joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fb80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400aa200]
mov rsi, rcx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x14000fbcb
mov r8d, 0x67f
lea rdx, [0x14004fcb0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x140052ef0]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x14000fcaa
lea ecx, [rdx + 1]
test r8d, r8d
je 0x14000fc96
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14000fc9b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400181b0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140010c60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1400aa200]
mov edi, edx
cmp byte [rbx + 0x1e25], 0
jne 0x140010cb1
cmp byte [rbx + 0x1e26], 0
jne 0x140010cb1
mov r9d, dword [rbx + 0x2ec8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002910
test dil, 1
je 0x140010dd6
jmp 0x140010d39
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14008acc0]
xor eax, eax
mulss xmm1, dword [0x14008acb0]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1ba0], rax
mov dword [rbx + 0x1b8c], 1
movss dword [rbx + 0x1b98], xmm0
movss dword [rbx + 0x1b9c], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x14008ac38]
or dword [rbx + 0x1b88], 0x41
movss dword [rbx + 0x1be8], xmm0
mov r9d, dword [rbx + 0x2ec8]
call fcn.140002910
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140010d90
lea r11, [0x140052ef0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140010d73
cmp byte [r8], r9b
jne 0x140010d73
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140010d60
not ecx
call fcn.140009e90
test rax, rax
je 0x140010dd6
cmp byte [rax + 0x8e], 0
je 0x140010dd6
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ec8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ec8]
call fcn.140002910
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c5e0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140015d20
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x1400aa200]
cmp byte [rbx + 0x2f5c], 0
je 0x140015e0c
cmp qword [rbx + 0x2f68], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2f70]
je 0x140015df4
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x140015d9b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140017f30
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.1400030c0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x2f68]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f78]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400aa1f8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.1400030c0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x1400361f0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov edx, ecx
xor edi, edi
lea ecx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003625f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14003625f
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003625a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140036230
jmp 0x14003625f
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x470]
mov rax, rdi
add rsp, 0x460
pop rdi
ret
Function at 0x14004b6d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004b71e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004b71e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004b71e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004b71e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004b71e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004b720
xor al, al
add rsp, 0x28
ret
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140013d80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112fd
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400150d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400150f0
xor al, al
jmp 0x140015171
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015103
xor al, al
jmp 0x140015171
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001512d
xor al, al
jmp 0x140015171
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015141
xor al, al
jmp 0x140015171
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015153
xor al, al
jmp 0x140015171
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001516f
xor al, al
jmp 0x140015171
mov al, 1
add rsp, 0x38
ret
Function at 0xf2471c
Capabilities:
Get graphical window text

Disassembly:
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
and qword [rbp + 0x30], 0
and qword [rbp + 0x38], 0
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x20], 0
call fcn.00f2c8c0
mov r11, qword [0x00f431f8]
test r11, r11
je 0xf24874
mov eax, dword [0x00f43204]
test eax, eax
je 0xf24874
mov rcx, qword [0x00f431f0]
mov byte [rax + r11], 0
test rcx, rcx
je 0xf2478b
lea rdx, [rsp + 0x20]
mov r8d, 0x100
call qword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.00f2f120
mov qword [rbp + 0x30], rax
test rax, rax
je 0xf24866
mov rdx, qword [0x00f48048]
mov rcx, rax
call fcn.00f2f1a0
mov rdx, qword [0x00f47c60]
mov rcx, qword [rbp + 0x30]
call fcn.00f2f250
mov rdx, qword [0x00f47280]
mov rcx, qword [rbp + 0x30]
call fcn.00f2f250
mov rdx, qword [0x00f47f58]
mov rcx, qword [rbp + 0x30]
call fcn.00f2f250
mov rcx, qword [rbp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.00f2f250
mov rdx, qword [0x00f483e8]
mov rcx, qword [rbp + 0x30]
call fcn.00f2f250
call fcn.00f24618
mov rcx, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
test rax, rax
je 0xf2482c
mov rdx, rax
call fcn.00f2f250
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rbp + 0x38]
movsxd rdx, eax
call fcn.00f2ca40
jmp 0xf2484d
mov rdx, qword [0x00f431f8]
call fcn.00f2f250
mov r8d, dword [0x00f43204]
mov rcx, qword [0x00f431f8]
xor edx, edx
call fcn.00f2c8c0
mov rcx, qword [rbp + 0x30]
lea rdx, [0x00f35754]
call fcn.00f2f250
lea rcx, [rbp + 0x30]
call fcn.00f2f630
and dword [0x00f43200], 0
and dword [0x00f43204], 0
add rsp, 0x120
pop rbp
ret

Function at 0xf24984
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
movzx ebx, word [rcx + 0x18]
mov rdi, rcx
lea rcx, [0x00f431e8]
call fcn.00f2e440
mov rcx, qword [0x00f47ab0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [0x00f47db8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rcx, qword [rdi + 0x10]
mov qword [0x00f431f0], rax
cmp rcx, 0xd
jne 0xf249e3
call fcn.00f2471c
jmp 0xf24a87
xor esi, esi
mov edx, ebx
mov word [rsp + 0x158], si
call fcn.00f24880
test eax, eax
jne 0xf24a87
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r11d, dword [rdi + 0x18]
mov ecx, dword [rdi + 0x10]
sar r11, 0x10
lea r9, [rsp + 0x158]
lea r8, [rsp + 0x40]
movzx edx, r11b
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_ToAscii]
mov r11b, byte [rsp + 0x158]
mov byte [rsp + 0x3f], sil
mov byte [rsp + 0x150], r11b
mov ecx, esi
lea rdx, [rsp + 0x30]
lea eax, [rcx + 0x41]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, 0xf
jb 0xf24a49
lea rcx, [rsp + 0x30]
call fcn.00f2cec4
cmp byte [rsp + 0x150], sil
je 0xf24a87
test ebx, ebx
je 0xf24a87
lea rcx, [rsp + 0x150]
mov edx, 1
call fcn.00f244f8
dec rbx
jne 0xf24a70
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0xf24f64
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rax - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
cmp rsi, 0x40000000
jbe 0xf24fab
lea rax, [rsi - 0x40000000]
cmp rdi, rax
cmovb rdi, rax
mov rbx, qword [0x00f475e0]
lea rax, [rsi + 0x40000000]
cmp rbp, rax
cmova rbp, rax
sub rbp, 0xfff
test rbx, rbx
je 0xf24fe6
cmp rbx, rdi
jb 0xf24fe1
cmp rbx, rbp
jae 0xf24fe1
cmp qword [rbx + 8], 0
jne 0xf250b3
mov rbx, qword [rbx]
jmp 0xf24fc7
mov r12, rsi
cmp rsi, rdi
jb 0xf2502d
mov r8d, dword [rsp + 0x48]
mov rdx, rdi
mov rcx, r12
call fcn.00f24e64
mov r12, rax
test rax, rax
je 0xf2502d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0xf25073
cmp r12, rdi
jae 0xf24fee
test rbx, rbx
jmp 0xf2506a
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, rsi
call fcn.00f24ed8
mov rsi, rax
test rax, rax
je 0xf250b3
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0xf25073
cmp rsi, rbp
jbe 0xf25032
jmp 0xf250b3
and qword [rbx + 8], 0
and dword [rbx + 0x10], 0
lea rcx, [rbx + 0x40]
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0xf25086
mov rax, qword [0x00f475e0]
mov qword [rbx], rax
mov qword [0x00f475e0], rbx
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop r12
ret
Function at 0xf25a40
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 4]
call qword [0x00f47878]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0xf25b35
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
jmp 0xf25b24
cmp dword [rsp + 0x20], 0x10
jb 0xf25b0f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0xf25b0f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0xf25b0f
mov r8, qword [rbx]
test r8, r8
jne 0xf25ad0
mov dword [rbx + 8], 0x80
mov rcx, qword [0x00f43230]
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0xf25b2c
jmp 0xf25aff
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0xf25aff
mov rcx, qword [0x00f43230]
lea r9d, [rax + rax]
xor edx, edx
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0xf25b2c
mov ecx, dword [rbx + 8]
mov qword [rbx], rax
add ecx, ecx
mov dword [rbx + 8], ecx
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rcx + rdx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0xf25a7f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0xf25b40
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
and qword [rcx], 0
and dword [rcx + 8], 0
and dword [rcx + 0xc], 0
mov r12d, r8d
mov r13d, edx
mov rbx, rcx
call fcn.00f25a40
cmp qword [rbx], 0
je 0xf25bc6
xor edi, edi
cmp dword [rbx + 0xc], edi
jbe 0xf25bc6
xor esi, esi
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rsi]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0xf25bbb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, r12d
mov edx, r13d
mov rcx, rbp
call fcn.00f25940
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, dword [rbx + 0xc]
jb 0xf25b81
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0xf25be0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0xf25c4f
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0xf25c3d
xor esi, esi
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rsi + rax]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0xf25c32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, dword [rbx + 0xc]
jb 0xf25c06
mov r8, qword [rbx]
mov rcx, qword [0x00f43230]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0xf264f8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
lea rbp, [rax - 0x818]
sub rsp, 0x910
mov rsi, rdx
mov r12, rcx
lea rcx, [rbp - 0x58]
lea rdx, str.MozillaFirefox
mov r8d, 0x20
call fcn.00f2cce0
xor r9d, r9d
lea r11, [rbp - 0x30]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0xf266f2
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.00f2fbd8
test eax, eax
je 0xf266f2
mov rax, qword [str.profiles.ini]
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x58], rax
mov rax, qword [0x00f35880]
lea rcx, [rbp + 0x1e0]
mov qword [rsp + 0x60], rax
mov rax, qword [0x00f35888]
mov qword [rsp + 0x68], rax
movzx eax, word [0x00f35890]
mov word [rsp + 0x70], ax
call fcn.00f2fbd8
test eax, eax
je 0xf266f2
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0xf266f2
mov rax, qword [str.IsRelative]
xor bl, bl
mov qword [rsp + 0x40], rax
mov rax, qword [0x00f35868]
mov qword [rsp + 0x48], rax
mov eax, dword [0x00f35870]
mov dword [rsp + 0x50], eax
movzx eax, word [0x00f35874]
mov word [rsp + 0x54], ax
mov rax, qword [str.Path]
mov qword [rsp + 0x30], rax
movzx eax, word [0x00f35858]
mov word [rsp + 0x38], ax
lea r8, str.Profile_u
lea rcx, [rsp + 0x78]
movzx r9d, bl
mov edx, 0xf
call fcn.00f2e29c
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x78]
mov r8d, 0x20
call fcn.00f2d238
lea r9, [rbp + 0x1e0]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
or r8d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
cmp eax, 0xffffffff
je 0xf266f2
lea rax, [rbp + 0x1e0]
lea r9, [rbp + 0x3f0]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x78]
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0xf266e7
lea rcx, [rbp + 0x3f0]
call fcn.00f2fc10
cmp edi, 1
jne 0xf266d6
lea r8, [rbp + 0x3f0]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x600]
call fcn.00f2fbd8
test eax, eax
je 0xf266e7
lea rcx, [rbp + 0x600]
jmp 0xf266dd
lea rcx, [rbp + 0x3f0]
mov rdx, rsi
call r12
test eax, eax
je 0xf266f2
inc bl
cmp bl, 0xfa
jb 0xf2661d
lea r11, [rsp + 0x910]
mov dword [0x00f43250], 1
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0xf27a54
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
mov r8d, dword [0x00f47174]
mov rdx, qword [0x00f47280]
lea rcx, [rsp + 0x48]
call fcn.00f3040c
lea rcx, [rsp + 0x30]
call fcn.00f30228
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x48]
test eax, eax
jns 0xf27a8c
xor ecx, ecx
jmp 0xf27a91
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x00f43278], rax
test rax, rax
jne 0xf27aa7
xor eax, eax
jmp 0xf27b15
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0xf27adf
mov rcx, qword [0x00f43278]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0xf27ad4
mov rcx, qword [0x00f43278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xf27aa3
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [0x00f4325c]
lea r8, [0x00f279e8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x00f43260], rax
test rax, rax
je 0xf27ac5
mov eax, 1
add rsp, 0x78
ret

Function at 0xf27b40
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, 1
mov rbx, r8
mov rdi, rcx
mov qword [0x00f43280], rcx
cmp edx, esi
jne 0xf27c89
cmp dword [r8 + 0x1f7], 0xe291a0f3
je 0xf27b7d
xor eax, eax
jmp 0xf27cf1
call fcn.00f2c9f0
mov ecx, esi
call fcn.00f2dc54
test eax, eax
js 0xf27b76
mov r9d, esi
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.00f30960
lea rcx, [rbx + 0x1cf]
call fcn.00f27b20
test eax, eax
je 0xf27b76
mov rdx, qword [0x00f48568]
mov rcx, qword [0x00f47280]
call fcn.00f2d0ac
test rax, rax
jne 0xf27b76
call fcn.00f27a54
test eax, eax
je 0xf27b76
call fcn.00f2d4e0
call fcn.00f2ef60
mov rcx, qword [0x00f48278]
lea r9, [0x00f43258]
xor r8d, r8d
mov dl, 0x3b
call fcn.00f2d314
lea rdx, [0x00f4325c]
lea rcx, [0x00f43278]
mov r8d, esi
mov qword [0x00f43268], rax
call fcn.00f30458
call fcn.00f2269c
mov rcx, qword [0x00f47280]
call fcn.00f27b1c
test eax, eax
je 0xf27c2a
call fcn.00f2287c
jmp 0xf27c80
call fcn.00f244a8
call fcn.00f237e8
call fcn.00f2bcb8
call fcn.00f21000
call fcn.00f28520
call fcn.00f22218
call fcn.00f2bdcc
call fcn.00f22e38
call fcn.00f28144
call fcn.00f2287c
call fcn.00f22854
call fcn.00f22868
call fcn.00f22b8c
xor ecx, ecx
call fcn.00f228a4
call fcn.00f27d04
test eax, eax
je 0xf27c80
call fcn.00f22890
xor ecx, ecx
call fcn.00f22704
jmp 0xf27cef
test edx, edx
jne 0xf27cef
call fcn.00f2270c
call fcn.00f290f4
call fcn.00f244d4
mov ecx, esi
call fcn.00f2dbc0
call fcn.00f2160c
call fcn.00f22250
call fcn.00f2eca4
call fcn.00f22ea0
lea rdx, [0x00f43258]
lea rcx, [0x00f43268]
call fcn.00f2d44c
cmp dword [0x00f41cc4], 0
je 0xf27ce2
mov rcx, qword [0x00f43260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x00f43270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0xf27f9c
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x00f432c8], 0
mov esi, r8d
mov edi, edx
mov rbx, rcx
jne 0xf27fc0
xor eax, eax
jmp 0xf27ff2
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, edi
je 0xf27fbc
test esi, esi
jne 0xf27fd7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, edi
mov rcx, rbx
call fcn.00f27ebc
mov edi, eax
test esi, esi
jne 0xf27ff0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0xf28004
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov r13d, ecx
cmp dword [0x00f432c8], ebx
mov edi, ebx
jne 0xf28039
xor eax, eax
jmp 0xf28125
mov r14d, dword [0x00f47174]
xor edx, edx
lea ecx, [rdx + 4]
call qword [0x00f47878]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0xf28075
mov byte [rbp - 0x21], bl
lea rcx, [rbp - 0x30]
lea eax, [rbx + 0x41]
inc ebx
mov byte [rcx], al
inc rcx
cmp ebx, 0xf
jb 0xf2805b
lea rcx, [rbp - 0x30]
call fcn.00f2cec4
jmp 0xf28032
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0xf2811a
cmp dword [rbp - 0x14], r14d
jne 0xf28104
mov r8d, dword [rbp - 0x18]
xor edx, edx
lea ecx, [rdx + 0x4a]
call qword [0x00f47770]
mov r12, rax
test rax, rax
je 0xf28104
mov edx, dword [rbp - 0x18]
xor r8d, r8d
mov rcx, rax
call fcn.00f27f9c
test eax, eax
je 0xf280fb
mov rcx, r12
test r13d, r13d
je 0xf280f0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [rbp - 0x21], bl
mov ecx, ebx
lea rdx, [rbp - 0x30]
lea eax, [rcx + 0x41]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, 0xf
jb 0xf280d6
lea rcx, [rbp - 0x30]
call fcn.00f2cec4
jmp 0xf280f6
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, 1
mov rcx, r12
call qword [0x00f477c0]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0xf28090
mov ebx, edi
mov rcx, rsi
call qword [0x00f477c0]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret

Function at 0xf2846c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [0x00f48508]
mov rcx, qword [0x00f43280]
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0xf2849c
xor eax, eax
jmp 0xf284d6
mov rcx, qword [0x00f43280]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x00f43280]
mov rdx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0xf28498
mov r9d, 4
xor r8d, r8d
mov edx, edi
mov rcx, rax
call fcn.00f31500
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret