joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003afa4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, r8
mov rbp, rdx
mov r12, rcx
mov rcx, qword [r8 + 8]
test rcx, rcx
je 0x10003b142
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x10003afe9
xor ebx, ebx
mov qword [rsp + 0x28], rbx
jmp 0x10003b00a
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x10003b00a
mov ecx, 0x8007000e
call fcn.1000242ec
nop
jmp 0x10003b009
nop
test rbx, rbx
je 0x10003b0d7
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x10003b0d7
lea rdx, [0x100066a5c]
lea rcx, [rsp + 0x20]
call fcn.100001740
nop
mov edx, LoadRegTypeLib
lea rcx, [rsp + 0x20]
call fcn.1000017d0
mov r9, rax
mov edx, SafeArrayGetDim
mov r8d, LoadRegTypeLib
mov rcx, qword [r12 + 0x1c0]
call qword [sym.imp.USER32.dll_SendMessageW]
or edx, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.100001848
mov rdx, qword [rsp + 0x20]
mov rdi, rbx
sub rdi, rdx
movzx eax, word [rdx]
movzx ecx, word [rdx + rdi]
sub eax, ecx
jne 0x10003b08c
add rdx, 2
test ecx, ecx
jne 0x10003b079
test eax, eax
je 0x10003b0cc
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [r12 + 0x220]
call fcn.1000085f0
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 0xc]
mov rcx, qword [r12 + 0x1c0]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
lea rcx, [rsp + 0x20]
call fcn.1000012b0
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rax, qword [rbp]
lock add dword [rax], 0xffffffff
jne 0x10003b111
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x10003b0fe
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rbp + 8], 0
mov rcx, qword [rbp]
call sub.msvcrt.dll_free
and qword [rbp], 0
mov rax, qword [rsi]
lock add dword [rax], 0xffffffff
jne 0x10003b13e
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x10003b12d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rsi + 8], 0
mov rcx, qword [rsi]
call sub.msvcrt.dll_free
and qword [rsi], 0
xor eax, eax
jmp 0x10003b15f
and dword [rsp + 0x88], 0
lea rdx, [0x1000788f0]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll__CxxThrowException
nop
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x10003bb70
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
sub r8d, 0x4e
je 0x10003bbaa
sub r8d, 0xc2
je 0x10003bba1
cmp r8d, 1
jne 0x10003bba6
shr r9, 0x10
xor eax, eax
cmp r9w, ax
jne 0x10003bba6
mov rdx, qword [rsp + 0x60]
call fcn.10003bdc0
jmp 0x10003bba6
call fcn.10003bc04
xor eax, eax
jmp 0x10003bbf9
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x10], 0xffffff36
je 0x10003bbed
cmp dword [rax + 0x10], 0xfffffffc
je 0x10003bbc4
cmp dword [rax + 0x10], 0xfffffffe
jne 0x10003bba6
mov r8, qword [rcx + 0x40]
mov rcx, qword [rcx + 0x38]
xor eax, eax
lea rdx, str.open
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10003bbf2
call fcn.10003be50
mov rax, 1
add rsp, 0x38
ret
Function at 0x10003ebd4
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x20], 0
mov rax, qword [0x100091250]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__itow]
lea rdx, [0x10006e1b8]
mov rcx, rbx
call fcn.100002350
lea r8, [rsp + 0x40]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.100005978
nop
mov rdx, rax
mov rcx, rbx
call fcn.100003720
nop
lea rcx, [rsp + 0x28]
call fcn.1000012b0
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.100001100
add rsp, 0x80
pop rbx
ret

Function at 0x10003f434
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x50], rbx
mov rax, qword [0x100090120]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov rsi, qword [rbp + 0x60]
mov eax, edx
mov rdi, rcx
test edx, edx
je 0x10003f492
mov ecx, 0x23
lea rdx, [rbp + 2]
lea r8d, [rcx - 0x19]
mov word [rbp], cx
mov ecx, eax
call qword [sym.imp.msvcrt.dll__itow]
lea r8, [0x10006dd28]
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x10003f52d
lea rcx, [0x10006dd28]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jg 0x10003f51a
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x10003f4c5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.100002240
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x10003f51a
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea eax, [r9 + r9]
xor edx, edx
mov dword [rsp + 0x28], eax
lea r8, [0x10006dd28]
lea ecx, [rdx + 3]
or r9d, 0xffffffff
mov byte [rbx], 0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb r8, r8
and r8, rbx
jmp 0x10003f51d
xor r8d, r8d
lea rdx, [0x10006d542]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0x10003f539
xor eax, eax
jmp 0x10003f565
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsi], eax
test eax, eax
je 0x10003f535
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10003f535
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.100001100
mov rbx, qword [rbp + 0x50]
lea rsp, [rbp + 0x20]
pop rdi
pop rsi
pop rbp
ret
Function at 0x100042b34
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdi, [rcx + 8]
cmp byte [rdi + 8], 0
jne 0x100042bf6
mov byte [rdi + 8], 1
cmp qword [rdi + 0xa8], 0
jne 0x100042bee
and qword [rsp + 0x28], 0
lea r9, [rdi + 0x80]
lea r8, [0x10005274c]
mov edx, 0xffff
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0xa8], rax
test rax, rax
je 0x100042be2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rdi + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
cmp qword [rdi + 0xb0], 0
mov qword [rdi + 0xb8], rax
je 0x100042be2
test rax, rax
je 0x100042be2
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x100042bee
lea rcx, [rdi + 0x80]
call fcn.1000524e0
mov rcx, rdi
call fcn.100048058
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1000434a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
movsxd r12, r9d
mov rdi, r8
mov rbp, rcx
cmp r8, rbx
jne 0x1000434cf
xor eax, eax
jmp 0x1000435c1
mov esi, edx
xor r9d, r9d
shr edx, 4
lea r13d, [r9 + 1]
mov word [r8], bx
and esi, 0xf
add dx, r13w
movzx r8d, dx
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
cmp rax, rbx
je 0x1000435bf
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rbx
je 0x1000435bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r11, rax
cmp rax, rbx
je 0x1000435bf
cmp esi, ebx
jbe 0x10004353f
mov ecx, esi
movzx eax, word [r11]
add eax, r13d
sub rcx, r13
cdqe
lea r11, [r11 + rax*2]
jne 0x10004352d
movzx eax, word [r11]
lea r9d, [r12 - 1]
mov rdx, r12
cmp r9d, eax
cmovl eax, r9d
movsxd r8, eax
cmp r12, rbx
je 0x1000435a9
cmp rdx, 0x7fffffff
ja 0x1000435a9
cmp r8, 0x7ffffffe
jbe 0x100043571
mov word [rdi], bx
jmp 0x1000435a9
lea r10, [r11 + 2]
sub r8, rdx
mov rcx, rdi
sub r10, rdi
lea rax, [r8 + rdx]
cmp rax, rbx
je 0x10004359d
movzx eax, word [r10 + rcx]
cmp ax, bx
je 0x10004359d
mov word [rcx], ax
add rcx, 2
sub rdx, r13
jne 0x10004357e
cmp rdx, rbx
jne 0x1000435a6
sub rcx, 2
mov word [rcx], bx
movzx ecx, word [r11]
cmp r9d, ecx
cmovl ecx, r9d
movsxd rcx, ecx
mov word [rdi + rcx*2], bx
movzx ebx, word [r11]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x100046728
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rbx, r9
mov rdi, r8
mov rax, rdx
mov dword [rsp + 0x30], 4
test rdx, rdx
je 0x100046825
lea rcx, [r11 - 0x18]
mov qword [r11 - 0x20], rcx
lea rcx, [r11 + 0x10]
mov qword [r11 - 0x28], rcx
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x100046825
cmp dword [rsp + 0x34], 4
jne 0x100046825
cmp dword [rsp + 0x58], eax
je 0x100046825
cmp dword [0x100091a04], eax
je 0x10004680b
cmp byte [0x1000900ea], al
je 0x1000467bb
mov al, byte [0x100091a08]
cmp al, 4
jae 0x1000467ee
test al, al
jne 0x10004680b
jmp 0x1000467ee
mov al, byte [0x100091a08]
cmp al, 4
jae 0x1000467c9
test al, al
jne 0x10004680b
movabs rdx, 0x8000000000000000
test qword [0x1000919f0], rdx
je 0x10004680b
mov rcx, qword [0x1000919f8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x10004680b
mov r9, qword [rbx]
lea r8, [0x10006bfe8]
lea rdx, [0x10006c2a8]
mov rcx, qword [0x100090180]
call fcn.1000032b0
mov rdx, rbx
lea rcx, [0x1000902a0]
call fcn.100046a20
mov ecx, dword [rsp + 0x58]
mov dword [rax], ecx
jmp 0x100046900
mov dword [rsp + 0x30], 4
test rdi, rdi
je 0x100046900
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x100046900
cmp dword [rsp + 0x34], 4
jne 0x100046900
cmp dword [rsp + 0x58], eax
je 0x100046900
cmp dword [0x100091a04], eax
je 0x1000468eb
cmp byte [0x1000900ea], al
je 0x10004689b
mov al, byte [0x100091a08]
cmp al, 4
jae 0x1000468ce
test al, al
jne 0x1000468eb
jmp 0x1000468ce
mov al, byte [0x100091a08]
cmp al, 4
jae 0x1000468a9
test al, al
jne 0x1000468eb
movabs rdx, 0x8000000000000000
test qword [0x1000919f0], rdx
je 0x1000468eb
mov rcx, qword [0x1000919f8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000468eb
mov r9, qword [rbx]
lea r8, [0x10006bfe8]
lea rdx, [0x10006c2a8]
mov rcx, qword [0x100090180]
call fcn.1000032b0
mov rdx, rbx
lea rcx, [0x1000902a0]
call fcn.100046a20
mov ecx, dword [rsp + 0x58]
mov dword [rax], ecx
mov rcx, rbx
call fcn.1000012b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100051aa4
Capabilities:
Read data from internet
Receive data

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.WININET.dll_InternetReadFile]
neg eax
sbb eax, eax
not eax
and eax, 0x80004005
add rsp, 0x28
ret
Function at 0x1000524e0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x10005251c
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10005250d
mov rcx, qword [rbx + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x28], 0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x100052530
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x30], 0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x100052544
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x38], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1000556e0
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rbx, rdx
mov rdi, rcx
call fcn.10000dbe0
test rax, rax
je 0x100055717
lea rdx, str.GetThreadUILanguage
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x100055717
call rax
jmp 0x10005571d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r8d, ax
mov rdx, rbx
mov rcx, rdi
call fcn.100055984
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000562e8
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x100056353
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x100056373
mov rax, qword [rsp + 0x538]
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1800077c0
Capabilities:
Create http request

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r12, rcx
bts edi, 0x1a
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x88], 0x1388
mov r9d, 4
lea r8, [rsp + 0x88]
lea edx, [r9 - 2]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov dword [rsp + 0x88], 3
mov r9d, 4
lea r8, [rsp + 0x88]
lea edx, [r9 - 1]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov r11, qword [rsp + 0xa0]
mov qword [rsp + 0x38], r11
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rsi
mov r8, rbp
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.180007db0
movzx esi, al
test rbx, rbx
je 0x1800078ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, sil
jmp 0x1800078bd
mov al, sil
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x180007ce0
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
mov rbx, rax
je 0x180007d80
mov r9d, 4
lea r8, [0x1800ff9f0]
mov rcx, rax
lea edx, [r9 - 2]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov r9d, 4
lea r8, [0x1800ff9f4]
lea edx, [r9 - 1]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetSetOptionA]
cmp qword [rdi + 0x20], 0x10
jb 0x180007d4e
mov rdx, qword [rdi + 8]
jmp 0x180007d52
lea rdx, [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x84000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
jne 0x180007d8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x18000af20
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x2060
call fcn.1800c95a0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rbx, r9
mov r13, r8
mov rsi, rdx
mov rdi, rcx
mov rbp, qword [rsp + 0x20c0]
mov qword [rsp + 0x40], rbp
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x50], r14w
xor edx, edx
mov r8d, 0x1ffe
lea rcx, [rsp + 0x52]
call fcn.1800a3870
cmp qword [rdi + 0x20], 8
jb 0x18000af99
mov rdi, qword [rdi + 8]
jmp 0x18000af9d
add rdi, 8
cmp qword [rbp + 0x20], 8
jb 0x18000afae
lea r12, [rbp + 8]
mov r8, qword [r12]
jmp 0x18000afb5
lea r12, [rbp + 8]
mov r8, r12
cmp qword [rbx + 0x20], 8
jb 0x18000afc2
mov rdx, qword [rbx + 8]
jmp 0x18000afc6
lea rdx, [rbx + 8]
cmp qword [r13 + 0x20], 8
jb 0x18000afd3
mov rcx, qword [r13 + 8]
jmp 0x18000afd7
lea rcx, [r13 + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], r14
lea rbx, [rsi + 8]
mov word [rbx], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x18000b028
mov rax, qword [rbx]
jmp 0x18000b02b
mov rax, rbx
lea rcx, [rsp + 0x50]
cmp rcx, rax
jb 0x18000b07c
cmp rdx, 8
jb 0x18000b040
mov rcx, qword [rbx]
jmp 0x18000b043
mov rcx, rbx
mov rax, qword [rsi + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x50]
cmp rcx, rax
jbe 0x18000b07c
cmp rdx, 8
jb 0x18000b05e
mov rbx, qword [rbx]
lea r8, [rsp + 0x50]
sub r8, rbx
sar r8, 1
mov r9, rdi
mov rdx, rsi
mov rcx, rsi
call fcn.1800030a0
jmp 0x18000b104
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
jbe 0x18000b090
call fcn.1800a09f0
mov rax, qword [rsi + 0x20]
cmp rax, rdi
jae 0x18000b0aa
mov r8, qword [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.180003710
jmp 0x18000b0c3
test rdi, rdi
jne 0x18000b0c3
mov qword [rsi + 0x18], r14
cmp rax, 8
jb 0x18000b0bc
mov rbx, qword [rbx]
mov word [rbx], 0
jmp 0x18000b104
test rdi, rdi
je 0x18000b104
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x18000b0d7
mov rcx, qword [rbx]
jmp 0x18000b0da
mov rcx, rbx
lea r13, [rdi + rdi]
add rdx, rdx
mov r9, r13
lea r8, [rsp + 0x50]
call fcn.1800a1c40
mov qword [rsi + 0x18], rdi
cmp qword [rsi + 0x20], 8
jb 0x18000b0fc
mov rbx, qword [rbx]
mov word [r13 + rbx], 0
cmp qword [rbp + 0x20], 8
jb 0x18000b114
mov rcx, qword [r12]
call fcn.1800a2030
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r14
mov word [r12], 0
mov rax, rsi
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0x2060
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000c3a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800030a0
nop
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.1800192c0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000c42b
cmp qword [rsp + 0x48], 8
jb 0x18000c427
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
mov al, 1
jmp 0x18000c43f
cmp qword [rsp + 0x48], 8
jb 0x18000c43d
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0x68
ret

Function at 0x18000c480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800030a0
nop
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.1800192c0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000c50f
test al, 0x10
jne 0x18000c50f
cmp qword [rsp + 0x48], 8
jb 0x18000c50b
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
mov al, 1
jmp 0x18000c523
cmp qword [rsp + 0x48], 8
jb 0x18000c521
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0x68
ret

Function at 0x18000c560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800030a0
nop
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.1800192c0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000c5ef
test al, 0x10
je 0x18000c5ef
cmp qword [rsp + 0x48], 8
jb 0x18000c5eb
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
mov al, 1
jmp 0x18000c603
cmp qword [rsp + 0x48], 8
jb 0x18000c601
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0x68
ret
Function at 0x18000c640
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x20], 8
mov rdi, rcx
lea rbx, [rcx + 8]
jb 0x18000c65d
mov rcx, qword [rbx]
jmp 0x18000c660
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x18000c684
and eax, 0xfffffffe
cmp qword [rdi + 0x20], 8
jb 0x18000c679
mov rcx, qword [rbx]
jmp 0x18000c67c
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp qword [rdi + 0x20], 8
jb 0x18000c68e
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x30]
cmp eax, 1
sete al
add rsp, 0x20
pop rdi
ret