joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d7122
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cdq
cmova r8w, r9w
mov ebx, ecx
movzx r9, r13w
xchg cl, dh
movzx cx, bpl
lea r9, [0x1400c8ea0]
mov ecx, 2
not r8w
lea r8, [0x1400c8e98]
lea rdx, [0x1400cf758]
jmp 0x1404d715e
call fcn.1404d72d6
mov ecx, ebx
stc
cmc
test rax, rax
jmp 0x1404d716f
je 0x1404d7184
add rsp, 0x20
mov bh, 0x24
pop rbx
jmp qword [case.0x1404c1b3d.0]
add rsp, 0x20
mov bh, bl
pop rbx
jmp 0x1404d7190
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404d7197
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
not r9b
cmp spl, bpl
push rdi
sub rsp, 0x20
mov rbx, rdx
movzx r8w, r13b
lea r9, [0x1400c8ea8]
xchg r8w, r8w
mov edi, ecx
lea rdx, [0x1400cf748]
movzx r8, dx
mov ecx, 3
movzx r8d, r12w
lea r8, [0x1400c8ea0]
call fcn.1404d72d6
mov rdx, rbx
bswap rcx
mov ecx, edi
clc
test rax, rax
jmp 0x1404d71ed
je 0x1404d71fe
call qword [case.0x1404c1b3d.0]
jmp 0x1404d7204
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
sar dil, 0xbf
movzx edi, dx
mov dil, 0x96
add rsp, 0x20
movsx di, r9b
cmovne edi, edx
pop rdi
jmp 0x1404d7225
ret
Function at 0x1404d7bd1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d7be5
mov qword [rsp + 0x10], rbp
test r13b, 0x34
cmc
mov qword [rsp + 0x18], rsi
sbb si, 0x6f21
push rdi
rcl dil, cl
sbb rsi, rsp
sub rsp, 0x30
movsxd rdi, r8d
test r10w, si
shl sil, 0x70
sal esi, cl
mov r8d, ecx
movzx si, cl
sbb sil, 0xc5
mov rsi, rdx
test ecx, 0xfffff3ff
jne 0x1404d7c37
cmp ecx, 0xc00
jne 0x1404d7d77
test rsi, rsi
jmp 0x1404d7c3f
jne 0x1404d7c4d
test edi, edi
jg 0x1404d7d77
test edi, edi
jmp 0x1404d7c54
js 0x1404d7d77
xor r9d, r9d
ror bp, 0x2f
shld r10w, r14w, 0x82
lea rbp, reloc.d2d1.dll_Ordinal_1
add r10b, 0x42
mov r10d, 0xe3
btr ecx, ecx
lea eax, [r10 + r9]
and dx, r13w
cdq
neg ecx
sub eax, edx
mov edx, r8d
setge cl
btc cx, si
mov ch, 0x73
sar eax, 1
or cl, 0x60
movsxd rcx, eax
clc
jmp 0x1404d7ca3
shl rcx, 4
sub edx, dword [rcx + rbp]
jmp 0x1404d7caf
je 0x1404d7cf8
test edx, edx
xchg cx, cx
movzx rcx, r11w
movsx rcx, r13w
lea ecx, [rax - 1]
jmp 0x1404d7cca
cmovns ecx, r10d
inc eax
sub r10w, sp
test edx, edx
mov r10d, ecx
jmp 0x1404d7cde
cmovns r9d, eax
test r12b, 0x21
cmp r9d, ecx
jle 0x1404d7c7b
or eax, 0xffffffff
cmp r13w, 0x3b2e
test eax, eax
jmp 0x1404d7cff
js 0x1404d7d77
cdqe
movsxd rcx, esi
mov edx, 0x55
adc ecx, esi
add rax, rax
mov rbp, qword [rbp + rax*8 + 8]
bswap cx
xchg ecx, ecx
mov rcx, rbp
call fcn.1400fe5f1
mov rbx, rax
cmp r15w, 0x5c53
test spl, 0x7d
test edi, edi
jmp 0x1404d7d3a
jle 0x1404d7d6a
cmp ebx, edi
jge 0x1404d7d77
mov rdx, rdi
movsxd rcx, r10d
movzx rcx, r12w
mov r8, rbp
mov rcx, rsi
jmp 0x1404d7d5d
call fcn.1404c1331
test eax, eax
jne 0x1404d7dbc
lea eax, [rbx + 1]
jmp 0x1404d7d72
jmp 0x1404d7d7d
sub eax, eax
xadd bpl, bpl
mov rbx, qword [rsp + 0x40]
sbb dil, 0x9d
mov rbp, qword [rsp + 0x48]
inc dil
shrd edi, eax, 0xba
add rdi, 0x2ba12ced
mov rsi, qword [rsp + 0x50]
sub dil, al
movzx di, cl
xor dil, 0xde
add rsp, 0x30
movzx rdi, dx
movsx edi, r11w
pop rdi
jmp 0x1404d7dbb
ret
and qword [rsp + 0x20], 0
sub r9d, r9d
cmp r11b, 0xe5
stc
clc
sub r8d, r8d
cmp r12b, dl
xor edx, edx
stc
sub ecx, ecx
call fcn.1404ad3bc
int3
Function at 0x1404db270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
bsr r10w, r12w
add r10b, spl
or r10b, 0xe6
sub rsp, 0x30
xor r10b, r8b
not r10w
sal r10b, 0xcd
xor eax, eax
mov r10w, 0x3463
mov r10d, ecx
clc
jmp 0x1404db29d
test rdx, rdx
jne 0x1404db2cc
call fcn.1404ac6b8
mov ebx, 0x16
jmp 0x1404db2b5
mov dword [rax], ebx
call fcn.1404ad32a
mov eax, ebx
dec bx
add rsp, 0x30
pop rbx
jmp 0x1404db2cb
ret
test r8, r8
jmp 0x1404db2d4
je 0x1404db2a6
movzx ecx, byte [rsp + 0x60]
test bl, dil
mov word [rdx], ax
shr al, 0x6d
lea rax, [rcx + 1]
cmp r8, rax
jmp 0x1404db2f4
ja 0x1404db30e
call fcn.1404ac6b8
mov ebx, 0x22
jmp 0x1404db309
jmp 0x1404db2b5
lea eax, [r9 - 2]
test r12b, r11b
mov ebx, 0x22
test bpl, dl
test eax, 0x62d23936
cmp eax, ebx
jmp 0x1404db329
ja 0x1404db2a6
mov byte [rsp + 0x60], cl
mov ecx, r10d
add rsp, 0x30
pop rbx
jmp 0x1404db340
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
adc bp, r14w
jmp 0x1404db358
mov qword [rsp + 0x18], rsi
push rdi
dec r11w
movzx rdi, ax
ror bh, 0x8e
push r14
sal rdi, cl
movsx rbx, r10w
push r15
neg bx
mov bpl, sil
sub rsp, 0x20
btc bp, 0x4b
sub r15d, r15d
btc rbx, r8
mov ebp, r9d
shrd r10, rdx, 0x9c
inc r11
mov rdi, r8
not r10w
mov r11, rdx
sal r10d, cl
mov r10, rdx
sal rbx, 0x12
bsr rbx, rsp
mov ebx, r15d
cmp byte [rsp + 0x60], r15b
jmp 0x1404db3ba
je 0x1404db3ed
lea eax, [r15 + 0x2d]
shrd bx, r10w, 8
cmp bpl, r11b
inc r10b
neg ecx
movsx r14d, r13w
mov word [rdx], ax
lea ebx, [rax - 0x2c]
sbb r8b, 0xfc
cmp di, sp
sub r14w, 0x3de1
lea r10, [rdx + 2]
mov r8, r10
add si, 0x72ed
or r14, 0x205404af
xchg r14, r14
sub edx, edx
shl r14w, cl
shld si, di, 0xd2
lea rsi, [r10 + 2]
rcr r14w, 0x75
mov eax, ecx
mov r9, r10
inc ch
div ebp
xchg r14w, r14w
bts ecx, r14d
add cl, r13b
mov ecx, eax
shr r14b, 0x9c
sbb rax, 0x6ec2024c
sub r14b, 0xef
cmp edx, 9
xchg r14b, r14b
movsx ax, sil
mov ax, 0x6975
mov eax, 0x57
jmp 0x1404db457
lea r14d, [rax - 0x27]
jmp 0x1404db460
cmovbe ax, r14w
jmp 0x1404db46a
inc rbx
add ax, dx
cmp r8w, 0x3e36
cmp r11, rdx
mov word [r10], ax
test sil, 0x2e
test ecx, ecx
jmp 0x1404db488
je 0x1404db4a0
mov r10, rsi
clc
cmp rbx, rdi
jmp 0x1404db49a
jb 0x1404db3ff
cmp rbx, rdi
jmp 0x1404db4a8
jb 0x1404db4de
mov word [r11], r15w
jmp 0x1404db4b7
call fcn.1404ac6b8
mov ebx, 0x22
jmp 0x1404db4c6
mov dword [rax], ebx
jmp 0x1404db4cd
call fcn.1404ad32a
mov eax, ebx
jmp 0x1404db4d9
jmp 0x1404db521
mov word [rsi], r15w
clc
bsf cx, r14w
movzx eax, word [r8]
or cl, 0x84
setbe ch
movzx ecx, word [r9]
mov word [r9], ax
clc
sub r9, 2
mov word [r8], cx
test rdi, rbx
add r8, 2
test r14b, 0xbf
cmp r14b, r14b
cmp r8, r9
jmp 0x1404db519
jb 0x1404db4e8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
shld r14d, ebp, 0x3b
movzx r15, bx
add rsp, 0x20
mov r14b, 0x33
pop r15
mov r14w, 0x7684
pop r14
mov di, 0xe9b
cmovne edi, r10d
xchg dil, dil
pop rdi
jmp 0x1404db55a
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140013060
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Create thread

Disassembly:
jmp 0x140011a10
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1400220b8]
call fcn.140011389
mov dword [rbp + 0x44], 0
movsxd rax, dword [rbp + 0x44]
lea rcx, [rbp + 0x24]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140011375]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov edx, 0xa
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x140011aa7
lea rcx, str.the_kernel_object_is_signaled_n
call fcn.14001119f
jmp 0x140011abc
cmp dword [rbp + 0x64], 0x102
jne 0x140011abc
lea rcx, str.the_kernel_object_is_timeout_n
call fcn.14001119f
cmp qword [rbp + 8], 0
je 0x140011ade
mov edx, dword [rbp + 0x44]
lea rcx, str.Thread_launched__d_n
call fcn.14001119f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011af1
lea rcx, str.Error_creating_thread_n
call fcn.14001119f
mov eax, 1
jmp 0x140011af3
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ac80]
call fcn.140011320
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400143b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400143d0
xor al, al
jmp 0x140014451
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400143e3
xor al, al
jmp 0x140014451
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001440d
xor al, al
jmp 0x140014451
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014421
xor al, al
jmp 0x140014451
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014433
xor al, al
jmp 0x140014451
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001444f
xor al, al
jmp 0x140014451
mov al, 1
add rsp, 0x38
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
je 0x14003f67f
push rcx
int1
mov ebx, 0xbaf0ff73
jb 0x14003f687
invalid
out dx, eax
mov ecx, 0xb8efff71
jo 0x14003f68f
invalid
out dx, al
mov dh, 0x6f
invalid
outsb dx, byte [rsi]
invalid
push 0x68aee957
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid
inc dword [rax]
invalid
invalid

Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020640]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f118]
lea rcx, [0x140020640]
mov rdi, rdx
inc rdx
mov qword [0x14001f118], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021210]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140002a00
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword gs:[0x30]
mov rbp, rcx
xor edx, edx
mov rcx, qword [rax + 0x60]
test rbp, rbp
jne 0x140002a3f
mov rax, qword [rcx + 0x10]
jmp 0x140002b3d
mov rcx, qword [rcx + 0x18]
lea r14, [rsp + 0x20]
mov esi, edx
mov r13, rdx
lea rax, [rcx + 0x10]
mov qword [rsp + 0x20], rax
lea rax, [rcx + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rcx + 0x30]
mov qword [rsp + 0x30], rax
mov r15, qword [r14]
mov rbx, qword [r15]
jmp 0x140002b1f
mov rdi, rbx
mov r12, rdx
sub rdi, r13
mov rax, rdx
mov rcx, qword [rdi + 0x60]
cmp word [rcx], dx
je 0x140002a97
inc rax
add rcx, 2
cmp rax, 0x20
jb 0x140002a83
jmp 0x140002a9a
mov r12, rax
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x40]
call fcn.14000310c
mov rcx, qword [rdi + 0x60]
lea r8, [rsp + 0x40]
mov edx, r12d
call fcn.140002f0c
mov rdx, rbp
mov rcx, rax
call fcn.140003064
test eax, eax
je 0x140002b5e
mov rcx, qword [rdi + 0x50]
call fcn.1400029d8
xor edx, edx
mov r12, rax
test rax, rax
je 0x140002b1c
mov rdx, rbp
mov rcx, rax
call fcn.140003064
test eax, eax
je 0x140002b5e
mov r8d, 0x100
lea rdx, [rsp + 0x80]
mov rcx, r12
call fcn.140002f64
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.140003064
xor edx, edx
test eax, eax
je 0x140002b5e
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x140002a73
inc esi
add r14, 8
add r13, 0x10
cmp esi, 3
jl 0x140002a68
xor eax, eax
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rdi + 0x30]
jmp 0x140002b3d

Function at 0x140002c1c
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
and dword [r9], 0
mov r11, r9
movzx ebx, r8w
mov r10, rcx
test rcx, rcx
jne 0x140002c3c
xor eax, eax
jmp 0x140002ce4
movsxd rcx, dword [rcx + 0x3c]
mov r8d, 0x5a4d
cmp word [r10], r8w
jne 0x140002c72
test ecx, ecx
jle 0x140002c72
cmp ecx, 0x10000000
jae 0x140002c72
cmp dword [rcx + r10], 0x4550
jne 0x140002c72
lea r9, [r10 + 4]
add r9, rcx
lea r8, [r10 + 0x18]
add r8, rcx
jmp 0x140002c79
mov r9, r10
lea r8, [r10 + 0x14]
movzx ecx, word [r8]
mov eax, 0x107
sub ecx, eax
je 0x140002cc9
sub ecx, 4
je 0x140002cae
cmp ecx, 0x100
jne 0x140002c35
mov qword [rsp + 0x28], r8
mov rcx, r10
mov qword [rsp + 0x20], r9
movzx r8d, bx
mov r9, r11
call fcn.140002bc0
jmp 0x140002ce4
mov qword [rsp + 0x28], r8
mov rcx, r10
mov qword [rsp + 0x20], r9
movzx r8d, bx
mov r9, r11
call fcn.140002b64
jmp 0x140002ce4
mov qword [rsp + 0x28], r8
mov edx, eax
mov qword [rsp + 0x20], r9
movzx r8d, bx
mov r9, r11
mov rcx, r10
call fcn.140002d94
add rsp, 0x30
pop rbx
ret
Function at 0x140002e84
Capabilities:
Enumerate pe sections

Disassembly:
xor edx, edx
mov r11d, r8d
test rcx, rcx
je 0x140002ec9
movzx r9d, word [rcx + 6]
test r9d, r9d
je 0x140002ec9
movzx r10d, word [rcx + 0x14]
add r10, 0x18
add r10, rcx
test r9d, r9d
je 0x140002ec9
lea r8, [r10 + 0x10]
mov ecx, dword [r8 - 4]
cmp r11d, ecx
jb 0x140002ebe
add ecx, dword [r8]
cmp r11d, ecx
jb 0x140002ecc
inc edx
add r8, 0x28
cmp edx, r9d
jb 0x140002ead
xor eax, eax
ret
mov eax, edx
lea rcx, [rax + rax*4]
lea rax, [r10 + rcx*8]
ret
Function at 0x140061390
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.1400612f0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rcx, [0x14039c6b0]
call fcn.14000f130
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.140018e30
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14000f130
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x48]
call fcn.14000f240
call fcn.1400612f0
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x80
pop rdi
ret

Function at 0x140061470
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0
call fcn.1400612f0
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rcx, [0x14039c6b0]
call fcn.14000f130
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x88]
call fcn.14000f130
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call fcn.1400612f0
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call fcn.14000f350
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x88]
call fcn.14000f240
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x60
pop rdi
ret
Function at 0x140061550
Capabilities:
Read .ini file

Disassembly:
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.1400612f0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rcx, [0x14039c6b0]
call fcn.14000f130
mov qword [rsp + 0x38], rax
movss xmm1, dword [rsp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.1400612b0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14000f130
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x48]
call fcn.14000f240
call fcn.1400612f0
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x80
pop rdi
ret

Function at 0x140061fc0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x58]
lea rcx, str._pipediscord_ipc_0
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_46
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x50], reloc.WS2_32.dll_setsockopt
mov eax, 2
imul rax, rax, 0x15
mov ecx, Ordinal_50
mov word [rsp + rax + 0x58], cx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x48]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x140062072
mov rax, qword [rsp + 0x48]
mov byte [rax], 1
mov al, 1
jmp 0x1400620ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 2
jne 0x1400620bc
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
cmp eax, 0x39
jge 0x1400620ba
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
inc ax
mov ecx, 2
imul rcx, rcx, 0x15
mov word [rsp + rcx + 0x58], ax
jmp 0x140062022
jmp 0x1400620e3
cmp dword [rsp + 0x40], 0xe7
jne 0x1400620e3
mov edx, 0x2710
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x1400620de
xor al, al
jmp 0x1400620ec
jmp 0x140062022
xor al, al
jmp 0x1400620ec
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x140062150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x70], 0
jne 0x140062181
mov al, 1
jmp 0x140062210
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140062197
xor al, al
jmp 0x140062210
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x1400621a7
xor al, al
jmp 0x140062210
cmp qword [rsp + 0x68], 0
jne 0x1400621b3
xor al, al
jmp 0x140062210
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140062203
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
jne 0x140062203
mov dword [rsp + 0x34], 1
jmp 0x14006220b
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x58
ret

Function at 0x140062230
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x68], 0
jne 0x140062261
xor al, al
jmp 0x140062328
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14006227a
xor al, al
jmp 0x140062328
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x14006228d
xor al, al
jmp 0x140062328
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x14006231c
mov eax, dword [rsp + 0x3c]
cmp rax, qword [rsp + 0x70]
jb 0x14006231a
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140062310
mov al, 1
jmp 0x140062328
mov rcx, qword [rsp + 0x60]
call fcn.140062110
jmp 0x140062326
mov rcx, qword [rsp + 0x60]
call fcn.140062110
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x58
ret