joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001d334
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp rax, rbx
mov rsi, rax
je 0x10001d481
lea rdx, [0x100019708]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp rax, rbx
mov rdi, rax
je 0x10001d456
lea r8, [0x100035f40]
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, ebx
je 0x10001d404
lea rdx, [0x100019b68]
lea rcx, [0x100019cf8]
call fcn.100021ab8
jmp 0x10001d3c0
cmp eax, 3
jne 0x10001d3e5
lea rcx, [0x100019d14]
call fcn.100021ab8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x100035f40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, ebx
mov eax, dword [0x100035f44]
jne 0x10001d3af
cmp eax, 1
lea rdx, [0x100019b68]
lea rcx, [0x100019d18]
je 0x10001d3ff
lea rcx, [0x100019d38]
call fcn.100021ab8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
cmp eax, ebx
je 0x10001d42b
lea rdx, [0x100019b68]
lea rcx, [0x100019d68]
call fcn.100021ab8
mov ebx, 1
jmp 0x10001d44b
lea rcx, [0x100035b30]
mov edx, 0x100
call fcn.10001d4ec
lea rcx, [0x100019d88]
mov rdx, rax
call fcn.100021ab8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001d476
lea rcx, [0x100035b30]
mov edx, 0x100
call fcn.10001d4ec
lea rcx, [0x100019cc0]
mov rdx, rax
call fcn.100021ab8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001d4a1
lea rcx, [0x100035b30]
mov edx, 0x100
call fcn.10001d4ec
lea rcx, [0x100019c30]
mov rdx, rax
call fcn.100021ab8
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10001d5a0
Capabilities:
Enumerate services

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
xor edi, edi
lea rax, [r11 - 0x38]
mov r13, rdx
mov qword [r11 - 0x40], rax
lea rax, [r11 + 0x20]
mov rsi, rcx
mov qword [r11 - 0x48], rax
lea rax, [r11 + 0x18]
lea ebp, [rdi + 3]
mov qword [r11 - 0x50], rax
lea edx, [rdi + 0x30]
xor r9d, r9d
mov r8d, ebp
mov rcx, r13
mov dword [rsp + 0x20], edi
mov dword [r11 + 0x18], edi
mov dword [r11 + 0x20], edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cmp eax, edi
jne 0x10001d729
cmp dword [rsp + 0x90], edi
je 0x10001d729
mov ebx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov r12, rax
je 0x10001d729
mov ecx, dword [rsp + 0x90]
lea rax, [rsp + 0x40]
lea edx, [rdi + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x98]
mov r9, r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov r8d, ebp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cmp eax, edi
je 0x10001d715
cmp dword [rsp + 0x98], edi
mov ebp, edi
jbe 0x10001d715
lea rbx, [r12 + 0x14]
lea r14d, [rdi + 1]
mov rcx, qword [rbx - 0xc]
lea rdx, [0x100019e18]
call fcn.100021854
cmp eax, edi
jne 0x10001d6b3
cmp dword [rbx], 4
je 0x10001d6c5
add ebp, r14d
add rbx, 0x30
cmp ebp, dword [rsp + 0x98]
jae 0x10001d715
jmp 0x10001d69a
mov eax, ebp
mov edx, edi
lea rcx, [rax + rax*2]
add rcx, rcx
mov r8, qword [r12 + rcx*8]
mov ecx, 0x104
sub r8, rsi
lea rax, [rcx + 0x7ffffefa]
cmp rax, rdi
je 0x10001d6fe
movzx eax, word [r8 + rsi]
cmp ax, di
je 0x10001d6fe
mov word [rsi], ax
add rsi, 2
sub rcx, r14
jne 0x10001d6dc
cmp rcx, rdi
jne 0x10001d70c
sub rsi, 2
mov edx, 0x8007007a
cmp edx, edi
mov word [rsi], di
cmove edi, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10001d754
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbx, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp rax, rdi
mov rbp, rax
je 0x10001d88e
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp rax, rdi
mov r13, rax
je 0x10001d885
lea rax, [rsp + 0x78]
lea esi, [rdi + 3]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov edx, esi
mov rcx, rbp
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], edi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cmp eax, edi
jne 0x10001d87c
cmp dword [rsp + 0x70], edi
je 0x10001d87c
mov ebx, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov r12, rax
je 0x10001d87c
mov r9d, dword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov r8, r12
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov edx, esi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cmp eax, edi
je 0x10001d868
cmp dword [rsp + 0x78], edi
mov ebx, edi
jbe 0x10001d868
mov rsi, r12
mov rcx, qword [rsi]
lea rdx, [0x100019708]
call fcn.100021854
cmp eax, edi
je 0x10001d863
add ebx, 1
add rsi, 0x30
cmp ebx, dword [rsp + 0x78]
jb 0x10001d841
jmp 0x10001d868
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x10001db54
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rdx, rdx
mov rax, qword [0x1000345a8]
mov rdi, rdx
mov qword [rcx], rax
mov rsi, rcx
je 0x10001dbf6
mov rax, rdx
shr rax, 0x10
test ax, ax
jne 0x10001dbcc
movzx ebx, dx
xor r8d, r8d
mov edx, ebx
call fcn.10001e498
test eax, eax
jne 0x10001dbf6
mov rax, qword [0x1000345a8]
lea rdx, [0x100019e50]
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x30], rax
call fcn.10001e400
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x30]
call fcn.10001da98
jmp 0x10001dbf6
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10001dbf6
movsxd rbx, eax
mov rcx, rsi
mov rdx, rbx
call fcn.10001d8e8
mov rcx, qword [rsi]
lea r8, [rbx + rbx]
mov rdx, rdi
call fcn.100022010
mov rbx, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10001e6cc
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x150
mov rax, qword [0x100033380]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
mov rbp, rdx
mov r12d, ecx
cmp dword [0x100035f8c], ebx
je 0x10001e70e
lea eax, [rbx + 1]
jmp 0x10001e837
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x114
call fcn.100028c50
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x10001e835
cmp dword [rsp + 0x30], 2
jne 0x10001e835
cmp dword [rsp + 0x24], 5
jb 0x10001e835
cmp r12d, 1
mov esi, ebx
jne 0x10001e795
cmp rbp, rbx
je 0x10001e795
lea rcx, [0x1000347f0]
call fcn.10001f7c8
cmp eax, r12d
jne 0x10001e795
lea rcx, [0x100034870]
mov rdx, rbp
call fcn.100020114
cmp eax, r12d
mov esi, eax
jne 0x10001e795
lea rcx, [0x1000347f8]
xor edx, edx
call fcn.10001fbcc
mov esi, eax
cmp r12d, 2
jne 0x10001e7d9
cmp rbp, rbx
mov esi, ebx
je 0x10001e7d9
lea rcx, [0x1000347f0]
call fcn.10001f7c8
cmp eax, 1
jne 0x10001e7d9
lea rcx, [0x100034870]
mov rdx, rbp
call fcn.10002020c
cmp eax, 1
mov esi, eax
jne 0x10001e7d9
lea rcx, [0x1000347f8]
xor edx, edx
call fcn.10001fb60
mov esi, eax
cmp r12d, 3
jne 0x10001e81d
cmp rbp, rbx
mov esi, ebx
je 0x10001e81d
lea rcx, [0x1000347f0]
call fcn.10001f7c8
cmp eax, 1
jne 0x10001e81d
lea rcx, [0x100034870]
mov rdx, rbp
call fcn.100020304
cmp eax, 1
mov esi, eax
jne 0x10001e81d
lea rcx, [0x1000347f8]
xor edx, edx
call fcn.10001fbcc
mov esi, eax
cmp esi, ebx
je 0x10001e832
mov dword [0x100035f8c], 1
mov ebx, 1
jmp 0x10001e835
or ebx, 0xffffffff
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.100021240
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x10001f150
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x100035f8c], ebx
je 0x10001f183
cmp dword [rcx + 0x10], ebx
jne 0x10001f169
xor eax, eax
jmp 0x10001f199
mov r8, qword [0x1000348b8]
mov eax, 0xc
cmp r8, rbx
je 0x10001f192
mov rcx, qword [rcx + 8]
call r8
jmp 0x10001f192
cmp dword [rcx + 0x10], ebx
je 0x10001f197
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x10001f29c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
cmp dword [rcx + 0x10], 0
mov rbx, rdx
mov rsi, rcx
lea rdx, [0x100019620]
jne 0x10001f2d0
mov rcx, rbx
call fcn.10001dc10
jmp 0x10001f3d7
lea rcx, [rsp + 0x48]
call fcn.10001dc10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, 0x200
mov r8, rbp
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
jne 0x10001f312
lea rdx, [0x100019620]
mov rcx, rbx
call fcn.10001dc10
jmp 0x10001f3cd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x10001f347
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10001f2fe
mov rcx, qword [rsi + 8]
mov eax, 0x100
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov r8, rdi
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rbp
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10001f398
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.10001dd68
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.10001d8a8
lea rcx, [rsp + 0x48]
call fcn.10001da98
lea r11, [rsp + 0x60]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x10001f3f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x10], 0
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
jne 0x10001f427
lea rdx, [0x100019620]
mov rcx, rbx
call fcn.10001dc10
jmp 0x10001f4db
lea rdx, [0x100019624]
lea rcx, [rsp + 0x78]
call fcn.10001db54
mov dword [rsp + 0x60], 0x100
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
jne 0x10001f473
lea rdx, [0x100019624]
mov rcx, rbx
call fcn.10001db54
jmp 0x10001f4d1
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rcx, qword [rsi + 8]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8, rax
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10001f4b0
lea rcx, [rsp + 0x78]
mov rdx, rdi
call fcn.10001dd68
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.10001d8a8
lea rcx, [rsp + 0x78]
call fcn.10001da98
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x10001f4f4
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rcx
mov ebx, dword [rcx + 0x14]
lea rcx, [0x100019eb0]
mov qword [rax - 0x40], rcx
xor esi, esi
mov dword [rax - 0x30], esi
mov qword [rax - 0x38], rsi
mov ecx, 0x20019
cmp ebx, esi
cmove ebx, ecx
lea rcx, [rax - 0x38]
mov qword [rax - 0x58], rcx
mov r9d, ebx
xor r8d, r8d
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, esi
cmp eax, esi
sete cl
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], ebx
mov rbx, qword [0x1000345a8]
mov qword [rsp + 0x80], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x38]
call fcn.10001f29c
cmp rbx, qword [rax]
je 0x10001f59b
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.10001dcf8
mov rbx, qword [rsp + 0x80]
lea rdx, [0x100019620]
lea rcx, [rsp + 0x90]
call fcn.10001dc10
mov r11, rbx
mov rdx, qword [rsp + 0x90]
sub rdx, rbx
movzx ecx, word [r11]
movzx eax, word [r11 + rdx]
sub ecx, eax
jne 0x10001f5d2
add r11, 2
test eax, eax
jne 0x10001f5bd
mov edi, esi
cmp ecx, esi
setne dil
lea rcx, [rsp + 0x90]
call fcn.10001da98
lea rcx, [rsp + 0x98]
call fcn.10001da98
cmp edi, esi
je 0x10001f62f
cmp dword [rsp + 0x48], esi
je 0x10001f613
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.10001f4f4
cmp eax, esi
jne 0x10001f566
lea rcx, [rsp + 0x80]
call fcn.10001da98
nop
lea rcx, [rsp + 0x38]
call fcn.10001f264
xor eax, eax
jmp 0x10001f661
lea rcx, [rsp + 0x80]
call fcn.10001da98
nop
lea rcx, [rsp + 0x38]
call fcn.10001f264
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
sete sil
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x10001f7c8
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x100033380]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
xor ebx, ebx
call fcn.100028c50
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
jne 0x10001f81c
cmp dword [rsp + 0x24], 5
lea eax, [rbx + 1]
cmovae ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.100021240
add rsp, 0xd0
pop rbx
ret
Function at 0x10001fcf0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [0x100035f90]
xor esi, esi
mov rbx, rcx
cmp rdi, rsi
jne 0x10001fd3b
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x28], rsi
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
xor eax, eax
jmp 0x10001fe49
mov edx, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 8], rax
jne 0x10001fd78
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], rsi
jmp 0x10001fd34
mov edx, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x10], rax
je 0x10001fd52
mov edx, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x18], rax
je 0x10001fd52
mov edx, 9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x20], rax
je 0x10001fd52
mov edx, 0xb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x28], rax
je 0x10001fd52
mov edx, 0xd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x30], rax
je 0x10001fd52
mov edx, 0xf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x38], rax
je 0x10001fd52
mov edx, 0x11
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x40], rax
je 0x10001fd52
mov edx, 0x13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x48], rax
je 0x10001fd52
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x10001febc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [0x100035f90]
xor esi, esi
mov rbx, rcx
cmp rdi, rsi
jne 0x10001ff0f
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x28], rsi
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rsi
xor eax, eax
jmp 0x10002005b
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 8], rax
jne 0x10001ff54
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rsi
mov qword [rbx + 0x58], rsi
jmp 0x10001ff08
mov edx, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x10], rax
je 0x10001ff26
mov edx, 5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x18], rax
je 0x10001ff26
mov edx, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x20], rax
je 0x10001ff26
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x28], rax
je 0x10001ff26
mov edx, 0xc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x30], rax
je 0x10001ff26
mov edx, 0xe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x38], rax
je 0x10001ff26
mov edx, 0x10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x40], rax
je 0x10001ff26
mov edx, 0x12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x48], rax
je 0x10001ff26
mov edx, 7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x50], rax
je 0x10001ff26
mov edx, 0x14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rsi
mov qword [rbx + 0x58], rax
je 0x10001ff26
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x100020880
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0xc0
mov rax, qword [0x100033380]
xor rax, rsp
mov qword [rsp + 0xb0], rax
test rdx, rdx
mov rsi, rdx
mov rdi, rcx
jne 0x1000208b9
xor eax, eax
jmp 0x100020a33
cmp word [rdx], 0
je 0x1000208b2
call fcn.1000206e0
test rax, rax
mov rbx, rax
je 0x10002099f
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x80
call fcn.100028c50
lea r9, [rsp + 0x30]
lea r8, [0x100019624]
lea rdx, [0x100019f18]
lea rcx, [0x1000196a0]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x10002099f
mov rbp, qword [rdi + 8]
mov ebx, eax
test rbp, rbp
jne 0x100020935
mov rdx, rsi
mov rcx, rdi
call fcn.1000205bc
test rax, rax
mov rbp, rax
je 0x100020989
mov rcx, rbp
call fcn.10001f958
lea r12, [rax + rbx + 2]
lea rcx, [r12 + r12]
call fcn.10001f8ac
test rax, rax
mov rbx, rax
je 0x100020989
lea rax, [rsp + 0x30]
lea r8, [0x100019f08]
mov r9, rbp
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.10001ac04
test eax, eax
je 0x100020980
mov rcx, rbx
call fcn.10001f924
xor ebx, ebx
test rbx, rbx
jne 0x100020a2c
lea rcx, [rsp + 0x30]
call fcn.10001f99c
test rax, rax
mov rbx, rax
jne 0x100020a2c
lea rcx, [0x100019f30]
call fcn.10001f99c
mov rbp, qword [rdi + 8]
test rbp, rbp
mov rbx, rax
jne 0x1000209ca
mov rdx, rsi
mov rcx, rdi
call fcn.1000205bc
test rax, rax
mov rbp, rax
je 0x100020a2c
mov rcx, rbp
call fcn.10001f958
mov rcx, rbx
mov r9, rax
call fcn.10001f958
lea r12, [r9 + rax + 2]
cmp r12, 2
jbe 0x100020a2c
lea rcx, [r12 + r12]
call fcn.10001f8ac
test rax, rax
mov rsi, rax
je 0x100020a2c
lea r8, [0x100019f08]
mov r9, rbp
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10001ac04
test eax, eax
jne 0x100020a24
mov rcx, rbx
call fcn.10001f924
mov rbx, rsi
jmp 0x100020a2c
mov rcx, rsi
call fcn.10001f924
mov qword [rdi + 0x10], rbx
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.100021240
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret