joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033ee0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x140033efc
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x140033f49
mov ecx, dword [0x1401a3a34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140033f38
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140033f38
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140033f54
inc ecx
inc rax
cmp rax, 6
jl 0x140033f26
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x28]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140033f80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x140033f9c
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x140033fe9
mov ecx, dword [0x1401a3a34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140033fd8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140033fd8
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140033ff4
inc ecx
inc rax
cmp rax, 6
jl 0x140033fc6
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x30]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140034020
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14003407d
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x140034075
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140034070
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140034070
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400340ca
mov ecx, dword [0x1401a3a34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400340b9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400340b9
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400340d5
inc ecx
inc rax
cmp rax, 6
jl 0x1400340a7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140034100
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14003415d
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140034155
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140034150
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140034150
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400341aa
mov ecx, dword [0x1401a3a34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140034199
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140034199
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400341b5
inc ecx
inc rax
cmp rax, 6
jl 0x140034187
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x38]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140034840
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1400348a0
lea rcx, [rbx + 0x1b0]
cmp qword [rcx + 0x20], 0
je 0x14003486e
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x150]
call fcn.1400311d0
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140034898
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x140034898
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400348ea
mov ecx, dword [0x1401a3a34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400348d9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400348d9
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400348f5
inc ecx
inc rax
cmp rax, 2
jl 0x1400348c7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1e8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400354f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140035517
add rcx, 8
call fcn.1400311d0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140035564
mov ecx, dword [0x1401a3a34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140035553
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140035553
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003556f
inc ecx
inc rax
cmp rax, 6
jl 0x140035541
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x88]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140035810
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14003584a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003584f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140035898
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14003cb40]
cmp byte [rcx + rax], 0
je 0x140035898
dec r8
sub rdx, 1
jne 0x14003587e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14003713c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140037186
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140037186
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140037186
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140037186
cmp dword [rcx + 0x84], 0xe
jbe 0x140037186
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140037188
xor al, al
add rsp, 0x28
ret
Function at 0x14000dad0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rbx, rcx
mov dword [rsp + 0x20], 0
mov rcx, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14000db0e
lea rdx, [0x1401452c0]
mov rcx, rbx
call fcn.140003600
jmp 0x14000dba8
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x14000db98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14000db98
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140003600
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003560
mov dword [rsp + 0x20], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0xb0], rax
lea rax, vtable.CVolMem.0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.1400fd160
nop
lea rax, vtable.CVolObject.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rax
jmp 0x14000dbb0
lea rdx, [0x1401452c0]
mov rcx, rbx
call fcn.140003600
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret

Function at 0x14000dbd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x90
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400fcc20
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400fcbc0
mov rbx, rax
lea rcx, [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x30], rcx
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400fe430
nop
lea rbp, vtable.CVolMem.0
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x58]
call fcn.1400fd160
nop
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x58], r14
mov rdx, qword [rsp + 0x48]
add rdx, 2
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
xor ebx, ebx
test rax, rax
je 0x14000dcde
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
test r8, r8
cmove rdx, rbx
mov rcx, rax
call fcn.14010bf90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rdi, rdi
jne 0x14000dcb8
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000dcde
mov rdx, rsi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov ebx, 1
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0x20]
call fcn.1400fd160
nop
mov qword [rsp + 0x20], r14
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14000eaf0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0x98
xorps xmm0, xmm0
movups xmmword [rax - 0x78], xmm0
mov dword [rax - 0x78], 0x70
movups xmmword [rax - 0x68], xmm0
movups xmmword [rax - 0x58], xmm0
movups xmmword [rax - 0x48], xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
call fcn.140100bf0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
lea rax, str.runas
mov dword [rsp + 0x24], 0x8000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x50], 0xa
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
add rsp, 0x98
ret

Function at 0x14000eb60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, ecx
test ecx, ecx
jne 0x14000eb76
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov r8d, eax
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test ebx, ebx
mov rbx, qword [rsp + 0x30]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x14000f320
Capabilities:
Connect udp socket

Disassembly:
cmp dword [0x1403ab274], 0
jne 0x14000f32f
mov eax, 0xffffffff
ret
jmp fcn.140102220

Function at 0x140018170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
call fcn.140033140
mov r8, qword [rbx]
mov rcx, rbx
mov rdi, rax
call qword [r8 + 0x28]
cmp rdi, rax
je 0x1400181cd
mov r8d, dword [rdi + 0x18]
cmp dword [rax + 0x18], r8d
jne 0x140018283
mov r8, qword [rdi + 0x10]
cmp qword [rax + 0x10], r8
jne 0x140018283
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.140110dc0
test eax, eax
jne 0x140018283
movzx eax, byte [rbx + 8]
xor al, byte [rsi + 8]
test al, 1
jne 0x140018283
mov rax, qword [rbx + 0x10]
cmp qword [rsi + 0x10], rax
jne 0x140018283
mov eax, dword [rbx + 0x18]
cmp dword [rsi + 0x18], eax
jne 0x140018283
lea rcx, [rbx + 0x20]
call fcn.140100bf0
lea rcx, [rsi + 0x20]
mov rdi, rax
call fcn.140100bf0
sub rdi, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140018223
add rax, 2
test ecx, ecx
jne 0x140018210
test edx, edx
jne 0x140018283
lea rcx, [rbx + 0x78]
call fcn.140100bf0
lea rcx, [rsi + 0x78]
mov rdi, rax
call fcn.140100bf0
sub rdi, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140018253
add rax, 2
test ecx, ecx
jne 0x140018240
test edx, edx
jne 0x140018283
lea rdx, [rbx + 0xd0]
lea rcx, [rsi + 0xd0]
call fcn.140014ff0
test eax, eax
jne 0x140018283
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e0e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rdi, rdx
mov rbx, rcx
add rcx, 0xec0
xor edx, edx
call fcn.1400a1550
lea rdx, [0x1401452c0]
lea rcx, [rsp + 0x30]
call fcn.14000f700
nop
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1403acca0]
mov edx, dword [0x1403acc38]
mov rcx, rbx
call fcn.140024b20
nop
lea rcx, [rsp + 0x30]
call fcn.14000f880
lea rdx, [0x1401469c4]
lea rcx, [rsp + 0xe0]
call fcn.14000f700
mov rbx, rax
lea r8, [0x1401469f0]
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.1400ffdc0
nop
mov r8d, 0x40
mov rdx, rbx
mov rcx, rax
call fcn.14002c150
nop
lea rcx, [rsp + 0x88]
call fcn.140004670
nop
lea rcx, [rsp + 0xe0]
call fcn.14000f880
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14002bed0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rsi, r8
mov r14, rdx
mov rdi, rcx
lea rcx, [rsp + 0x78]
call fcn.1400fcc20
nop
mov r8, rdi
lea rdx, vtable.CVolCommonBaseWithMemManager.0
lea rcx, [rbp - 0x18]
call fcn.1400ffc30
nop
mov rcx, rax
call fcn.140100bf0
mov rcx, rax
call fcn.1400fb4b0
mov rbx, rax
lea rax, [rbp + 8]
mov qword [rbp + 0x88], rax
lea r12, vtable.CVolMem.0
mov qword [rbp + 8], r12
lea rcx, [rbp + 8]
call fcn.1400fd160
nop
lea r15, vtable.CVolObject.0
mov qword [rbp + 8], r15
mov qword [rbp - 0x18], r15
test ebx, ebx
je 0x14002bfaf
mov r8, rdi
lea rdx, vtable.CVolCommonBaseWithMemManager.0
lea rcx, [rsp + 0x20]
call fcn.1400ffc30
nop
mov rcx, rax
call fcn.140100bf0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rax, [rsp + 0x40]
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x40]
call fcn.1400fd160
nop
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x88], 0x632989ea
lea rcx, [rbp - 0x50]
call fcn.1400fcc20
nop
mov qword [rbp - 0x50], r12
mov r8d, 4
lea rdx, [rbp + 0x88]
lea rcx, [rbp - 0x50]
call fcn.1400fcfd0
nop
mov rdx, qword [rbp - 0x38]
xor r13d, r13d
mov r8, qword [rbp - 0x28]
test r8, r8
cmove rdx, r13
lea rcx, [rsp + 0x78]
call fcn.1400fcfd0
nop
mov qword [rbp - 0x50], r12
lea rcx, [rbp - 0x50]
call fcn.1400fd160
nop
mov qword [rbp - 0x50], r15
mov dword [rbp + 0x88], 0x632e9fff
lea rcx, [rsp + 0x20]
call fcn.1400fcc20
nop
mov qword [rsp + 0x20], r12
lea r8d, [r13 + 4]
lea rdx, [rbp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.1400fcfd0
nop
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
test r8, r8
cmove rdx, r13
lea rcx, [rsp + 0x78]
call fcn.1400fcfd0
nop
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0x20]
call fcn.1400fd160
nop
mov qword [rsp + 0x20], r15
mov r8, rsi
mov rdx, r14
lea rcx, [rbp - 0x18]
call fcn.140071230
nop
mov r8, qword [rax + 0x28]
test r8, r8
mov edx, r13d
je 0x14002c08e
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x78]
call fcn.1400fcfd0
nop
mov qword [rbp - 0x18], r12
lea rcx, [rbp - 0x18]
call fcn.1400fd160
nop
mov qword [rbp - 0x18], r15
mov r8, rdi
lea rdx, vtable.CVolCommonBaseWithMemManager.0
lea rcx, [rsp + 0x20]
call fcn.1400ffc30
nop
mov rcx, rax
call fcn.140100bf0
mov rdx, rax
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x78]
call fcn.1400fe410
mov rbx, rax
lea rax, [rsp + 0x40]
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x40]
call fcn.1400fd160
nop
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x20], r15
mov qword [rbp - 0x60], r13
lea rcx, [rsp + 0x78]
call fcn.1400fd160
nop
mov qword [rsp + 0x78], r12
lea rcx, [rsp + 0x78]
call fcn.1400fd160
nop
mov qword [rsp + 0x78], r15
mov eax, ebx
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140033b60
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, dword [0x1403b7c30]
mov rax, qword gs:[0x58]
mov ecx, 4
mov r8, qword [rax + rdx*8]
mov eax, dword [rcx + r8]
cmp dword [0x1403b5e90], eax
jg 0x140033ba1
mov rdx, rbx
lea rcx, [0x1403b5e40]
add rsp, 0x20
pop rbx
jmp 0x1400f9660
lea rcx, [0x1403b5e90]
call fcn.14010a3e8
cmp dword [0x1403b5e90], 0xffffffff
jne 0x140033b8d
lea r8, [0x140148440]
lea rdx, str.PanGet.dll
lea rcx, [0x1403b5e40]
call fcn.1400f8cd0
lea rcx, [0x140141120]
call fcn.14010a248
nop
lea rcx, [0x1403b5e90]
call fcn.14010a388
jmp 0x140033b8d

Function at 0x140040410
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x5050
call fcn.14010a6d0
sub rsp, rax
mov rax, qword [0x1403a6cc8]
xor rax, rsp
mov qword [rsp + 0x5040], rax
mov r15, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x38], rcx
mov rsi, qword [rsp + 0x50b0]
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rax, vtable.CVolObject.0
mov qword [rcx], rax
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
lea rax, vtable.CWString.0
mov qword [rcx], rax
add rcx, 0x20
call fcn.1400fcc20
nop
mov qword [r14 + 0x18], r12
mov qword [r14 + 0x50], 0xfe
mov dword [rsp + 0x30], 1
mov rcx, qword [rdi + 0x18]
mov eax, r12d
test rcx, rcx
je 0x1400404aa
cmp word [rcx], r12w
sete al
jmp 0x1400404b2
cmp qword [rdi + 0x48], 2
setle al
test eax, eax
jne 0x140040559
mov rcx, qword [rbp + 0x18]
mov eax, r12d
test rcx, rcx
je 0x1400404cf
cmp word [rcx], r12w
sete al
jmp 0x1400404d7
cmp qword [rbp + 0x48], 2
setle al
test eax, eax
jne 0x140040559
mov rcx, qword [r15 + 0x18]
mov eax, r12d
test rcx, rcx
je 0x1400404f0
cmp word [rcx], r12w
sete al
jmp 0x1400404f8
cmp qword [r15 + 0x48], 2
setle al
test eax, eax
jne 0x140040559
mov word [rsp + 0x40], r12w
mov rcx, rdi
call fcn.140100bf0
mov rdi, rax
mov rcx, rsi
call fcn.140100bf0
mov rsi, rax
mov rcx, r15
call fcn.140100bf0
mov rbx, rax
mov rcx, rbp
call fcn.140100bf0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x2800
lea r9, [rsp + 0x40]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140101520
mov rax, r14
mov rcx, qword [rsp + 0x5040]
xor rcx, rsp
call fcn.14010a630
add rsp, 0x5050
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140040610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1403a6cc8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, edx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea rax, vtable.CVolObject.0
mov qword [rcx], rax
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
lea rax, vtable.CWString.0
mov qword [rcx], rax
add rcx, 0x20
call fcn.1400fcc20
nop
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x50], 0xfe
mov dword [rsp + 0x20], 1
mov word [rsp + 0x30], bp
lea eax, [rdi - 1]
cmp eax, 7
ja 0x1400406f0
cmp edi, 1
jne 0x140040693
lea r8d, [rbp + 5]
jmp 0x1400406db
cmp edi, 2
jne 0x14004069e
lea r8d, [rdi + 4]
jmp 0x1400406db
cmp edi, 3
jne 0x1400406a9
lea r8d, [rdi + 0xd]
jmp 0x1400406db
cmp edi, 4
jne 0x1400406b4
lea r8d, [rdi + 0x10]
jmp 0x1400406db
cmp edi, 5
jne 0x1400406bf
lea r8d, [rdi + 6]
jmp 0x1400406db
cmp edi, 6
jne 0x1400406ca
lea r8d, [rdi - 4]
jmp 0x1400406db
mov eax, 7
mov r8d, 0x1a
cmp edi, eax
cmove r8d, eax
xor r9d, r9d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
movsxd rbp, eax
jmp 0x140040739
cmp edi, 9
jne 0x140040707
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x140040733
cmp edi, 0xa
jne 0x14004071e
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140040733
cmp edi, 0xb
jne 0x140040778
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
setne bpl
test rbp, rbp
je 0x140040778
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140101520
mov rcx, rsi
call fcn.140100bc0
mov rbx, rax
test rax, rax
jle 0x14004076b
mov rcx, rsi
call fcn.140100bf0
cmp word [rax + rbx*2 - 2], 0x5c
je 0x140040778
mov edx, 0x5c
mov rcx, rsi
call fcn.140100170
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14010a630
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret

Function at 0x140040b30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [rdx + 0x28]
test rbx, rbx
jne 0x140040b43
xor edx, edx
jmp 0x140040b47
mov rdx, qword [rdx + 0x18]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140040b82
mov dword [rsp + 0x40], 0
test rbx, rbx
je 0x140040b8a
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140040b82
cmp dword [rsp + 0x40], ebx
je 0x140040b8a
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140041b10
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, r9
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140041b4e
xor eax, eax
jmp 0x140041c00
mov rcx, qword [rsi + 0x18]
add rcx, 0x10
call fcn.1400feb60
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
lea r8, [0x140041c20]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140041bbb
mov rcx, qword [rsi + 0x18]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140041bf2
test rdi, rdi
je 0x140041bcb
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret