d, dword [rcx + 8]
mov r11, r8
add qword [rcx + 8], r8
and r10d, 0x3f
mov rbx, rdx
mov r9, rcx
test r8, r8
je 0x140005492
mov al, byte [rbx]
dec r11
mov byte [r10 + r9 + 0x10], al
inc rbx
inc r10d
cmp r10d, 0x40
jne 0x140005489
lea rdx, [r9 + 0x10]
xor r8d, r8d
movzx ecx, byte [rdx]
movzx eax, byte [rdx + 1]
lea rdx, [rdx + 4]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [rdx - 2]
shl eax, 8
or ecx, eax
movzx eax, byte [rdx - 1]
or ecx, eax
mov dword [rsp + r8*4], ecx
inc r8
cmp r8, 0x10
jl 0x14000536c
cmp r8, 0x50
jge 0x1400053c8
mov edx, 0x50
lea rcx, [rsp + r8*4 - 0x38]
sub rdx, r8
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x1400053ae
mov r15d, dword [r9 + 0x50]
xor r10d, r10d
mov r12d, dword [r9 + 0x54]
mov r14d, r15d
mov r13d, dword [r9 + 0x58]
mov esi, r12d
mov edi, dword [r9 + 0x5c]
mov r8d, r13d
mov ebp, dword [r9 + 0x60]
mov edx, r14d
rol edx, 5
add edx, dword [rsp + r10*4]
add edx, ebp
cmp r10, 0x14
jge 0x14000540b
mov ecx, edi
xor ecx, r8d
and ecx, esi
xor ecx, edi
add ecx, 0x5a827999
jmp 0x140005449
cmp r10, 0x28
jge 0x140005420
mov ecx, edi
xor ecx, r8d
xor ecx, esi
add ecx, 0x6ed9eba1
jmp 0x140005449
cmp r10, 0x3c
jge 0x14000543c
mov ecx, r8d
mov eax, r8d
or ecx, esi
and eax, esi
and ecx, edi
or ecx, eax
add ecx, 0x8f1bbcdc
jmp 0x140005449
mov ecx, edi
xor ecx, r8d
xor ecx, esi
add ecx, 0xca62c1d6
add ecx, edx
mov ebp, edi
mov edi, r8d
inc r10
mov r8d, esi
mov esi, r14d
ror r8d, 2
mov r14d, ecx
cmp r10, 0x50
jl 0x1400053e8
add dword [r9 + 0x5c], edi
lea eax, [r15 + rcx]
add dword [r9 + 0x60], ebp
mov dword [r9 + 0x50], eax
xor r10d, r10d
lea eax, [r12 + rsi]
mov dword [r9 + 0x54], eax
lea eax, [r8 + r13]
mov dword [r9 + 0x58], eax
test r11, r11
jne 0x14000534b
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140005f10
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140005778
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetDefaultDllDirectories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400057ab
mov ecx, 0x800
call rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.14000220c
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400023c4
mov ebx, eax
test eax, eax
js 0x14000586a
lea rdx, str.user
lea rcx, [rsp + 0x20]
call fcn.140001c74
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140002870
mov rdx, qword [rsp + 0x20]
test al, al
sete dil
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000581a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, str.unregister
lea rcx, [rsp + 0x28]
call fcn.140001c74
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140002870
mov rdx, qword [rsp + 0x28]
test al, al
sete bl
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000585e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dl, bl
mov cl, dil
call fcn.1400056b4
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.14000234c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x45e200
Capabilities:
Parse pe header
Terminate process

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x00400000], 0x5a4d
je 0x45e221
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
movsxd rax, dword [0x0040003c]
lea rcx, [0x00400000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x45e242
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x45e280
cmp ecx, 0x20b
je 0x45e25e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
cmp dword [rax + 0x84], 0xe
ja 0x45e26f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
cmp dword [rax + 0x74], 0xe
ja 0x45e28e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x00483dc8], 0xffffffffffffffff
mov qword [0x00483dd0], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x00481da4]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x00481da0]
mov dword [rcx], eax
call fcn.0045d2e0
cmp dword [0x004817b0], 0
jne 0x45e2f7
lea rcx, [fcn.0045d2e0]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x00460498]
lea rcx, [0x00460490]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x00481d9c]
mov dword [rsp + 0x68], r11d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x00481d98]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x00460488]
lea rcx, [0x00460430]
call sub.msvcrt.dll__initterm
mov r11, qword [rsp + 0x38]
mov rax, qword [sym.imp.msvcrt.dll___initenv]
mov qword [rax], r11
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
call fcn.0045ae04
mov edi, eax
mov dword [rsp + 0x34], eax
test ebx, ebx
jne 0x45e383
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x45e3a4
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x14000ca40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140087040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx edi, r8b
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
lea rcx, [rsp + 0x58]
call fcn.140002b30
mov byte [rsp + 0x78], dil
mov qword [rsp + 0x80], rsi
lea ecx, [rbp + 0x30]
call fcn.1400384d8
test rax, rax
je 0x14000cacc
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x140065b10]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], bpl
mov byte [rax + 0x20], dil
mov qword [rax + 0x28], rsi
jmp 0x14000cacf
mov rax, rbp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140008b30]
xor edx, edx
xor ecx, ecx
call fcn.14004689c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000cbe6
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000cb40
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cbf5
call fcn.140038514
cmp dword [rsp + 0x38], 0
je 0x14000cbdb
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14003a5c0
test eax, eax
jne 0x14000cbdb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000cba3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000cb9e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cbfb
mov rcx, r8
call fcn.140038514
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140038630
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 1
call fcn.14003a988
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.14003a988
nop
call fcn.140040fa0
nop
call fcn.140040fa0
int3

Function at 0x14000cc10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x140088bd0]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.14003a660
test eax, eax
jne 0x14000cc9e
cmp dword [0x140088c1c], 0x7fffffff
je 0x14000cc89
lea edx, [rax + 2]
mov rcx, rbx
call fcn.1400110b0
mov eax, dword [rbx + 0x60]
mov dword [rsp + 0x50], eax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14003a668
mov dword [0x140088c1c], 0x7ffffffe
mov ecx, 6
call fcn.14003a988
int3
mov ecx, 5
call fcn.14003a988
int3
Function at 0x14000d1d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rdx
xor ebp, ebp
mov dword [rsp + 0x3c], ebp
lea r14, [0x140088bd0]
mov qword [rsp + 0x50], r14
mov rcx, r14
call fcn.14003a660
test eax, eax
jne 0x14000d2fb
cmp dword [0x140088c1c], 0x7fffffff
je 0x14000d2e6
lea edx, [rbp + 8]
mov rcx, rdi
call fcn.1400110b0
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140002b30
mov rdx, rax
mov rcx, rdi
call fcn.140010920
nop
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x34]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x34]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x3c], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x14000d2a8
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
call fcn.140008f80
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000d2b5
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.14003a668
mov rax, rbx
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [0x140088c1c], 0x7ffffffe
mov ecx, 6
call fcn.14003a988
int3
mov ecx, 5
call fcn.14003a988
int3
Function at 0x140010920
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
lea r8d, [rsi + 4]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x140010971
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400109bf
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400109ba
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400109de
mov rcx, r8
call fcn.140038514
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140040fa0
int3

Function at 0x1400109f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
mov rbx, rdx
add eax, eax
mov dword [rsp + 0x30], 0
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbx + 0x10]
mov rdx, rbx
add r8d, r8d
cmp qword [rbx + 0x18], 7
jbe 0x140010a4d
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140005330
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140010b50
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140087040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r15, rcx
mov qword [rsp + 0x40], rdx
mov rdi, qword [rsp + 0xe0]
xor ebx, ebx
call fcn.140020f40
test al, al
jne 0x140010bc0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
lea r8d, [rbx + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140001390
jmp 0x140010d33
mov ebp, 1
mov ecx, 0x208
call fcn.1400388bc
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rbx, 0xffffffffffffffff
mov r14d, 0x104
nop word [rax + rax]
mov rax, r15
cmp qword [r15 + 0x18], 7
jbe 0x140010c0d
mov rax, qword [r15]
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140010c1a
mov r8, qword [rdi]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140010c29
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x140010c37
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r14 - 1]
cmp eax, ecx
jb 0x140010cb8
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140010c5f
mov r8, qword [rdi]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140010c84
add rax, 2
test ecx, ecx
jne 0x140010c70
test edx, edx
je 0x140010cb8
mov rcx, rsi
call fcn.140038514
inc ebp
imul r14d, ebp, 0x104
mov ecx, r14d
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400388bc
mov rsi, rax
jmp 0x140010c00
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140010cc0
mov rax, qword [rsp + 0x60]
cmp rbx, rax
ja 0x140010d03
lea rdi, [rsp + 0x48]
cmp rax, 7
cmova rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14005f2a0
xor r14d, r14d
mov word [rbx + rdi], r14w
jmp 0x140010d19
mov r9, rsi
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140001d30
mov rcx, rsi
call fcn.140038514
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140038630
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret