joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110025730
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov byte [rcx + 8], 0x1e
mov dword [rcx + 0xc], eax
lea rdi, [0x1100d2030]
mov qword [rcx + 0x14], rax
lea rdx, [rsp + 0x30]
mov qword [rcx + 0x1c], rax
mov rbx, rcx
mov dword [rcx + 0x24], eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
movabs rax, 0x14043caa0
mov word [rcx + 0x10], 3
mov rcx, rdi
call rax
test al, al
je 0x11002590d
mov ecx, dword [rbx + 4]
mov rax, qword [rsp + 0x30]
cmp dword [rsp + 0x34], ecx
jne 0x1100257b3
cmp eax, dword [rbx]
je 0x11002590d
mov r9, rdi
mov qword [rbx], rax
mov r8d, 0x1e
lea rdx, [0x1100d2058]
lea rcx, [0x1100d18a0]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rdi
lea rdx, [0x1100d2060]
lea rcx, [0x1100d18a0]
mov byte [rbx + 8], al
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rdi
lea rdx, [0x1100d2070]
lea rcx, [0x1100d18a0]
mov dword [rbx + 0xc], eax
mov r8d, 3
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rdi
lea rdx, [0x1100d2080]
lea rcx, [0x1100d18a0]
mov byte [rbx + 0x10], al
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rdi
lea rdx, [0x1100d208c]
lea rcx, [0x1100d2098]
mov byte [rbx + 0x11], al
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov r9, rdi
lea rdx, [0x1100d20a0]
lea rcx, [0x1100d2098]
mov dword [rbx + 0x14], eax
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
lea r8, [0x1100d20a8]
mov dword [rbx + 0x18], eax
lea rdx, [0x1100d20b0]
mov dword [rsp + 0x20], 0x20
lea rcx, [0x1100d2098]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x38]
call fcn.1100b2100
xorps xmm1, xmm1
mov qword [rsp + 0x28], rdi
cvtsd2ss xmm1, xmm0
lea r9, [rsp + 0x38]
mov dword [rsp + 0x20], 0x20
lea r8, [0x1100d20a8]
lea rdx, [0x1100d20c0]
lea rcx, [0x1100d2098]
movss dword [rbx + 0x1c], xmm1
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x38]
call fcn.1100b2100
xorps xmm1, xmm1
lea rdx, [0x1100d20d0]
cvtsd2ss xmm1, xmm0
mov r9, rdi
lea rcx, [0x1100d2098]
xor r8d, r8d
movss dword [rbx + 0x20], xmm1
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0x24], eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.11009af60
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x110025930
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, rdx
movaps xmmword [rsp + 0x20], xmm6
mov edx, dword [rcx + 0x14]
mov r14, r8
mov rbx, rcx
movabs rsi, 0x1400df070
test edx, edx
je 0x11002597a
mov rcx, rdi
movabs rax, 0x140055c40
call rax
xor edx, edx
mov rcx, rdi
call rsi
mov edx, dword [rbx + 0x18]
test edx, edx
je 0x110025997
mov rcx, rdi
movabs rax, 0x140055e70
call rax
xor edx, edx
mov rcx, rdi
call rsi
movss xmm0, dword [rbx + 0x1c]
xorps xmm6, xmm6
ucomiss xmm0, xmm6
jp 0x1100259a6
je 0x1100259cf
xorps xmm0, xmmword [0x1100d21e0]
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
mov r9d, 0xffffffff
mov r8d, 5
mov rcx, rdi
movabs rax, 0x14005f660
call rax
movss xmm0, dword [rbx + 0x20]
ucomiss xmm0, xmm6
jp 0x1100259db
je 0x1100259fb
xorps xmm0, xmmword [0x1100d21e0]
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
xor r8d, r8d
mov rcx, rdi
movabs rax, 0x14005f990
call rax
cmp dword [rbx + 0x24], 0
je 0x110025a59
movabs rax, 0x14007b8b0
xor esi, esi
call rax
mov rcx, rax
mov dl, 2
movabs rax, 0x14007b880
call rax
mov rcx, qword [rdi + 0x790]
cmp al, 2
jne 0x110025a31
mov esi, dword [rcx + 0x929b]
sub esi, dword [rbx + 0x24]
mov dl, 2
mov r8d, esi
movabs rax, 0x14011be20
call rax
mov r8d, esi
mov dl, 2
mov rcx, rdi
movabs rax, 0x1400e8e60
call rax
mov eax, dword [rbx + 0x14]
mov rcx, rdi
mov dword [r14], eax
movabs rax, 0x140061950
call rax
mov rcx, qword [0x110207f98]
lea rdx, [0x1100d21c8]
add rcx, 0x1280
mov r8, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r14
jmp fcn.11003df70

Function at 0x110026020
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rsi, [0x1100d21f0]
mov rdi, rcx
mov qword [rsp + 0x30], rax
mov r9, rsi
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rdx, [0x1100d1b3c]
mov qword [rsp + 0x48], rax
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
movsxd rcx, eax
mov dword [rdi], eax
mov eax, 0x40
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
xor ebx, ebx
mov qword [rdi + 8], rax
cmp dword [rdi], ebx
jle 0x1100260fb
nop dword [rax]
nop word [rax + rax]
mov r8d, ebx
lea rdx, [0x1100d2204]
lea rcx, [rsp + 0x30]
call fcn.110001a70
movsxd r9, ebx
lea r8, [0x1100d14fc]
shl r9, 6
lea rdx, [rsp + 0x30]
add r9, qword [rdi + 8]
lea rcx, [0x1100d14f4]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
inc ebx
cmp ebx, dword [rdi]
jl 0x1100260b0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.11009af60
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x110026120
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [r11 + 0x18], rsi
lea r9, [r11 - 0x68]
mov qword [r11 + 0x20], rdi
lea r8, [0x1100cf738]
mov qword [r11 - 0x10], r14
lea rdx, [0x1100d14c0]
mov qword [r11 - 0x18], r15
mov rbx, rcx
lea r15, [0x1100d2210]
xor dil, dil
mov qword [rsp + 0x28], r15
lea rcx, [0x1100d14f4]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x60]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x60]
mov r8d, esi
cmove edi, esi
call fcn.1100b1cb0
test eax, eax
movzx ecx, dil
mov r9, r15
lea rdx, [0x1100d1b3c]
cmove ecx, esi
xor eax, eax
mov byte [rbx], cl
xor r8d, r8d
lea rcx, [0x1100d14f4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rbx + 4], eax
cmp eax, 0x32
jle 0x110026206
mov eax, 0x32
mov dword [rbx + 4], eax
movsxd r14, eax
mov rcx, 0xffffffffffffffff
mov eax, 0xc
mul r14
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
xor edi, edi
mov qword [rsp + 0x30], rax
mov rsi, rax
test rax, rax
je 0x11002624c
test r14, r14
je 0x11002624f
lea r8, [r14 + r14*2]
xor edx, edx
shl r8, 2
mov rcx, rax
call fcn.11009c5d0
jmp 0x11002624f
mov rsi, rdi
mov r14, qword [rsp + 0xb8]
mov qword [rbx + 8], rsi
cmp dword [rbx + 4], edi
jle 0x11002638a
mov qword [rsp + 0xd8], rbp
mov rsi, rdi
nop
mov r8d, edi
lea rdx, [0x1100d2238]
lea rcx, [rsp + 0x38]
call fcn.110001a70
mov r9, r15
lea rdx, [rsp + 0x38]
xor r8d, r8d
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rcx, qword [rbx + 8]
lea rdx, [0x1100d2248]
mov r8d, edi
mov byte [rsi + rcx], al
lea rcx, [rsp + 0x38]
call fcn.110001a70
mov r9, qword [rbx + 8]
lea r8, [0x1100d14fc]
movsxd rax, edi
lea rdx, [rsp + 0x38]
inc r9
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 8
lea rcx, [rax + rax*2]
lea rbp, [rcx*4]
add r9, rbp
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov rax, qword [rbx + 8]
cmp byte [rsi + rax], 0
jne 0x11002633e
mov rcx, qword [0x110207df0]
lea rdx, [rax + 1]
add rdx, rbp
call fcn.110039030
test al, al
jne 0x11002633e
mov r8, qword [rbx + 8]
lea rdx, [0x1100d2258]
mov rcx, qword [0x110207f98]
inc r8
add r8, rbp
add rcx, 0x378
call fcn.11003df70
mov byte [rbx], 0
mov r8d, edi
lea rdx, [0x1100d2290]
lea rcx, [rsp + 0x38]
call fcn.110001a70
mov r9, r15
lea rdx, [rsp + 0x38]
xor r8d, r8d
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rcx, qword [rbx + 8]
inc edi
mov word [rcx + rsi + 0xa], ax
add rsi, 0xc
cmp edi, dword [rbx + 4]
jl 0x110026270
mov rbp, qword [rsp + 0xd8]
mov rcx, qword [0x1101121c8]
xor edx, edx
call fcn.110011920
mov r15, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xe0]
test al, al
jne 0x1100263b6
mov byte [rbx], al
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.11009af60
add rsp, 0xc0
pop rbx
ret
Function at 0x1100263d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov byte [rcx], 0
mov eax, ebx
mov rdi, rcx
nop dword [rax]
nop word [rax + rax]
mov qword [rcx + rax + 0x10], rbx
mov qword [rcx + rax + 0x18], rbx
mov qword [rcx + rax + 0x20], rbx
mov qword [rcx + rax + 0x28], rbx
mov qword [rcx + rax + 0x30], rbx
mov qword [rcx + rax + 0x38], rbx
mov word [rcx + rax + 0x40], bx
add rax, 0x32
cmp rax, 0x1ee88
jl 0x110026400
call fcn.110026120
movdqa xmm0, xmmword [0x1100d22a0]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x32], al
mov word [rsp + 0x30], 0xffd8
nop
movsxd rax, ebx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rbx - 0x1f]
inc ebx
xor byte [rcx], al
cmp ebx, 0x12
jb 0x110026450
movzx eax, byte [rdi]
lea rdx, [rsp + 0x20]
mov r8, qword [0x110207df0]
mov rcx, qword [0x110207f98]
mov byte [rsp + 0x32], 0
add rcx, 0x1bc
mov r8, qword [r8 + rax*8 + 0x48]
call fcn.11003df70
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.11009af60
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x110026d60
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xor ecx, ecx
mov rax, rdi
lea edx, [rcx + 0x27]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rcx
mov qword [rax - 0x20], rcx
mov qword [rax - 0x18], rcx
mov qword [rax - 0x10], rcx
mov qword [rax - 8], rcx
sub rdx, 1
jne 0x110026d91
mov qword [rax], rcx
lea rbp, [0x1100d1658]
mov qword [rax + 8], rcx
lea rdx, [0x1100d22b0]
mov qword [rax + 0x10], rcx
mov esi, 1
mov qword [rax + 0x18], rcx
mov r9, rbp
mov dword [rax + 0x20], ecx
mov r8d, esi
lea rcx, [0x1100d14f4]
mov byte [rdi + 0x9e4], 1
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
lea r8, [0x1100cf738]
mov byte [rdi + 0x9e4], al
lea rdx, [0x1100d22b8]
mov dword [rsp + 0x20], 0x40
lea rcx, [0x1100d14f4]
xor bl, bl
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea r8d, [rsi + 3]
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov r8d, esi
lea rcx, [rsp + 0x30]
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
mov r9, rbp
lea rcx, [0x1100d14f4]
cmove edx, esi
mov r8d, 0xbb8
mov byte [rdi + 0x9e5], dl
lea rdx, [0x1100d22c8]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov word [rdi + 0x9e6], ax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x110027280
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
lea r14, [0x1100d2328]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x60]
lea r8, [0x1100cf738]
mov dword [rsp + 0x20], 0x40
lea rdx, [0x1100d2358]
xor bl, bl
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x60]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x60]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
movzx ecx, bl
lea r9, [rsp + 0x60]
test eax, eax
mov qword [rsp + 0x28], r14
lea r8, [0x1100cf738]
mov dword [rsp + 0x20], 0x40
cmove ecx, esi
lea rdx, [0x1100d2368]
mov byte [rdi], cl
xor bl, bl
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea r8d, [rsi + 3]
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x60]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov r8d, esi
lea rcx, [rsp + 0x60]
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx ecx, bl
mov r9, r14
lea rdx, [0x1100d2370]
cmove ecx, esi
xor eax, eax
mov byte [rdi + 1], cl
xor r8d, r8d
lea rcx, [0x1100d14f4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi + 4], eax
mov rcx, 0xffffffffffffffff
movsxd rbp, eax
mov eax, 8
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
xor ebx, ebx
mov qword [rsp + 0x30], rax
mov rsi, rax
test rax, rax
je 0x110027400
test rbp, rbp
je 0x110027403
lea r8, [rbp*8]
xor edx, edx
mov rcx, rax
call fcn.11009c5d0
jmp 0x110027403
mov rsi, rbx
mov qword [rdi + 8], rsi
cmp dword [rdi + 4], ebx
jle 0x11002745c
nop dword [rax]
mov r8d, ebx
lea rdx, [0x1100d2378]
lea rcx, [rsp + 0x38]
call fcn.110001a70
mov rax, qword [rdi + 8]
lea r8, [0x1100d14fc]
movsxd rcx, ebx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 8
lea r9, [rax + rcx*8]
lea rcx, [0x1100d14f4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
inc ebx
cmp ebx, dword [rdi + 4]
jl 0x110027410
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x110027730
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov word [rcx], 0
call fcn.110027280
xor edx, edx
cmp byte [rbx], dl
jne 0x110027760
mov r9d, edx
cmp byte [rbx + 1], dl
je 0x110027766
mov r9d, 1
movdqa xmm0, xmmword [0x1100d2390]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x3c], al
mov dword [rsp + 0x30], 0x71637776
mov dword [rsp + 0x34], 0x34217476
mov dword [rsp + 0x38], 0x2d366d38
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rdx + 5]
inc edx
xor byte [rcx], al
cmp edx, 0x1c
jb 0x1100277a0
mov r8, qword [0x110207df0]
lea rdx, [rsp + 0x20]
mov rcx, qword [0x110207f98]
mov byte [rsp + 0x3c], 0
add rcx, 0x1bc
mov r8, qword [r8 + r9*8 + 0x48]
call fcn.11003df70
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x50
pop rbx
ret
Function at 0x110027d90
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0xa0
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov byte [rcx + 8], 0
call fcn.110027800
movdqa xmm0, xmmword [0x1100d2460]
xor eax, eax
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x62], al
xor edx, edx
mov word [rsp + 0x60], 0xbc99
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0x60]
inc edx
xor byte [rcx], al
cmp edx, 0x12
jb 0x110027de0
movzx eax, byte [rdi + 8]
lea rdx, [rsp + 0x50]
mov r8, qword [0x110207df0]
mov rcx, qword [0x110207f98]
mov byte [rsp + 0x62], 0
add rcx, 0x1bc
mov r8, qword [r8 + rax*8 + 0x48]
call fcn.11003df70
cmp byte [rdi + 8], 0
je 0x110027f44
mov qword [rsp + 0xc8], rsi
xor esi, esi
cmp dword [rdi + 0xc], esi
jle 0x110027f3c
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbp
xor ebp, ebp
movdqa xmm0, xmmword [0x1100d2440]
xor eax, eax
movdqa xmm1, xmmword [0x1100d2450]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x88], 0xa7e7eda4
movdqu xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x8c], 0xeea2e0e8
mov word [rsp + 0x90], 0xc5
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x68]
add rdx, rcx
lea ecx, [rax - 0x60]
inc eax
xor byte [rdx], cl
cmp eax, 0x29
jb 0x110027ea0
mov rdx, qword [rdi + 0x10]
mov byte [rsp + 0x91], 0
movsxd rax, esi
imul rcx, rax, 0x2c
movzx r8d, byte [rdx + rbp + 0x2a]
lea r11, [rdx + 1]
movzx r10d, word [rdx + rbp + 0x28]
add r11, rcx
movzx ebx, byte [rdx + rbp + 0x21]
mov eax, dword [rdx + rbp + 0x24]
mov rcx, qword [0x110207f98]
movzx r9d, byte [rdx + rbp]
add rcx, 0x1bc
mov dword [rsp + 0x40], r8d
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x38], r10d
mov r8d, esi
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call fcn.11003df70
inc esi
add rbp, 0x2c
cmp esi, dword [rdi + 0xc]
jl 0x110027e53
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.11009af60
add rsp, 0xa0
pop rdi
ret
Function at 0x110029e90
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [r11 + 0x18], r14
mov rdi, rcx
mov qword [r11 - 0x40], rax
xor ebx, ebx
mov qword [r11 - 0x38], rax
mov dword [rcx], ebx
lea r9, [0x1100d2648]
lea rcx, [0x1100d266c]
mov qword [r11 - 0x30], rax
xor r8d, r8d
mov qword [r11 - 0x28], rax
lea rdx, [0x1100d19a4]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi], eax
mov rcx, 0xffffffffffffffff
movsxd r14, eax
mov eax, 0x18
mul r14
cmovo rax, rcx
mov rcx, rax
call fcn.11009b934
mov qword [rsp + 0x20], rax
mov rsi, rax
test rax, rax
je 0x110029f2a
test r14, r14
je 0x110029f2d
lea r8, [r14 + r14*2]
xor edx, edx
shl r8, 3
mov rcx, rax
call fcn.11009c5d0
jmp 0x110029f2d
mov rsi, rbx
mov eax, dword [rdi]
mov qword [rdi + 8], rsi
mov esi, ebx
test eax, eax
jle 0x110029ffc
mov r14, rbx
mov r8d, esi
lea rdx, [0x1100d19a8]
lea rcx, [rsp + 0x28]
call fcn.110001a70
lea r9, [0x1100d2648]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [0x1100d266c]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rcx, qword [rdi + 8]
lea rdx, [0x1100d19b0]
mov r8d, esi
mov byte [r14 + rcx], al
lea rcx, [rsp + 0x28]
call fcn.110001a70
lea r9, [0x1100d2648]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [0x1100d266c]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov ecx, eax
mov r8d, esi
mov rax, qword [rdi + 8]
lea rdx, [0x1100d19c0]
mov qword [r14 + rax + 8], rcx
lea rcx, [rsp + 0x28]
call fcn.110001a70
lea r9, [0x1100d2648]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [0x1100d266c]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov rcx, qword [rdi + 8]
lea r14, [r14 + 0x18]
inc esi
mov dword [r14 + rcx - 8], eax
mov eax, dword [rdi]
cmp esi, eax
jl 0x110029f40
mov r14, qword [rsp + 0x80]
test eax, eax
jle 0x11002a07e
mov qword [rsp + 0x78], rbp
mov rsi, rbx
movabs rbp, 0x140000c00
nop word [rax + rax]
mov rdx, qword [rdi + 8]
movzx ecx, byte [rsi + rdx]
test ecx, ecx
je 0x11002a05d
sub ecx, 1
je 0x11002a049
cmp ecx, 1
jne 0x11002a06f
mov rcx, qword [rsi + rdx + 8]
mov edx, dword [rsi + rdx + 0x10]
add rcx, rbp
call fcn.110048e40
jmp 0x11002a06f
mov rcx, qword [rsi + rdx + 8]
movzx edx, word [rsi + rdx + 0x10]
add rcx, rbp
call fcn.110048e60
jmp 0x11002a06f
mov rcx, qword [rsi + rdx + 8]
movzx edx, byte [rsi + rdx + 0x10]
add rcx, rbp
call fcn.110048d70
inc ebx
add rsi, 0x18
cmp ebx, dword [rdi]
jl 0x11002a020
mov rbp, qword [rsp + 0x78]
mov edx, 5
movabs rcx, 0x1400081d9
call fcn.110048bd0
mov edx, 5
movabs rcx, 0x1400102ee
call fcn.110048bd0
mov edx, 5
movabs rcx, 0x1401c1612
call fcn.110048bd0
mov dl, 0xeb
movabs rcx, 0x140261ff2
call fcn.110048d70
mov edx, 0xffffe990
movabs rcx, 0x14039d71e
call fcn.110048e60
mov edx, 0xffffe990
movabs rcx, 0x14039d7d8
call fcn.110048e60
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.11009af60
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x11002a110
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x110109588]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
call fcn.1100491a0
xor r9d, r9d
mov byte [rdi + 4], 0
mov dword [rdi + 8], r9d
lea r8, [rdi + 0xc]
mov edx, r9d
mov byte [rdi + rdx + 0x1874c4c], 1
mov rax, r8
mov ecx, 0x9e
mov qword [rax], r9
mov qword [rax + 8], r9
mov qword [rax + 0x10], r9
lea rax, [rax + 0x40]
mov qword [rax - 0x28], r9
mov qword [rax - 0x20], r9
mov qword [rax - 0x18], r9
mov qword [rax - 0x10], r9
mov qword [rax - 8], r9
sub rcx, 1
jne 0x11002a160
inc rdx
mov qword [rax], r9
add r8, 0x2790
mov qword [rax + 8], r9
cmp rdx, 0x9e4
jl 0x11002a150
lea rbp, [0x1100d1e70]
xor bl, bl
mov qword [rsp + 0x28], rbp
lea r9, [rsp + 0x30]
lea r8, [0x1100cf738]
mov dword [rsp + 0x20], 0x40
lea rdx, [0x1100d2678]
lea rcx, [0x1100d2688]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov r8d, 4
lea rdx, [0x1100cf740]
lea rcx, [rsp + 0x30]
call fcn.1100b1d78
test eax, eax
lea rdx, [0x1100d14c8]
mov esi, 1
lea rcx, [rsp + 0x30]
mov r8d, esi
cmove ebx, esi
call fcn.1100b1cb0
test eax, eax
movzx edx, bl
mov r9, rbp
lea r8d, [rsi + 4]
cmove edx, esi
lea rcx, [0x1100d2688]
mov byte [rdi + 4], dl
lea rdx, [0x1100d2698]
call qword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [rdi + 8], eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.11009af60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret