joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14061b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14061b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14061b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061b06f
add dl, dl
jne 0x14061b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061b0f6
xor eax, eax
add dl, dl
jne 0x14061b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061b1ad
add dl, dl
jne 0x14061b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14061b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14061b07e
mov eax, 1
add dl, dl
jne 0x14061b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061b0fb
sub eax, ebx
mov ebx, 1
jne 0x14061b14c
mov ecx, 1
add dl, dl
jne 0x14061b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14061b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061b15d
cmp eax, 0x7d00
jae 0x14061b19b
cmp eax, 0x500
jb 0x14061b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061b07e
cmp eax, 0x7f
ja 0x14061b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14061b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14061b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1813ba058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1813ba1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1813ba089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1813ba06f
add dl, dl
jne 0x1813ba096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1813ba0f6
xor eax, eax
add dl, dl
jne 0x1813ba0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1813ba1ad
add dl, dl
jne 0x1813ba0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1813ba0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1813ba0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1813ba0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1813ba0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1813ba07e
mov eax, 1
add dl, dl
jne 0x1813ba106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1813ba113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1813ba0fb
sub eax, ebx
mov ebx, 1
jne 0x1813ba14c
mov ecx, 1
add dl, dl
jne 0x1813ba12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1813ba13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1813ba123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1813ba07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1813ba168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1813ba175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1813ba15d
cmp eax, 0x7d00
jae 0x1813ba19b
cmp eax, 0x500
jb 0x1813ba196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1813ba07e
cmp eax, 0x7f
ja 0x1813ba19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1813ba07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1813ba1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1813ba07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140d97058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140d971df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d97089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d9706f
add dl, dl
jne 0x140d97096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d970f6
xor eax, eax
add dl, dl
jne 0x140d970a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d971ad
add dl, dl
jne 0x140d970b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d970c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d970d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d970dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d970ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d9707e
mov eax, 1
add dl, dl
jne 0x140d97106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d97113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d970fb
sub eax, ebx
mov ebx, 1
jne 0x140d9714c
mov ecx, 1
add dl, dl
jne 0x140d9712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d9713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d97123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d9707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d97168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d97175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d9715d
cmp eax, 0x7d00
jae 0x140d9719b
cmp eax, 0x500
jb 0x140d97196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d9707e
cmp eax, 0x7f
ja 0x140d9719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d9707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d971d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d9707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400063d0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400416b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
mov ebx, r12d
test rdx, rdx
je 0x140006557
cmp word [rdx], r12w
je 0x140006557
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140006445
mov r8, rdi
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1400150d4
lea rcx, [rsp + 0x30]
call fcn.14000bec0
mov rbx, r12
mov rax, qword [rsi + 0x88]
sub rax, qword [rsi + 0x80]
sar rax, 3
test rax, rax
je 0x1400064a0
mov rax, qword [rsi + 0x80]
mov rcx, qword [rax + rbx*8]
add rcx, 8
lea rdx, [rsp + 0x30]
call fcn.140003898
test eax, eax
je 0x1400064a0
inc rbx
mov rax, qword [rsi + 0x88]
sub rax, qword [rsi + 0x80]
sar rax, 3
cmp rbx, rax
jb 0x140006469
mov rax, qword [rsi + 0x88]
sub rax, qword [rsi + 0x80]
sar rax, 3
cmp rbx, rax
je 0x1400064c4
mov rax, qword [rsi + 0x80]
mov rbx, qword [rax + rbx*8]
jmp 0x1400064c7
mov rbx, r12
test rbx, rbx
jne 0x140006557
lea ecx, [rbx + 0x60]
call fcn.140014af4
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140006534
mov byte [rax], 1
mov qword [rax + 0x20], 7
mov qword [rax + 0x18], r12
mov word [rax + 8], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 8]
call fcn.14000444c
nop
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0x50], 7
mov qword [rbx + 0x48], r12
mov word [rbx + 0x38], r12w
jmp 0x140006537
mov rbx, r12
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140006557
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x80]
call fcn.14000524c
mov rbx, qword [rsp + 0x20]
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140014700
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r12
pop rdi
pop rsi
ret
Function at 0x140007bfc
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400416b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r13, rdx
mov r12, rcx
xor r14d, r14d
mov esi, r14d
cmp dword [rcx + 0x380], r14d
jle 0x140007d8c
cmp rdx, 0xffffffffffffffff
je 0x140007d8c
lea r15d, [r14 + 7]
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r14
mov word [rbp - 0x30], r14w
lea r8d, [r14 + 0x1a]
lea rdx, str.____Queued_Lines_End_____r_n
lea rcx, [rbp - 0x30]
call fcn.14000444c
nop
lea rdx, [rbp - 0x30]
lea rcx, [r12 + 0x360]
call fcn.14000a098
nop
cmp qword [rbp - 0x18], 8
jb 0x140007c96
mov rcx, qword [rbp - 0x30]
call fcn.140014720
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r14
mov word [rbp - 0x30], r14w
jmp 0x140007d7e
lea rdx, [rbp - 0x30]
lea rcx, [r12 + 0x360]
call fcn.14000a5e4
mov rcx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140007cc9
mov rax, r14
jmp 0x140007ccc
mov rax, qword [rax]
mov rcx, qword [rcx + 0x10]
cmp qword [rax + 0x10], rcx
ja 0x140007cda
sub rcx, qword [rax + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140007cf0
mov rdx, qword [rdx]
lea r8d, [rax + rax]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140007d0d
add esi, dword [rbp - 0x40]
cmp qword [r12 + 0x380], r14
je 0x140007d8c
mov rcx, qword [r12 + 0x378]
mov rax, qword [r12 + 0x368]
mov rdi, qword [rax + rcx*8]
cmp qword [rdi + 0x18], 8
jb 0x140007d3a
mov rcx, qword [rdi]
call fcn.140014720
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
inc qword [r12 + 0x378]
mov rax, qword [r12 + 0x378]
cmp rax, qword [r12 + 0x370]
sbb rcx, rcx
and rcx, rax
mov qword [r12 + 0x378], rcx
dec qword [r12 + 0x380]
jne 0x140007d7e
mov qword [r12 + 0x378], r14
cmp qword [r12 + 0x380], r14
ja 0x140007ca8
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140014700
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400089f0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400416b0]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rbp + 0x58]
mov qword [rbp - 0x28], 7
xor r13d, r13d
mov qword [rbp - 0x30], r13
mov word [rbp - 0x40], r13w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov edx, dword [rdx + 0x10]
call fcn.1400084b8
bt ebx, 0x1b
jb 0x140008a57
test dword [rdi + 0x10], 0x80000
je 0x140008ab7
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
je 0x140008a86
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140008a86
add rcx, 0x38
jmp 0x140008a91
mov rcx, qword [rsi + 0x108]
add rcx, 0x30
cmp qword [rcx + 0x18], 8
jb 0x140008a9b
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x140036940]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140008ad0
add rcx, 8
cmp qword [rcx + 0x18], 8
jb 0x140008ad7
mov rcx, qword [rcx]
jmp 0x140008ad7
lea rcx, [0x1400362a8]
call fcn.140015094
test rax, rax
je 0x140008afd
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
mov r9, r12
mov rdx, rdi
mov rcx, rsi
call fcn.140007db4
test dword [rdi + 0x10], 0x10000000
je 0x140008b14
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
cmp qword [rbp - 0x28], 8
jb 0x140008b24
mov rcx, qword [rbp - 0x40]
call fcn.140014720
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r13
mov word [rbp - 0x40], r13w
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140014700
add rsp, 0x78
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140008b50
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x820
mov rbp, rcx
mov r8d, edx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov rsi, rax
test rax, rax
je 0x140008be9
lea r9, [rsp + 0x840]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x140008be0
test dword [rsp + 0x840], 0xfffffff8
jbe 0x140008be0
lea rbx, [rsp + 0x20]
mov rcx, qword [rbx]
lea rdx, [rbp + 0x138]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rsp + 0x840]
inc edi
shr eax, 3
add rbx, 8
cmp edi, eax
jb 0x140008bb6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000b298
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400416b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov qword [rbp - 0x51], rcx
mov r12d, 7
mov qword [rbp - 1], r12
xor esi, esi
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
cmp qword [rcx + 0x10], rsi
jne 0x14000b37f
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x31], rsi
mov word [rbp - 0x41], si
lea rdx, [rbp - 0x19]
lea rcx, str.RegValues
call fcn.14000c124
lea r8, str.Lock
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0xf]
call fcn.14000bd14
nop
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.140003918
nop
cmp qword [rbp + 0x27], 8
jb 0x14000b33b
mov rcx, qword [rbp + 0xf]
call fcn.140014720
mov qword [rbp + 0x27], r12
mov qword [rbp + 0x1f], rsi
mov word [rbp + 0xf], si
lea r8, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae r8, qword [rbp - 0x41]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0x10], rax
cmp qword [rbp - 0x29], 8
jb 0x14000b373
mov rcx, qword [rbp - 0x41]
call fcn.140014720
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x31], rsi
mov word [rbp - 0x41], si
mov edx, 0x32
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000b458
lea r8, str.MappedFile
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x41]
call fcn.14000bd14
nop
lea rax, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rax, qword [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x108
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 8], rax
test rax, rax
je 0x14000b431
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, esi
cmp eax, 0xb7
setne dil
mov qword [rsp + 0x20], 0x108
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14000b431
test edi, edi
je 0x14000b42b
mov qword [rbp - 0x59], rax
mov rcx, rax
call fcn.140005fa4
nop
mov rax, qword [rbx + 0x18]
inc dword [rax]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
cmp qword [rbp - 0x29], 8
jb 0x14000b44c
mov rcx, qword [rbp - 0x41]
call fcn.140014720
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x31], rsi
mov word [rbp - 0x41], si
mov rbx, qword [rbx + 0x18]
cmp qword [rbp - 1], 8
jb 0x14000b46c
mov rcx, qword [rbp - 0x19]
call fcn.140014720
mov qword [rbp - 1], r12
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140014700
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x14000bf10
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14000bf60
mov r11, rsp
push rbx
sub rsp, 0x40
mov rbx, r8
test rbx, rbx
je 0x14000bf5b
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000bf5b
cmp dword [rsp + 0x68], 4
jne 0x14000bf5b
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
add rsp, 0x40
pop rbx
ret

Function at 0x14000bf64
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
and dword [rsp + 0x78], 0
lea rax, [r11 + 0x20]
mov rbp, r8
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
lea r9, [r11 - 0x28]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c021
cmp dword [rsp + 0x30], 1
jne 0x14000c021
mov ecx, dword [rsp + 0x78]
mov eax, 2
mov r12, 0xffffffffffffffff
shr ecx, 1
inc ecx
