joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11002cec0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rsi, [0x1100d2730]
mov rcx, rsi
lea rdx, [rsp + 0x30]
movabs rax, 0x14043caa0
call rax
test al, al
je 0x11002cf9d
mov edx, dword [rdi + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], edx
jne 0x11002cf1b
cmp eax, dword [rdi]
je 0x11002cf9d
mov qword [rsp + 0xa8], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
lea r8, [0x1100cf738]
lea rdx, [0x1100d14c0]
mov dword [rsp + 0x20], 0x40
lea rcx, [0x1100d2b60]
mov qword [rdi], rax
xor bl, bl
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x40]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x40]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
movzx ecx, bl
test eax, eax
mov rbx, qword [rsp + 0xa8]
cmove ecx, esi
mov byte [rdi + 8], cl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.11009af60
mov rsi, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret

Function at 0x11002d450
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rdi
sub rsp, 0xa0
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
mov byte [rcx + 8], 0
mov qword [rsp + 0xc0], rsi
lea rdx, [rsp + 0x30]
lea rsi, [0x1100d2730]
movabs rax, 0x14043caa0
mov rcx, rsi
call rax
test al, al
je 0x11002d535
mov ecx, dword [rdi + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], ecx
jne 0x11002d4b3
cmp eax, dword [rdi]
je 0x11002d535
mov qword [rsp + 0xb8], rbx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rsi
lea r8, [0x1100cf738]
lea rdx, [0x1100d14c0]
mov dword [rsp + 0x20], 0x40
lea rcx, [0x1100d2b60]
mov qword [rdi], rax
xor bl, bl
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x50]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x50]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
movzx ecx, bl
test eax, eax
mov rbx, qword [rsp + 0xb8]
cmove ecx, esi
mov byte [rdi + 8], cl
movdqa xmm0, xmmword [0x1100d2c00]
xor eax, eax
mov rsi, qword [rsp + 0xc0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x4e], al
mov dword [rsp + 0x48], 0xfea9a3b0
mov word [rsp + 0x4c], 0x82a7
movsxd rcx, eax
lea rdx, [rsp + 0x38]
add rdx, rcx
lea ecx, [rax + 0x7a]
inc eax
xor byte [rdx], cl
cmp eax, 0x16
jb 0x11002d560
movzx eax, byte [rdi + 8]
lea rdx, [rsp + 0x38]
mov r8, qword [0x110207df0]
mov rcx, qword [0x110207f98]
mov byte [rsp + 0x4e], 0
add rcx, 0x1bc
mov r8, qword [r8 + rax*8 + 0x48]
call fcn.11003df70
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.11009af60
add rsp, 0xa0
pop rdi
ret
Function at 0x11002daf0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [0x1100d2d18]
mov byte [rcx], 0
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 0x40
lea r8, [0x1100cf738]
xor bl, bl
lea rdx, [0x1100d2d38]
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x30]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx ecx, bl
cmove ecx, esi
mov byte [rdi], cl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x11002e2c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov byte [rcx + 0x10], 0
mov dword [rcx + 0x14], 0
call fcn.11002dbb0
movdqa xmm0, xmmword [0x1100d2e30]
xor eax, eax
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x44], al
xor edx, edx
mov dword [rsp + 0x40], 0x2a0f5601
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx + 0x14]
inc edx
xor byte [rcx], al
cmp edx, 0x14
jb 0x11002e310
movzx eax, byte [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov r8, qword [0x110207df0]
mov rcx, qword [0x110207f98]
mov byte [rsp + 0x44], 0
add rcx, 0x1bc
mov r8, qword [r8 + rax*8 + 0x48]
call fcn.11003df70
cmp byte [rbx + 0x10], 0
je 0x11002e42a
mov qword [rsp + 0x80], rdi
xor edi, edi
cmp dword [rbx + 0x14], edi
jle 0x11002e422
mov qword [rsp + 0x78], rsi
xor esi, esi
nop dword [rax + rax]
movdqa xmm0, xmmword [0x1100d2e40]
xor eax, eax
movdqa xmm1, xmmword [0x1100d2e50]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x52], al
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x50], 0x381d
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
add rdx, rcx
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
cmp eax, 0x22
jb 0x11002e3b0
mov r8, qword [rbx + 0x18]
movsxd rax, edi
imul rcx, rax, 0x4c
lea rax, [r8 + 0x44]
mov byte [rsp + 0x52], 0
mov r9d, dword [r8 + rsi]
lea rdx, [r8 + 4]
add rdx, rcx
add rax, rcx
mov rcx, qword [0x110207f98]
mov r8d, edi
mov qword [rsp + 0x28], rax
add rcx, 0x1bc
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x30]
call fcn.11003df70
inc edi
add rsi, 0x4c
cmp edi, dword [rbx + 0x14]
jl 0x11002e380
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x60
pop rbx
ret
Function at 0x11002eb00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov byte [rcx], 0
mov dword [rcx + 0x201], 0
mov word [rcx + 0x205], 0
call fcn.11002e780
movdqa xmm0, xmmword [0x1100d2fd0]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x29
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x20]
add rdx, rcx
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
cmp eax, 0x11
jb 0x11002eb50
movzx eax, byte [rbx]
lea rdx, [rsp + 0x20]
mov r8, qword [0x110207df0]
mov rcx, qword [0x110207f98]
mov byte [rsp + 0x31], 0
add rcx, 0x1bc
mov r8, qword [r8 + rax*8 + 0x48]
call fcn.11003df70
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x40
pop rbx
ret

Function at 0x110032a40
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [0x1100d2ac8]
mov byte [rcx], 0
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
lea r8, [0x1100cf738]
xor bl, bl
lea rdx, [0x1100d14c0]
lea rcx, [0x1100d3160]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x50]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x50]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
movdqa xmm0, xmmword [0x1100d3190]
test eax, eax
movzx ecx, bl
cmove ecx, esi
xor eax, eax
mov byte [rsp + 0x40], al
mov byte [rdi], cl
movdqu xmmword [rsp + 0x30], xmm0
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
add rdx, rcx
lea ecx, [rax + 0x6c]
inc eax
xor byte [rdx], cl
cmp eax, 0x10
jb 0x110032b00
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
mov r8, qword [0x110207df0]
mov rcx, qword [0x110207f98]
mov byte [rsp + 0x40], 0
add rcx, 0x1bc
mov r8, qword [r8 + rax*8 + 0x48]
call fcn.11003df70
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x110033550
Capabilities:
Read .ini file

Disassembly:
xor r10d, r10d
lea rdx, [rcx + 0x148]
mov r9, rcx
mov qword [rcx + 8], r10
mov word [rcx + 0x10], r10w
lea r8d, [r10 + 0xb]
nop word [rax + rax]
mov rax, rdx
mov ecx, 2
nop dword [rax + rax]
mov qword [rax - 0x134], r10
mov qword [rax], r10
mov qword [rax + 0x134], r10
mov qword [rax - 0x12c], r10
mov qword [rax + 8], r10
mov qword [rax + 0x13c], r10
mov qword [rax - 0x124], r10
mov qword [rax + 0x10], r10
mov qword [rax + 0x144], r10
mov qword [rax - 0x11c], r10
mov qword [rax + 0x18], r10
mov qword [rax + 0x14c], r10
mov qword [rax - 0x114], r10
mov qword [rax + 0x20], r10
mov qword [rax + 0x154], r10
mov qword [rax - 0x10c], r10
mov qword [rax + 0x28], r10
mov qword [rax + 0x15c], r10
mov qword [rax - 0x104], r10
mov qword [rax + 0x30], r10
mov qword [rax + 0x164], r10
mov qword [rax - 0xfc], r10
mov qword [rax + 0x38], r10
mov qword [rax + 0x16c], r10
mov qword [rax - 0xf4], r10
mov qword [rax + 0x40], r10
mov qword [rax + 0x174], r10
mov qword [rax - 0xec], r10
mov qword [rax + 0x48], r10
mov qword [rax + 0x17c], r10
mov qword [rax - 0xe4], r10
mov qword [rax + 0x50], r10
mov qword [rax + 0x184], r10
mov qword [rax - 0xdc], r10
mov qword [rax + 0x58], r10
mov qword [rax + 0x18c], r10
lea rax, [rax + 0x60]
sub rcx, 1
jne 0x110033580
add rdx, 0x1c
sub r8, 1
jne 0x110033570
mov rcx, r9
jmp fcn.110032d20

Function at 0x110034ad0
Capabilities:
Read .ini file

Disassembly:
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
lea r14, [0x1100d3310]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x50], rax
mov rcx, r14
mov qword [rsp + 0x58], rax
movabs rax, 0x14043caa0
call rax
test al, al
je 0x110034c24
mov ecx, dword [rdi + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], ecx
jne 0x110034b39
cmp eax, dword [rdi]
je 0x110034c24
mov qword [rsp + 0x98], rbx
lea rdx, [0x1100d1b3c]
mov qword [rsp + 0xa0], rbp
lea rcx, [0x1100d14f4]
mov r9, r14
mov qword [rsp + 0x70], rsi
xor r8d, r8d
mov qword [rdi], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi + 8], eax
mov rcx, 0xffffffffffffffff
movsxd rbp, eax
mov eax, 0x2a
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
xor ebx, ebx
mov qword [rsp + 0x38], rax
mov rsi, rax
test rax, rax
je 0x110034bb0
test rbp, rbp
je 0x110034bb3
imul r8, rbp, 0x2a
xor edx, edx
mov rcx, rax
call fcn.11009c5d0
jmp 0x110034bb3
mov rsi, rbx
mov rbp, qword [rsp + 0xa0]
mov qword [rdi + 0x10], rsi
mov rsi, qword [rsp + 0x70]
cmp dword [rdi + 8], ebx
jle 0x110034c1c
nop dword [rax]
mov r8d, ebx
lea rdx, [0x1100d3338]
lea rcx, [rsp + 0x40]
call fcn.110001a70
movsxd rax, ebx
lea r8, [0x1100d14fc]
imul r9, rax, 0x2a
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x40]
add r9, qword [rdi + 0x10]
lea rcx, [0x1100d14f4]
mov dword [rsp + 0x20], 0x2a
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
inc ebx
cmp ebx, dword [rdi + 8]
jl 0x110034bd0
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x78
pop r14
pop rdi
ret
Function at 0x110034cb0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
lea r14, [0x1100d3310]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov dword [rcx + 8], ebx
mov rcx, r14
mov qword [rsp + 0x58], rax
movabs rax, 0x14043caa0
call rax
test al, al
je 0x110034dfc
mov ecx, dword [rdi + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], ecx
jne 0x110034d1f
cmp eax, dword [rdi]
je 0x110034dfc
mov qword [rsp + 0x98], rbp
lea rdx, [0x1100d1b3c]
mov r9, r14
mov qword [rsp + 0xa0], rsi
xor r8d, r8d
mov qword [rdi], rax
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi + 8], eax
mov rcx, 0xffffffffffffffff
movsxd rbp, eax
mov eax, 0x2a
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
mov qword [rsp + 0x38], rax
mov rsi, rax
test rax, rax
je 0x110034d8f
test rbp, rbp
je 0x110034d92
imul r8, rbp, 0x2a
xor edx, edx
mov rcx, rax
call fcn.11009c5d0
jmp 0x110034d92
mov rsi, rbx
mov rbp, qword [rsp + 0x98]
mov qword [rdi + 0x10], rsi
mov rsi, qword [rsp + 0xa0]
cmp dword [rdi + 8], ebx
jle 0x110034dfc
nop dword [rax + rax]
mov r8d, ebx
lea rdx, [0x1100d3338]
lea rcx, [rsp + 0x40]
call fcn.110001a70
movsxd rax, ebx
lea r8, [0x1100d14fc]
imul r9, rax, 0x2a
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x40]
add r9, qword [rdi + 0x10]
lea rcx, [0x1100d14f4]
mov dword [rsp + 0x20], 0x2a
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
inc ebx
cmp ebx, dword [rdi + 8]
jl 0x110034db0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x70
pop r14
pop rdi
pop rbx
ret
Function at 0x110037870
Capabilities:
Read .ini file

Disassembly:
mov qword [rcx + 8], 0xffffffffffffff00
mov qword [rcx + 0x1a], 0xffffffffffffffff
mov qword [rcx + 0x10], 0xffffffffffffffff
mov qword [rcx + 0x22], 0xffffffffffffffff
mov word [rcx + 0x18], 0xffff
mov byte [rcx + 0x2a], 0xff
jmp fcn.110037380

Function at 0x1100383e0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov byte [rcx], 0
mov rdi, rcx
mov qword [rcx + 4], rbx
mov word [rcx + 0xc], bx
lea rbp, [0x1100d3a00]
mov dword [rcx + 0x10], ebx
lea rdx, [0x1100d3a20]
lea r8d, [rbx + 0x1e]
mov r9, rbp
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rbp
lea rdx, [0x1100d3a38]
lea rcx, [0x1100d14f4]
mov byte [rdi], al
mov r8d, 0x16e3600
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rbp
lea rdx, [0x1100d3a50]
lea rcx, [0x1100d14f4]
mov dword [rdi + 4], eax
mov r8d, 0x2dc6c0
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rbp
lea r8d, [rbx + 0xa]
lea rdx, [0x1100d3a68]
mov dword [rdi + 8], eax
lea rcx, [0x1100d3a74]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov esi, 1
lea rdx, [0x1100d3a78]
lea rcx, [0x1100d3a74]
mov byte [rdi + 0xc], al
mov r8d, esi
mov r9, rbp
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100cf738]
mov byte [rdi + 0xd], al
lea rdx, [0x1100d3a90]
mov dword [rsp + 0x20], 0x40
lea rcx, [0x1100d3a98]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea r8d, [rbx + 4]
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov r8d, esi
lea rcx, [rsp + 0x30]
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
cmove ebx, esi
mov dword [rdi + 0x10], ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1100385c0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor eax, eax
mov byte [rcx], 0
mov qword [rcx + 4], rax
lea rbp, [0x1100d2ac8]
mov rdi, rcx
mov qword [rsp + 0x28], rbp
lea rcx, [0x1100d3ac0]
mov dword [rsp + 0x20], 0x40
lea r9, [rsp + 0x30]
xor bl, bl
lea r8, [0x1100cf738]
lea rdx, [0x1100d3aa8]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x30]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
mov r9, rbp
lea rcx, [0x1100d3ac0]
cmove edx, esi
xor r8d, r8d
mov byte [rdi], dl
lea rdx, [0x1100d3ac8]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rbp
lea rdx, [0x1100d3ae8]
lea rcx, [0x1100d3ac0]
mov dword [rdi + 4], eax
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi + 8], eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x110038c10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x468
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
call fcn.1100a8da0
lea rcx, [rsp + 0x30]
call fcn.1100a8cc0
mov r10, rax
mov dword [rsp + 0x38], 0x6f3e392d
xor eax, eax
mov dword [rsp + 0x3c], 0x6b3c3d29
mov byte [rsp + 0x44], al
mov dword [rsp + 0x40], 0x77202135
nop
movsxd rcx, eax
lea rdx, [rsp + 0x38]
add rdx, rcx
lea ecx, [rax + 8]
inc eax
xor byte [rdx], cl
cmp eax, 0xc
jb 0x110038c60
mov r9d, dword [r10 + 0x10]
lea rdx, [rsp + 0x38]
mov r8d, dword [r10 + 0x14]
lea rcx, [rsp + 0x50]
mov eax, dword [r10 + 0xc]
inc r9d
add r8d, 0x76c
mov byte [rsp + 0x44], 0
mov dword [rsp + 0x20], eax
call fcn.110001a70
lea rcx, [rsp + 0x50]
call fcn.1100b22b0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x468
ret
Function at 0x110038cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x4e0
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdx
mov rbx, rdx
call fcn.1100a8da0
lea rcx, [rsp + 0x30]
call fcn.1100a8cc0
lea rcx, [rsp + 0x50]
mov rdi, rax
call fcn.1100b2e14
movdqa xmm0, xmmword [0x1100d3c10]
xor eax, eax
movdqu xmmword [rsp + 0x38], xmm0
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x38]
add rdx, rcx
lea ecx, [rax + 8]
inc eax
xor byte [rdx], cl
cmp eax, 0xf
jb 0x110038d30
mov eax, dword [rdi + 0x14]
lea rcx, [rsp + 0x50]
mov r9d, dword [rdi + 0x10]
lea rdx, [rsp + 0x38]
mov r8d, dword [rdi + 0xc]
add eax, 0x76c
mov qword [rsp + 0x28], rcx
inc r9d
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0x20], eax
mov byte [rsp + 0x47], 0
call fcn.110001a70
mov qword [rbx + 0x10], 0
lea rax, [rsp + 0xd0]
mov qword [rbx + 0x18], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbx], 0
inc r8
cmp byte [rax + r8], 0
jne 0x110038da1
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call fcn.1100160a0
mov rax, rbx
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.11009af60
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4e0
pop rdi
ret

Function at 0x11003a600
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov byte [rcx], 0
lea rax, [rcx + 1]
mov edx, 0x27
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
lea rax, [rax + 0x40]
mov qword [rax - 0x28], 0xffffffffffffffff
mov qword [rax - 0x20], 0xffffffffffffffff
mov qword [rax - 0x18], 0xffffffffffffffff
mov qword [rax - 0x10], 0xffffffffffffffff
mov qword [rax - 8], 0xffffffffffffffff
sub rdx, 1
jne 0x11003a630
mov qword [rax], 0xffffffffffffffff
lea r9, [rsp + 0x30]
mov qword [rax + 8], 0xffffffffffffffff
lea r8, [0x1100cf738]
mov qword [rax + 0x10], 0xffffffffffffffff
lea rdx, [0x1100d14c0]
mov qword [rax + 0x18], 0xffffffffffffffff
lea rcx, [0x1100d3c50]
mov dword [rax + 0x20], 0xffffffff
xor bl, bl
lea rax, [0x1100d2ac8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x30]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx ecx, bl
cmove ecx, esi
mov byte [rdi], cl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x11003deb0
Capabilities:
Delete file
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
mov esi, r8d
movzx edi, r9b
mov r8, rdx
mov rbx, rcx
test al, al
je 0x11003deee
mov r10, rdx
cmp al, 0x2f
je 0x11003dede
cmp al, 0x3a
jne 0x11003dee2
mov byte [r10], 0x5f
movzx eax, byte [r10 + 1]
inc r10
test al, al
jne 0x11003ded6
xor eax, eax
mov byte [rcx], 0
mov byte [rsp + 0x4a], al
xor edx, edx
mov word [rsp + 0x48], 0xa6f1
movsxd rax, edx
lea rcx, [rsp + 0x48]
add rcx, rax
lea eax, [rdx - 0x2c]
inc edx
xor byte [rcx], al
cmp edx, 2
jb 0x11003df00
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x4a], 0
mov rcx, rbx
call qword [sym.imp.user32.dll_wsprintfA]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_DeleteFileA]
movzx eax, byte [rsp + 0x50]
mov dword [rbx + 0x84], esi
mov rsi, qword [rsp + 0x38]
mov byte [rbx + 0x88], al
mov dword [rbx + 0x80], 0
mov byte [rbx + 0x90], 1
mov byte [rbx + 0x89], dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x11003f9c0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
lea rbp, [0x1100cfcd0]
mov qword [rsp + 0x28], rbp
lea r9, [rsp + 0x30]
lea r8, [0x1100cf738]
mov dword [rsp + 0x20], 0x40
lea rdx, [0x1100d4688]
xor bl, bl
lea rcx, [0x1100d4698]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x30]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
mov r9, rbp
lea rcx, [0x1100d4698]
cmove edx, esi
xor r8d, r8d
mov byte [rdi], dl
lea rdx, [0x1100d46a8]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100cf738]
mov dword [rdi + 0xc], eax
lea rdx, [0x1100d14c0]
mov dword [rsp + 0x20], 0x40
lea rcx, [0x1100d46b8]
xor bl, bl
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea r8d, [rsi + 3]
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov r8d, esi
lea rcx, [rsp + 0x30]
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
mov r9, rbp
lea rcx, [0x1100d46b8]
cmove edx, esi
xor r8d, r8d
mov byte [rdi + 0x10], dl
lea rdx, [0x1100d46c8]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi + 0x14], eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret