joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140210000
Capabilities:
Delete directory

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov dil, r8b
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + 0x30]
xor ebp, ebp
test al, al
je 0x140210229
cmp byte [rbx + 0x50], bpl
je 0x140210046
test dil, dil
je 0x140210059
cmp byte [rbx + 0x51], bpl
je 0x140210229
test dil, dil
je 0x140210229
mov rax, qword [rbx + 0x18]
cmp byte [rax + 1], bpl
jne 0x140210229
lea rdx, [0x14034fa44]
mov rcx, rsi
call fcn.14020ff70
test al, al
je 0x140210229
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140210220
cmp qword [rcx + 0x80], rbp
je 0x140210220
mov rax, qword [rcx + 0x80]
cmp byte [rax + 0x25], bpl
je 0x140210220
cmp byte [rax + 0x26], bpl
je 0x140210220
mov ecx, 0x30
call fcn.1400be454
mov rdi, rax
or r12, 0xffffffffffffffff
test rax, rax
je 0x1402100f7
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rdi + 8], r12d
mov qword [rdi + 0x10], rbp
mov word [rdi + 0x18], bp
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x28], rbp
jmp 0x1402100fa
mov rdi, rbp
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140052e98
nop
mov r9, qword [rsp + 0x28]
test r9, r9
je 0x1402101ea
test rsi, rsi
jne 0x14021011f
mov ecx, ebp
jmp 0x140210130
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rsi
mov rcx, r9
call fcn.14000c9f8
mov r9d, 1
mov r8d, 0x104
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x38]
call fcn.14000bd14
mov rcx, qword [rax + 8]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov eax, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
cmp eax, r12d
jne 0x140210186
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14021017d
mov eax, ebp
jmp 0x14021018a
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402101df
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x1402101df
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], bp
mov rax, qword [rbx + 0x28]
mov rcx, qword [rax + 0x80]
mov edx, dword [rcx + 0x28]
mov rax, qword [rsp + 0x28]
mov dword [rax + 8], edx
lea rax, [rbx - 8]
neg rax
sbb rcx, rcx
and rcx, rbx
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
call fcn.1400726b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.1401139c8
jmp 0x1402101ea
mov ecx, 0x80070057
call fcn.14000cbb8
nop
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x140210220
mov eax, r12d
lock xadd dword [rdi + 8], eax
add eax, r12d
jne 0x140210220
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r12d
lock xadd dword [rdi + 0xc], eax
add eax, r12d
jne 0x140210220
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x140210270
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x20]
cmp byte [rax + 1], 0
jne 0x14021040f
mov rdx, qword [rdx]
test rdx, rdx
je 0x14021040f
mov rdx, qword [rdx + 0x20]
call fcn.14020ed90
test al, al
je 0x1402103f9
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x1402103f9
cmp qword [rax + 0x80], 0
je 0x1402103f9
mov ecx, 0x30
call fcn.1400be454
mov rbx, rax
test rax, rax
je 0x14021031a
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
or dword [rbx + 8], 0xffffffff
and qword [rbx + 0x10], 0
mov word [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
jmp 0x14021031c
xor ebx, ebx
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140052e98
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1402103cf
mov rdx, qword [rsi]
add rdx, 0x20
call fcn.14000c244
mov r11, qword [rdi + 0x30]
mov rax, qword [r11 + 0x80]
mov ecx, dword [rax + 0x28]
mov rax, qword [rsp + 0x28]
mov dword [rax + 8], ecx
lea rcx, [rdi + 8]
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x80]
cmp byte [rcx + 0x26], 0
je 0x14021038e
call fcn.1400726b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.1401139c8
test eax, eax
jne 0x1402103c4
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x80]
cmp byte [rcx + 0x27], 0
je 0x1402103b5
call fcn.1400726b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.140111718
test eax, eax
jne 0x1402103c4
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1402231d8
mov rcx, qword [rsi]
test eax, eax
sete al
mov byte [rcx + 0x70], al
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14021040f
lock dec dword [rbx + 8]
jne 0x14021040f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x14021040f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x14021040f
mov rbx, qword [rsi]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
sete al
mov byte [rbx + 0x70], al
mov rax, qword [rdi + 0x20]
cmp byte [rax + 1], 0
sete al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140210430
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rdx
mov rbx, rcx
call qword [rax + 0x58]
lea rcx, [rbx - 8]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140210270
Function at 0x1402105bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov r12, rdx
mov rbx, rcx
xor edi, edi
cmp dword [rcx + 0x10], edi
jbe 0x140210742
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x50], rax
mov r8d, dword [rbx + 0x10]
lea rdx, [0x140366e98]
lea rcx, [rbp + 0x50]
call fcn.14000d9c8
lea r8, [0x140366e90]
mov rdx, qword [rbp + 0x50]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
or r14, 0xffffffffffffffff
test rax, rax
je 0x14021071a
mov rdx, rax
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
mov rdx, rsi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14021071a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov r8d, r13d
lea rcx, [rbp + 0x58]
call fcn.140075df0
nop
mov qword [rbp + 0x40], r14
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 0x40000000
mov rdx, r12
lea rcx, [rbp + 0x40]
call fcn.140021fb8
test eax, eax
je 0x1402106dd
mov r8b, 1
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x40]
call fcn.14001fbc0
test eax, eax
jne 0x1402106b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rbp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp rbx, r14
je 0x1402106e9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
mov qword [rbp + 0x40], rbx
jmp 0x1402106e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rbp + 0x40]
cmp rbx, r14
je 0x1402106f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140210722
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140210722
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140210742
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140210afc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
test rdx, 0xffffffffffff0000
jne 0x140210be1
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rbx, rcx
movzx esi, dx
cmp dword [rcx + 0x10], esi
je 0x140210bcd
lea r8, [0x140366e90]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140210bcd
mov rdx, rax
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rdx, rdi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140210bcd
mov dword [rbx + 0x10], esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov r8d, ebp
lea rcx, [rsp + 0x58]
call fcn.140075df0
nop
lea rax, [rbx + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034fb84]
mov rcx, qword [rsp + 0x58]
call fcn.1402e4560
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140210bcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140210f3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
lea rdx, [0x140330de8]
mov rcx, rsi
call fcn.1400bedf4
test eax, eax
je 0x140210fa8
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
mov ecx, edi
setne bl
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test ebx, ebx
je 0x140210fa8
mov r8, rsi
mov rdx, rbp
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x140210fad
mov eax, 2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14021100c
Capabilities:
Get token privileges

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov esi, r15d
mov dword [rbp + 0x40], r15d
lea rax, [rbp + 0x40]
mov qword [r11 - 0x78], rax
xor r9d, r9d
xor r8d, r8d
lea r12d, [r15 + 3]
mov edx, r12d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov qword [rbp + 0x58], r15
mov edx, dword [rbp + 0x40]
lea rcx, [rbp + 0x58]
call fcn.140063c00
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x40]
mov rbx, qword [rbp + 0x58]
mov r8, rbx
mov edx, r12d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14021109c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1402111d6
mov edi, r15d
cmp dword [rbx], r15d
jbe 0x1402111d6
mov dword [rbp + 0x50], 0x3e8
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
mov r9d, 1
mov r8d, dword [rbp + 0x50]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14000bd14
mov r8, qword [rax + 8]
mov eax, edi
lea rcx, [rax + rax*2]
lea rdx, [rbx + rcx*4 + 4]
lea r9, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
sete r13b
mov eax, dword [rbp - 0x10]
mov r12, qword [rbp - 0x20]
cmp eax, 0xffffffff
jne 0x140211123
mov rcx, qword [r12]
test rcx, rcx
jne 0x14021111a
mov eax, r15d
jmp 0x14021112b
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402111cb
mov rcx, qword [r12]
cmp eax, dword [rcx - 0xc]
jg 0x1402111cb
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r12]
mov word [rax + rcx*2], r15w
test r13b, r13b
je 0x140211156
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14021116a
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rbp - 0x30]
call fcn.1400bedf4
test eax, eax
je 0x140211199
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140211189
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc edi
mov rbx, qword [rbp + 0x58]
cmp edi, dword [rbx]
jb 0x1402110a8
jmp 0x1402111d6
mov eax, edi
lea rax, [rax + rax*2 + 3]
mov ecx, dword [rbx + rax*4]
mov dword [r14], ecx
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402111c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x58]
jmp 0x1402111d6
mov ecx, 0x80070057
call fcn.14000cbb8
nop
mov rcx, rbx
call fcn.1400bee7c
mov eax, esi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402114bc
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rsi, r8
mov rbx, rcx
mov word [rcx + 0x18], 0
mov byte [rcx + 0x1a], r9b
test rdx, rdx
jne 0x1402114ee
xor ecx, ecx
jmp 0x140211500
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbx + 0x20]
call fcn.14000c9f8
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14000cb18
nop
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14000f884
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140211547
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x40]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140211567
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1402135b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x48], edi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea r8d, [rdi + 1]
mov dword [rsp + 0x48], r8d
sub r8d, dword [rax - 8]
mov eax, dword [rax - 0xc]
mov edx, 0x106
sub eax, edx
or eax, r8d
jge 0x14021360d
mov rcx, rbx
call fcn.14000c998
mov edx, 0x104
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140213627
mov eax, edi
jmp 0x140213634
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14021364e
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14021364e
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], di
mov rax, rbx
jmp 0x140213659
mov ecx, 0x80070057
call fcn.14000cbb8
nop
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140215934
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov r12b, dl
mov rsi, rcx
xor edi, edi
and qword [rbp + 0x38], rdi
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x140328e20]
xor edx, edx
lea r8d, [rdi + 1]
lea rcx, [0x140328e30]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov rcx, qword [rbp + 0x38]
test eax, eax
js 0x140215aa5
test rcx, rcx
je 0x140215aa1
and qword [rbp - 0x20], rdi
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1402159ae
and qword [rbp - 0x10], rcx
jmp 0x1402159c8
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x1402159c8
mov ecx, 0x8007000e
call fcn.14000cbb8
nop
lea rdx, str..job
lea rcx, [rbp - 0x10]
call fcn.14007586c
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea r9, [rbp - 0x20]
lea r8, [0x140328e40]
mov rdx, qword [rbp - 0x10]
call qword [rax + 0x30]
mov ebx, eax
test eax, eax
js 0x140215a83
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140215a83
mov rax, qword [rcx]
lea rdx, [rbp + 0x30]
call qword [rax + 0xe8]
mov ebx, eax
test eax, eax
js 0x140215a83
mov edx, dword [rbp + 0x30]
test r12b, r12b
je 0x140215a24
and edx, 0xfffffffb
jmp 0x140215a27
or edx, 4
mov dword [rbp + 0x30], edx
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + 0xe0]
mov ebx, eax
test eax, eax
js 0x140215a83
and qword [rbp - 0x18], 0
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
lea r8, [rbp - 0x18]
lea rdx, [0x1403291b0]
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp - 0x18]
test eax, eax
js 0x140215a77
test rcx, rcx
je 0x140215a77
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 1]
call qword [rax + 0x30]
mov ebx, eax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140215a83
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140215a9d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x38]
test ebx, ebx
jns 0x140215ab1
mov edi, 6
test ebx, ebx
jns 0x140215ab1
movzx edi, bx
test rcx, rcx
je 0x140215abc
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rbp
ret
Function at 0x14021f2f8
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, VarUI4FromDisp
mov edi, 0x1f4
call fcn.1400c7360
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r9d, 1
cmp dword [rsp + 0x50], r9d
jne 0x14021f3aa
mov rdx, qword [rbx + 8]
or qword [rsp + 0x30], 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov r8d, 0x80000000
mov dword [rsp + 0x20], 3
call fcn.140021fb8
test eax, eax
je 0x14021f394
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x14021f3aa
mov rcx, rbx
jmp 0x14021f3a4
mov rcx, qword [rsp + 0x30]
mov edi, 0xea60
cmp rcx, 0xffffffffffffffff
je 0x14021f3aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret

Function at 0x14021f7b8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor ebp, ebp
mov r14, rcx
mov edi, 0x1f4
lea ecx, [rdi + 2]
lea eax, [rbp + 2]
mov r12, r9
mov r13, r8
mov dword [rsp + 0x60], ebp
mul rcx
lea rcx, [rbp - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.1400b9290
mov rcx, qword [r14 + 8]
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov r9, rax
mov rdx, r12
mov rcx, r13
mov rbx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or rsi, 0xffffffffffffffff
lea ecx, [rdi - 2]
cmp eax, ecx
je 0x14021f839
lea ecx, [rdi - 1]
cmp eax, ecx
jne 0x14021f88d
cmp ebp, 0xa
jge 0x14021f88d
mov rcx, rbx
call fcn.1400bee7c
add edi, edi
mov eax, 2
mov ecx, edi
add rcx, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400b9290
mov r8, qword [rsp + 0x80]
mov rdx, r12
mov rbx, rax
mov rax, qword [r14 + 8]
mov rcx, r13
mov qword [rsp + 0x28], rax
mov r9, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
inc ebp
jmp 0x14021f82b
mov rsi, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, rsi
call fcn.14000cb18
mov rcx, rbx
call fcn.1400bee7c
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rax, rsi
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14021f8c8
Capabilities:
Read .ini file

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov r12, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14021f2f8
mov edi, eax
xor r14d, r14d
test eax, eax
je 0x14021fa05
lea rcx, [rdi + 2]
lea eax, [r14 + 2]
mul rcx
lea r15, [r14 - 1]
cmovo rax, r15
mov rcx, rax
call fcn.1400b9290
mov rsi, rax
mov r8, qword [rbx + 8]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov r13d, r14d
lea ecx, [rdi - 2]
cmp eax, ecx
je 0x14021f947
lea ecx, [rdi - 1]
cmp eax, ecx
jne 0x14021f988
cmp r13d, 0xa
jge 0x14021f988
mov rcx, rsi
call fcn.1400bee7c
add edi, edi
mov ecx, edi
add rcx, 2
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400b9290
mov rsi, rax
mov r8, qword [rbx + 8]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
inc r13d
jmp 0x14021f939
mov rbx, rsi
cmp word [rsi], r14w
je 0x14021f9fd
test rbp, rbp
je 0x14021f9a3
mov rax, qword [rbp]
mov rdx, rbx
mov rcx, rbp
call qword [rax + 0x38]
test r12, r12
je 0x14021f9e5
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14000cb18
nop
lea rdx, [rsp + 0x78]
mov rcx, r12
call fcn.140038190
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14021f9e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], r14w
jne 0x14021f991
mov rcx, rsi
call fcn.1400bee7c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14021fa28
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r12, r8
mov r14, rdx
mov rbx, rcx
call fcn.14021f2f8
xor r15d, r15d
mov edi, eax
test eax, eax
je 0x14021fb47
lea rcx, [rdi + 2]
lea eax, [r15 + 2]
mul rcx
lea rcx, [r15 - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.1400b9290
mov r9, qword [rbx + 8]
mov r8d, edi
mov rdx, rax
mov rcx, r14
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov r13d, r15d
or r15, 0xffffffffffffffff
lea ecx, [rdi - 2]
cmp eax, ecx
je 0x14021faa8
lea ecx, [rdi - 1]
cmp eax, ecx
jne 0x14021faed
cmp r13d, 0xa
jge 0x14021faed
mov rcx, rsi
call fcn.1400bee7c
add edi, edi
mov eax, 2
mov ecx, edi
add rcx, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400b9290
mov r9, qword [rbx + 8]
mov r8d, edi
mov rdx, rax
mov rcx, r14
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
inc r13d
jmp 0x14021fa9a
xor r15d, r15d
mov qword [rsp + 0x20], rsi
mov rbx, rsi
cmp word [rsi], r15w
je 0x14021fb3f
or rsi, 0xffffffffffffffff
test r12, r12
je 0x14021fb12
mov rdx, rbx
mov rcx, r12
call fcn.1402e4170
test rbp, rbp
je 0x14021fb22
mov rdx, rbx
mov rcx, rbp
call fcn.1402e40e0
xor eax, eax
mov rdi, rbx
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], r15w
jne 0x14021fb02
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
call fcn.1400bee7c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r9d, r9d
jmp 0x14021fa28