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140012824
mov rbx, rax
test rax, rax
je 0x14000c021
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c019
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.14000444c
mov rcx, rbx
call fcn.140015180
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14000e2b0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov ebp, r8d
mov r12d, edx
mov rbx, rcx
xor r13d, r13d
mov dword [rax - 0x38], r13d
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r13
mov word [rcx], r13w
xor r8d, r8d
lea rdx, [0x1400362a8]
call fcn.14000444c
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rdi, eax
test eax, eax
je 0x14000e377
lea eax, [r13 + 2]
mul rdi
lea r14, [r13 - 1]
cmovo rax, r14
mov rcx, rax
call fcn.140012824
mov rsi, rax
mov r9d, edi
mov r8, rax
mov edx, ebp
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14000e36f
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
mov rcx, rbx
call fcn.14000444c
mov rcx, rsi
call fcn.140015180
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140010494
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor esi, esi
mov r15, r9
mov rbp, r8
mov r12, rdx
mov r14, rcx
mov edi, esi
mov ebx, esi
or r13, 0xffffffffffffffff
add edi, 0x200
test rbx, rbx
je 0x1400104d9
mov rcx, rbx
call fcn.140015180
mov ecx, edi
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.140012824
mov rbx, rax
test rax, rax
je 0x140010581
mov word [rax], si
lea rax, [r14 + 8]
cmp qword [rax + 0x18], 8
jb 0x14001050c
mov rax, qword [rax]
cmp qword [rbp + 0x18], 8
jb 0x140010519
mov rdx, qword [rbp]
jmp 0x14001051c
mov rdx, rbp
cmp qword [r12 + 0x18], 8
jb 0x14001052a
mov rcx, qword [r12]
jmp 0x14001052d
mov rcx, r12
mov qword [rsp + 0x28], rax
lea r8, [0x1400362a8]
mov r9, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r13d, eax
lea eax, [rdi - 1]
cmp r13d, eax
jae 0x1400104c2
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx - 1]
mov rcx, r15
call fcn.14000444c
mov rcx, rbx
call fcn.140015180
test r13d, r13d
setne al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400105a0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400416b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x48], r9
mov r14, r8
mov r13, rdx
mov r15, rcx
xor ebx, ebx
mov r12d, ebx
mov edi, ebx
add r12d, 0x200
test rdi, rdi
je 0x1400105f2
mov rcx, rdi
call fcn.140015180
mov ecx, r12d
call fcn.140012824
mov rdi, rax
test rax, rax
je 0x1400106de
mov byte [rax], bl
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], rbx
mov byte [rbp - 0x38], bl
lea rdx, [r15 + 8]
cmp qword [rdx + 0x18], 8
jb 0x140010627
mov rcx, qword [rdx]
jmp 0x14001062a
mov rcx, rdx
mov rax, qword [rdx + 0x10]
lea r8, [rcx + rax*2]
cmp qword [rdx + 0x18], 8
jb 0x14001063c
mov rdx, qword [rdx]
lea rcx, [rbp - 0x38]
call fcn.140010d1c
lea r11, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r11, qword [rbp - 0x38]
cmp qword [r14 + 0x18], 0x10
jb 0x14001065f
mov rdx, qword [r14]
jmp 0x140010662
mov rdx, r14
cmp qword [r13 + 0x18], 0x10
jb 0x14001066f
mov rcx, qword [r13]
jmp 0x140010672
mov rcx, r13
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140036d64]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
cmp qword [rbp - 0x20], 0x10
jb 0x14001069e
mov rcx, qword [rbp - 0x38]
call fcn.140014720
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], rbx
mov byte [rbp - 0x38], bl
lea eax, [r12 - 1]
cmp esi, eax
jae 0x1400105de
mov rcx, rdi
call fcn.1400151a0
mov r8, rax
mov rdx, rdi
mov rcx, qword [rbp - 0x48]
call fcn.14000a4ec
mov rcx, rdi
call fcn.140015180
test esi, esi
setne al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140014700
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400110c4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rax - 0x28], r12d
cmp qword [rdx + 0x18], 8
jb 0x140011102
mov rcx, qword [rdx]
jmp 0x140011105
mov rcx, rdx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
mov eax, 2
add ebp, eax
movsxd rcx, ebp
mul rcx
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.140012824
mov rsi, rax
cmp qword [rdi + 0x18], 8
jb 0x14001113f
mov rdi, qword [rdi]
mov r8d, ebp
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
xor eax, eax
mov rcx, r13
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
mov rcx, rbx
call fcn.14000444c
mov dword [rsp + 0x20], 1
mov rcx, rsi
call fcn.140015180
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret