joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013bac
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x140079ca0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov eax, r8d
mov rsi, rdx
mov rbx, rcx
cmp r8d, 0x800
jne 0x140013c1e
lea r8, [0x14005c6b0]
lea rcx, [rsp + 0xa0]
mov edx, 4
call fcn.14002fb84
test eax, eax
je 0x140013c40
cmp eax, 0xc
je 0x140013c18
cmp eax, 0x16
je 0x140013c12
cmp eax, 0x22
je 0x140013c12
cmp eax, 0x50
je 0x140013c40
call fcn.1400086c0
int3
call fcn.1400086c0
int3
call fcn.140008678
int3
mov r9d, 4
lea r8, [rsp + 0xa0]
mov ecx, eax
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140013d63
call fcn.140032018
mov edi, dword [rax]
call fcn.140032018
lea rcx, [rsp + 0xb0]
and dword [rax], 0
lea rax, [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov esi, 0x112
lea r8d, [rsi - 1]
mov rdx, rsi
call fcn.140031fac
mov ebx, eax
call fcn.140032018
cmp dword [rax], 0
je 0x140013cc8
call fcn.140032018
cmp dword [rax], 0
je 0x140013ccf
cmp dword [rax], 0xc
je 0x140013cbd
cmp dword [rax], 0x16
je 0x140013cb2
cmp dword [rax], 0x22
je 0x140013cb2
cmp dword [rax], 0x50
je 0x140013ccf
mov ecx, 0x80004005
call fcn.140004190
int3
mov ecx, 0x80070057
call fcn.140004190
int3
mov ecx, 0x8007000e
call fcn.140004190
int3
call fcn.140032018
mov dword [rax], edi
cmp ebx, 0xffffffff
je 0x140013d63
cmp ebx, esi
jae 0x140013d63
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor edx, edx
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
mov rbx, rax
mov dword [rsp + 0x30], 0x70
call fcn.140030610
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013d4e
lea rdx, str.FindActCtxSectionStringW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013d4e
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9, rbx
mov qword [rsp + 0x20], rcx
lea r8d, [rdx + 2]
xor ecx, ecx
call rax
mov rcx, rbx
test eax, eax
jne 0x140013d56
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140013d65
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14002f9d0
add rsp, 0x2f0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140018a0c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140018a44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, eax
call fcn.14002abc0
movzx edx, byte [rsi + 0x20]
cmp edx, ebp
je 0x140018a6f
test bpl, 1
je 0x140018a6f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140018a6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, eax
call fcn.14002abc0
lea rcx, [rsi + 8]
cmp qword [rcx], rbx
je 0x140018b55
lea rdx, [rsp + 0x88]
call fcn.1400188d4
lea rcx, [rsi + 0x10]
cmp qword [rcx], rbx
je 0x140018aa1
lea rdx, [rsp + 0x78]
call fcn.1400188d4
lea r13, [rsp + 0x78]
cmp qword [rsi], rbx
je 0x140018abe
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1400188d4
lea rbx, [rsp + 0x80]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140018b02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, eax
call fcn.14002abc0
lea r9, [rsp + 0x88]
mov r8, r13
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x140018b38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
mov ecx, ebx
call fcn.14002abc0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140018b55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, eax
call fcn.14002abc0
movzx edx, byte [rsi + 0x20]
cmp edx, ebp
je 0x140018b80
test bpl, 1
jne 0x140018b80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140018b80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, eax
call fcn.14002abc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030d08
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140035dbc
nop
cmp dword [0x14007f3f8], 1
je 0x140030cb4
mov dword [0x14007f3f4], 1
mov byte [0x14007f3f0], r12b
test ebx, ebx
jne 0x140030ca0
mov rcx, qword [0x1400987b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140030c8d
mov rcx, qword [0x1400987a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140030c2c
call fcn.1400342d0
cmp qword [rdi], rax
jne 0x140030c2c
jmp 0x140030c12
cmp rdi, rsi
jb 0x140030c8d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400342d0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400987b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400987a8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140030c6b
cmp r13, rax
je 0x140030c8b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140030c12
lea rdx, [0x140059df8]
lea rcx, [0x140059de0]
call fcn.140030a5c
lea rdx, [0x140059e08]
lea rcx, [0x140059e00]
call fcn.140030a5c
nop
test r12d, r12d
je 0x140030cc3
mov ecx, 8
call fcn.140035cbc
test r12d, r12d
jne 0x140030cee
mov dword [0x14007f3f8], 1
lea ecx, [r12 + 8]
call fcn.140035cbc
mov ecx, r15d
call fcn.1400309f0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140030b7c
Function at 0x140034823
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140079ca0]
jne 0x14002f9ea
rol rcx, 0x10
test cx, 0xffff
jne 0x14002f9e6
repz ret
ror rcx, 0x10
jmp 0x14003477c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14007f9e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14007fad8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140034801
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14007f9e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140034823
mov rax, qword [rsp + 0x88]
mov qword [0x14007fad8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14007fa78], rax
mov rax, qword [0x14007fad8]
mov qword [0x14007f950], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14007fa60], rax
mov dword [0x14007f940], 0xc0000409
mov dword [0x14007f944], 1
mov rax, qword [0x140079ca0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140079ca8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14007f9d8], eax
mov ecx, 1
call fcn.14003b82c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140062560]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14007f9d8], 0
jne 0x1400348aa
mov ecx, 1
call fcn.14003b82c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14003b34c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400342d0
xor ebx, ebx
mov rdi, rax
cmp qword [0x140080270], rbx
jne 0x14003b452
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14003b527
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003b527
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1400626d0]
mov rcx, rsi
mov qword [0x140080270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1400626b8]
mov rcx, rsi
mov qword [0x140080278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140080280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140080290], rax
test rax, rax
je 0x14003b449
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140080288], rax
jmp 0x14003b459
mov rax, qword [0x140080288]
jmp 0x14003b460
mov rax, qword [0x140080288]
mov r11, qword [0x140080290]
cmp rax, rdi
je 0x14003b4c8
cmp r11, rdi
je 0x14003b4c8
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140080290]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14003b4c8
test rax, rax
je 0x14003b4c8
call rsi
test rax, rax
je 0x14003b4c2
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003b4c2
test byte [rsp + 0x38], 1
jne 0x14003b4c8
bts ebp, 0x15
jmp 0x14003b506
mov rcx, qword [0x140080278]
cmp rcx, rdi
je 0x14003b506
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003b506
call rax
mov rbx, rax
test rax, rax
je 0x14003b506
mov rcx, qword [0x140080280]
cmp rcx, rdi
je 0x14003b506
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003b506
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140080270]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003b527
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14003b529
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140043ab0
Capabilities:
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov qword [rsp + 0x298], 0xfffffffffffffffe
mov rax, qword [0x140079ca0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor r9d, r9d
mov r8d, 0x24
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [0x140064440]
lea rcx, [rsp + 0x80]
call fcn.140004d20
lea rcx, [rsp + 0x40]
call fcn.140011e1c
nop
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140011f20
test eax, eax
jne 0x140043b99
lea rcx, [rsp + 0x40]
call fcn.140011990
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0xffffffffffffffff
jne 0x140043b89
lea rcx, [rsp + 0x40]
call fcn.140011e78
jmp 0x140043be7
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140043ba3
lea rcx, [rsp + 0x40]
call fcn.140011990
lea r9, [rsp + 0x80]
lea r8, [0x140064424]
lea rdx, [0x140064458]
lea rcx, str.reboot
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r8d, 4
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rsp + 0x40]
call fcn.140011e78
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14002f9d0
add rsp, 0x2b8
ret

Function at 0x140043c10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov qword [rsp + 0x278], 0xfffffffffffffffe
mov rax, qword [0x140079ca0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor r9d, r9d
mov r8d, 0x24
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x140043c5c
mov eax, 1
jmp 0x140043ccd
lea rdx, [0x140064428]
lea rcx, [rsp + 0x60]
call fcn.140004d20
mov dword [rsp + 0x270], 1
lea rcx, [rsp + 0x20]
call fcn.140011e1c
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140011f20
test eax, eax
je 0x140043ca4
mov dword [rsp + 0x270], 0
lea rcx, [rsp + 0x20]
call fcn.140011990
mov eax, dword [rsp + 0x270]
mov dword [rsp + 0x274], eax
lea rcx, [rsp + 0x20]
call fcn.140011e78
mov eax, dword [rsp + 0x274]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14002f9d0
add rsp, 0x298
ret

Function at 0x1400450d0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
mov r8d, 1
lea rdx, str.ReFreshFlg
lea rcx, [0x140064838]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x140045118
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140045130
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
xor r8d, r8d
lea rdx, str.ModelCount
adc eax, 0x1f673
lea rcx, [0x1400647e0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140045180
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
xor r8d, r8d
lea rdx, str.Count
lea rcx, [0x1400646d0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400451d0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
xor r8d, r8d
lea rdx, str.OSRestriction
lea rcx, [0x1400644b0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140046240
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov r9, qword [rsp + 0x50]
add r9, 8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
lea r8, [0x1400648b8]
lea rdx, str.PortDefault
lea rcx, [0x1400648d8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400462b8
mov rdx, qword [rsp + 0x50]
add rdx, 8
mov rcx, qword [rsp + 0x58]
call fcn.1400043e0
jmp 0x1400462d2
mov edx, 0x839
mov rcx, qword [rsp + 0x58]
call fcn.140003bb0
cmp eax, 1
je 0x1400462d2
mov eax, dword [rsp + 0x34]
jmp 0x1400462de
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x1400462f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov r9, qword [rsp + 0x50]
add r9, 8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
lea r8, [0x140064878]
lea rdx, str.ModelNameDefault
lea rcx, [0x1400648a8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140046368
mov rdx, qword [rsp + 0x50]
add rdx, 8
mov rcx, qword [rsp + 0x58]
call fcn.1400043e0
jmp 0x140046382
mov edx, 0x838
mov rcx, qword [rsp + 0x58]
call fcn.140003bb0
cmp eax, 1
je 0x140046382
mov eax, dword [rsp + 0x34]
jmp 0x14004638e
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x1400463a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov r9, qword [rsp + 0x50]
add r9, 8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
lea r8, [0x140064848]
lea rdx, str.ReFreshName
lea rcx, str.System
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14004641e
mov rdx, qword [rsp + 0x50]
add rdx, 8
mov rcx, qword [rsp + 0x58]
call fcn.1400043e0
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret
Function at 0x140046430
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.140003710
nop
mov r8d, dword [rsp + 0x70]
lea rdx, str.DriverName_d
lea rcx, [rsp + 0x38]
call fcn.140007280
mov rbx, qword [rsp + 0x60]
add rbx, 8
lea rcx, [rsp + 0x38]
call fcn.140003700
mov rdx, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x14006480c]
lea rcx, [0x140064810]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400464e7
mov rdx, qword [rsp + 0x60]
add rdx, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400043e0
mov dword [rsp + 0x40], 1
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x38]
call fcn.140003760
mov eax, dword [rsp + 0x44]
add rsp, 0x50
pop rbx
ret

Function at 0x140046510
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov r9, qword [rsp + 0x50]
add r9, 8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
lea r8, [0x140064798]
lea rdx, str.HelpFile
lea rcx, [0x1400647b8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14004658e
mov rdx, qword [rsp + 0x50]
add rdx, 8
mov rcx, qword [rsp + 0x58]
call fcn.1400043e0
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x1400465a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov r9, qword [rsp + 0x50]
add r9, 8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
lea r8, [0x140064768]
lea rdx, str.ConfigFile
lea rcx, [0x140064788]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14004661e
mov rdx, qword [rsp + 0x50]
add rdx, 8
mov rcx, qword [rsp + 0x58]
call fcn.1400043e0
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret
Function at 0x140046630
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov r9, qword [rsp + 0x50]
add r9, 8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
lea r8, [0x140064738]
lea rdx, str.DriverFile
lea rcx, [0x140064758]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400466ae
mov rdx, qword [rsp + 0x50]
add rdx, 8
mov rcx, qword [rsp + 0x58]
call fcn.1400043e0
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x1400466c0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.140003710
nop
mov r8d, dword [rsp + 0x70]
lea rdx, str.DataFile_d
lea rcx, [rsp + 0x38]
call fcn.140007280
mov rbx, qword [rsp + 0x60]
add rbx, 8
lea rcx, [rsp + 0x38]
call fcn.140003700
mov rdx, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140064720]
lea rcx, [0x140064728]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140046777
mov rdx, qword [rsp + 0x60]
add rdx, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400043e0
mov dword [rsp + 0x40], 1
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x38]
call fcn.140003760
mov eax, dword [rsp + 0x44]
add rsp, 0x50
pop rbx
ret

Function at 0x1400467a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.140003710
nop
mov r8d, dword [rsp + 0x70]
lea rdx, [0x1400646e8]
lea rcx, [rsp + 0x38]
call fcn.140007280
mov rbx, qword [rsp + 0x60]
add rbx, 8
lea rcx, [rsp + 0x38]
call fcn.140003700
mov rdx, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x2008]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x1400646cc]
lea rcx, str.CopyFile
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140046857
mov rdx, qword [rsp + 0x60]
add rdx, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400043e0
mov dword [rsp + 0x40], 1
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x38]
call fcn.140003760
mov eax, dword [rsp + 0x44]
add rsp, 0x50
pop rbx
ret