joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001eb10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1800c33e0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x60], 0x48
mov byte [rsp + 0x61], 0xb8
mov byte [rsp + 0x62], 0x1e
mov byte [rsp + 0x63], 0xfa
mov byte [rsp + 0x64], 0x90
mov byte [rsp + 0x65], 0x61
mov byte [rsp + 0x66], 0xdf
mov byte [rsp + 0x67], 0xd9
mov byte [rsp + 0x68], 0xd2
mov byte [rsp + 0x69], 0x22
mov byte [rsp + 0x70], 0x48
mov byte [rsp + 0x71], 0xb8
mov byte [rsp + 0x72], 0x18
mov byte [rsp + 0x73], 0x8f
mov byte [rsp + 0x74], 0xb0
mov byte [rsp + 0x75], 0xc1
mov byte [rsp + 0x76], 0xdd
mov byte [rsp + 0x77], 0xb2
mov byte [rsp + 0x78], 0x5e
mov byte [rsp + 0x79], 0x48
movabs rax, 0x288c01389535430b
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0
mov r8d, 0xa
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec11
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x18001ebe9
mov r8d, 0xa
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec39
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
jmp 0x18001ec11
mov rax, qword [rsp + 0x28]
add rax, 0x11
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x40
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
jmp 0x18001eca7
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x48], rax
je 0x18001ece9
mov eax, dword [rsp + 0x20]
movzx eax, byte [rsp + rax + 0x80]
mov rcx, qword [rsp + 0x48]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 7
mov dword [rsp + 0x20], eax
jmp 0x18001ec9a
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180084a40
add rsp, 0x98
ret
Function at 0x180006530
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea rcx, str._TLAC__DebugComponent::Initialize__:_Initialized_n
call fcn.1800042e0
movabs rax, 0x140284b01
mov byte [rbp - 0x69], 0
mov qword [rbp - 0x49], rax
lea rbx, [rbp - 0x41]
lea rax, [rbp - 0x69]
mov byte [rbp - 0x68], 0
mov qword [rbp - 0x41], rax
mov r15d, 5
lea rax, [rbp - 0x68]
mov word [rbp - 0x65], 0x1b0
mov qword [rbp - 0x39], rax
movabs rax, 0x140192601
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x67]
mov qword [rbp - 0x21], rax
movabs rax, 0x140302600
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x65]
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x63]
mov qword [rbp - 9], rax
movabs rax, 0x140302610
mov qword [rbp - 1], rax
lea rax, [rbp - 0x61]
mov qword [rbp + 7], rax
lea rax, [rbp - 0x5f]
mov qword [rbp + 0xf], rax
movabs rax, 0x140192d00
mov qword [rbp + 0x17], rax
lea rax, [rbp + 0x37]
mov qword [rbp + 0x1f], rax
lea rax, [rbp + 0x3d]
mov qword [rbp + 0x27], rax
mov word [rbp - 0x61], 0x1b0
mov dword [rbp + 0x37], 0x1b8
mov word [rbp + 0x3b], 0xc300
nop dword [rax + rax]
mov rdi, qword [rbx + 8]
lea r9, [rbp - 0x5d]
sub rdi, qword [rbx]
mov r8d, 0x40
mov rcx, qword [rbx - 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx - 8]
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rbx + 0x18]
sub r15, 1
jne 0x180006630
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [r15 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r9, [rbp - 0x59]
movabs rcx, 0x1409a0a58
lea edx, [r15 + 4]
lea r8d, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180021d70
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800066c0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x14], 0
mov rbx, rcx
je 0x1800066e9
call fcn.18001d850
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800067d0
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
call fcn.18001d850
mov edx, dword [rbx + 0x18]
cmp byte [rax + 0x1f2a], 0
je 0x18000680e
dec edx
mov byte [rbx + 0x15], 1
mov dword [rbx + 0x18], edx
cmp byte [rax + 0x1f2c], 0
je 0x180006820
inc edx
mov byte [rbx + 0x15], 1
mov dword [rbx + 0x18], edx
mov edi, 0x14
cmp edx, 0x26
jbe 0x180006831
mov dword [rbx + 0x18], edi
mov edx, edi
jmp 0x18000683d
cmp edx, edi
jae 0x18000683d
mov edx, 0x26
mov dword [rbx + 0x18], edx
cmp byte [rax + 0x114], 0
lea rsi, [0x180000000]
je 0x180006883
cmp byte [rax + 0x15], 0
jne 0x180006883
movsxd r8, edx
lea rcx, str.__s_______s__n
mov rdx, qword [str.DATA_TEST_MAIN]
mov byte [rbx + 0x14], 0
mov r8, qword [rsi + r8*8 + 0x2a150]
call fcn.1800042e0
mov edx, dword [rbx + 0x18]
mov ecx, 3
call qword [0x18002a3f8]
cmp byte [rbx + 0x15], 0
je 0x18000699f
lea rcx, [0x18002a0c4]
mov qword [rsp + 0x98], rbp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._DATA_TEST_MAIN:_n_n
call fcn.1800042e0
lea rbp, [0x18002a0dc]
nop word [rax + rax]
cmp edi, dword [rbx + 0x18]
lea eax, [rdi - 0x13]
mov r8, qword [rsi + rax*8 + 0x2a2a0]
lea rdx, [0x18002a0e0]
cmove rdx, rbp
lea rcx, str._s___s_n
call fcn.1800042e0
inc edi
cmp edi, 0x26
jbe 0x1800068c0
lea rcx, [0x18002a0f0]
call fcn.1800042e0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
mov rdi, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbp, qword [rsp + 0x98]
test rdi, rdi
je 0x18000699b
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x2c
xor eax, eax
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x64], rax
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [rsp + 0x48]
mov rcx, rdi
sub eax, 2
je 0x180006965
cmp eax, 1
je 0x18000695e
mov edx, 1
jmp 0x18000696a
mov edx, 3
jmp 0x18000696a
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov dword [rsp + 0x30], 0x43
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [rbx + 0x15], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180021d70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800067d0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x14], 0
mov rbx, rcx
je 0x1800066e9
call fcn.18001d850
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800067d0
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
call fcn.18001d850
mov edx, dword [rbx + 0x18]
cmp byte [rax + 0x1f2a], 0
je 0x18000680e
dec edx
mov byte [rbx + 0x15], 1
mov dword [rbx + 0x18], edx
cmp byte [rax + 0x1f2c], 0
je 0x180006820
inc edx
mov byte [rbx + 0x15], 1
mov dword [rbx + 0x18], edx
mov edi, 0x14
cmp edx, 0x26
jbe 0x180006831
mov dword [rbx + 0x18], edi
mov edx, edi
jmp 0x18000683d
cmp edx, edi
jae 0x18000683d
mov edx, 0x26
mov dword [rbx + 0x18], edx
cmp byte [rax + 0x114], 0
lea rsi, [0x180000000]
je 0x180006883
cmp byte [rax + 0x15], 0
jne 0x180006883
movsxd r8, edx
lea rcx, str.__s_______s__n
mov rdx, qword [str.DATA_TEST_MAIN]
mov byte [rbx + 0x14], 0
mov r8, qword [rsi + r8*8 + 0x2a150]
call fcn.1800042e0
mov edx, dword [rbx + 0x18]
mov ecx, 3
call qword [0x18002a3f8]
cmp byte [rbx + 0x15], 0
je 0x18000699f
lea rcx, [0x18002a0c4]
mov qword [rsp + 0x98], rbp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._DATA_TEST_MAIN:_n_n
call fcn.1800042e0
lea rbp, [0x18002a0dc]
nop word [rax + rax]
cmp edi, dword [rbx + 0x18]
lea eax, [rdi - 0x13]
mov r8, qword [rsi + rax*8 + 0x2a2a0]
lea rdx, [0x18002a0e0]
cmove rdx, rbp
lea rcx, str._s___s_n
call fcn.1800042e0
inc edi
cmp edi, 0x26
jbe 0x1800068c0
lea rcx, [0x18002a0f0]
call fcn.1800042e0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
mov rdi, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbp, qword [rsp + 0x98]
test rdi, rdi
je 0x18000699b
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x2c
xor eax, eax
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x64], rax
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [rsp + 0x48]
mov rcx, rdi
sub eax, 2
je 0x180006965
cmp eax, 1
je 0x18000695e
mov edx, 1
jmp 0x18000696a
mov edx, 3
jmp 0x18000696a
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov dword [rsp + 0x30], 0x43
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [rbx + 0x15], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180021d70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180007340
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [r8 + 8]
lea r9, [rsp + 0x20]
sub rbx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov rdx, rbx
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rsi]
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800073e6
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800073d4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180007403
mov rcx, r8
call fcn.18002214c
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180021d70
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x18000df70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 8]
lea r9, [rsp + 0x20]
sub rbx, qword [rdx]
mov rsi, rdx
mov rdx, rbx
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rsi]
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000e013
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000e001
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000e030
mov rcx, r8
call fcn.18002214c
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180021d70
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180012a30
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.180024c90
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800251c0
lea rdx, [0x180013020]
lea rcx, [0x1800371c0]
call fcn.1800244c0
call fcn.180024d10
mov ecx, 8
call fcn.180021d90
lea rcx, [0x180012a10]
mov qword [rax], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800155c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180012aee
cmp dword [0x180038f60], 0
jne 0x180012ae7
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [0x180038f58], xmm0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180021d70
add rsp, 0x68
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180014bf0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor esi, esi
lea rax, [0x180038f70]
nop word [rax + rax]
xor r15d, r15d
mov r12, rax
mov r13, rax
nop dword [rax]
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
xor r9d, r9d
mov r8d, ebx
mov edx, r15d
mov ecx, esi
call fcn.180014120
mov r8d, ebx
mov edx, r15d
mov ecx, esi
call fcn.180014540
cmp esi, 0x3e7
ja 0x180014e6d
cmp r15d, 3
ja 0x180014d59
cmp ebx, 1
ja 0x180014d59
movups xmm0, xmmword [str.modules]
mov r9d, esi
lea r8, str.pv._03d
mov edx, 0x20
lea rcx, [rsp + 0x140]
movups xmmword [rsp + 0x130], xmm0
call fcn.18000f120
xor edi, edi
lea r14d, [rdi + 8]
nop dword [rax]
lea r9, [rsp + 0x140]
mov dword [rsp + 0x20], edi
lea r8, str._ls.module_d
mov edx, 0x20
lea rcx, [rsp + 0x180]
call fcn.18000f120
lea r9, [0x180038670]
xor r8d, r8d
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
test eax, eax
jle 0x180014d4a
mov r8d, ebx
mov edx, r15d
mov ecx, esi
call fcn.1800140c0
test rax, rax
jne 0x180014d46
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.180012380
mov rdx, rax
mov rcx, r13
call fcn.180015140
mov r8d, ebx
mov edx, r15d
mov ecx, esi
call fcn.1800140c0
test rax, rax
je 0x180014d4a
mov dword [r14 + rax], ebp
inc edi
add r14, 4
cmp edi, 6
jl 0x180014cc0
cmp esi, 0x3e7
ja 0x180014e6d
cmp r15d, 3
ja 0x180014e6d
cmp ebx, 1
ja 0x180014e6d
movsd xmm0, qword [str.skins]
lea r8, str.pv._03d
mov eax, dword [0x18002b358]
lea rcx, [rsp + 0x180]
mov r9d, esi
movsd qword [rsp + 0x120], xmm0
mov edx, 0x20
mov dword [rsp + 0x128], eax
call fcn.18000f120
lea r9, [rsp + 0x180]
mov edx, 0x20
lea r8, str._ls.skin
lea rcx, [rsp + 0x140]
call fcn.18000f120
lea r9, [0x180038870]
xor r8d, r8d
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
cmp eax, 0xffffffff
jle 0x180014e6d
mov rcx, qword [r12]
mov rdx, qword [r12 + 8]
cmp rcx, rdx
je 0x180014e1d
cmp dword [rcx], esi
jne 0x180014e11
cmp dword [rcx + 4], ebx
je 0x180014e1f
add rcx, 0xe4
cmp rcx, rdx
jne 0x180014e08
xor ecx, ecx
test rcx, rcx
jne 0x180014e67
mov r8d, ebx
lea rcx, [rsp + 0x30]
mov edx, esi
call fcn.180012380
mov rdx, rax
mov rcx, r13
call fcn.180015140
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
cmp rcx, rax
je 0x180014e6d
nop dword [rax]
cmp dword [rcx], esi
jne 0x180014e59
cmp dword [rcx + 4], ebx
je 0x180014e67
add rcx, 0xe4
cmp rcx, rax
jne 0x180014e50
jmp 0x180014e6d
mov dword [rcx + 0x98], edi
mov r8d, ebx
mov edx, r15d
mov ecx, esi
call fcn.180014820
inc ebx
cmp ebx, 2
jl 0x180014c50
inc r15d
add r13, 0x18
add r12, 0x18
cmp r15d, 4
jl 0x180014c40
inc esi
lea rax, [0x180038f70]
cmp esi, 0x3e8
jl 0x180014c30
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180021d70
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180016c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, qword [r8 + 0x18]
mov r14, rdx
mov rsi, qword [r8 + 0x10]
mov rdi, r8
mov rdx, rcx
mov r10, r8
cmp r15, 0x10
jb 0x180016c76
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rsi, rsi
je 0x180016cb4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, rsi
jb 0x180016ca0
mov rcx, qword [rdx + 0x30]
mov rax, qword [rdx + 0x18]
and rcx, r9
mov r12, qword [rdx + 8]
add rcx, rcx
mov qword [rsp + 0x40], rbp
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r12
je 0x180016d24
mov rbp, qword [rax + rcx*8]
nop dword [rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x180016cf2
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0x10
jb 0x180016cfe
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x180016d0f
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180016d1a
cmp rbx, rbp
je 0x180016d24
mov rbx, qword [rbx + 8]
jmp 0x180016ce0
test rbx, rbx
je 0x180016d24
mov qword [r14], rbx
jmp 0x180016d27
mov qword [r14], r12
mov rbp, qword [rsp + 0x40]
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180019350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180019387
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1800193a8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800193aa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180019403
test ecx, ecx
jle 0x1800193e3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180019403
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180019403
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180019430
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180019452
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180019468
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180019484
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180019486
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x1800194c0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180019567
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1800194fb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x180019541
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x180019580
cmp rbx, rax
ja 0x180019510
mov r8, rdi
test rdi, rdi
je 0x180019567
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x18001956a
Function at 0x180019990
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800199bd
xor eax, eax
jmp 0x180019b12
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1800199e8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1800199e8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x180019b12
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180019b05
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x180019a2b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180019a56
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180019b0a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180019ac5
sub eax, 1
je 0x180019ac5
cmp eax, 2
jne 0x180019b05
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180019b0a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180019af3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180019b05
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x180019b0a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180021d70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret