joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051190
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x60], 0x244
lea rax, [rsp + 0x270]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0
lea rcx, [rsp + 0x80]
call fcn.180060cf0
nop
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, 0xc8
rep stosb byte [rdi], al
mov dword [rsp + 0xd0], 0x244
lea rax, [rsp + 0x80]
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0xe0], 8
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0xf0], 0x1f0
lea rax, [rsp + 0x88]
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x100], 4
mov qword [rsp + 0x108], 0
mov dword [rsp + 0x110], 0x1f0
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x120], 4
mov qword [rsp + 0x128], 0
mov dword [rsp + 0x130], 0x1c4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x140], 0x14
mov qword [rsp + 0x148], 0
mov dword [rsp + 0x150], 0x1c4
lea rax, [rsp + 0x170]
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x160], 0xc8
mov qword [rsp + 0x168], 0
mov rax, qword [rsp + 0x268]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x268]
call qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 5
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x60]
lea rdx, str.SELECT_ID_TYPE_COUNTRY_CODE_PHONE__SELECT_GROUP_CONCAT_EXTENSION__FROM_PROFILE_PHONE_EXTENSION_WHERE_PHONE_IDID__AS_EXT_FROM_PROFILE_PHONE_WHERE_USER_ID__ORDER_BY_TYPE
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x50]
movzx eax, al
test eax, eax
jne 0x180051380
mov dword [rsp + 0x30], 0xfffffff9
lea rcx, [rsp + 0x80]
call fcn.180061e10
mov eax, dword [rsp + 0x30]
jmp 0x18005142c
mov rax, qword [rsp + 0x268]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x268]
call qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x58]
movzx eax, al
test eax, eax
je 0x1800513e9
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0xa8]
call fcn.180062130
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x278]
call fcn.180066e70
jmp 0x180051380
mov rax, qword [rsp + 0x268]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x268]
call qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x60]
mov dword [rsp + 0x34], 0
lea rcx, [rsp + 0x80]
call fcn.180061e10
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180098830
add rsp, 0x250
pop rdi
ret
Function at 0x180053650
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0x120], 0
jg 0x18005368a
xor al, al
jmp 0x180053847
mov qword [rsp + 0x88], 2
mov dword [rsp + 0x90], 0x244
lea rax, [rsp + 0x120]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], 8
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0x244
lea rax, [rsp + 0x88]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], 8
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd0], 0x244
lea rax, [rsp + 0x88]
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0xe0], 8
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x60], 0x1f0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
call qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, [rsp + 0x90]
lea rdx, str.SELECT_COUNT___FROM_PROFILE_GROUP_MEMBER_WHERE_USER_ID____AND_GROUP_ID__AND_USER_ID__
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x50]
movzx eax, al
test eax, eax
jne 0x1800537c6
xor al, al
jmp 0x180053847
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
call qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x58]
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
call qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x60]
cmp dword [rsp + 0x80], 0
jle 0x18005383a
mov dword [rsp + 0x30], 1
jmp 0x180053842
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.180098830
add rsp, 0x108
ret
Function at 0x180053c30
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0x118], 0
je 0x180053c6e
cmp qword [rsp + 0x120], 0
jg 0x180053c75
xor al, al
jmp 0x180053e39
lea rdx, [0x1800cf522]
lea rcx, [rsp + 0x88]
call fcn.18002ebb0
nop
mov dword [rsp + 0xb0], 0x244
lea rax, [rsp + 0x120]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], 8
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd0], 0x1c4
lea rcx, [rsp + 0x88]
call fcn.18000ca70
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x60], 0x1f0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
call qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0xb0]
lea rdx, str.SELECT_1_FROM_PROFILE_PASSWORD_WHERE_USER_ID__AND_PASSWORD__
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x50]
movzx eax, al
test eax, eax
jne 0x180053da2
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x88]
call fcn.180008410
movzx eax, byte [rsp + 0x30]
jmp 0x180053e39
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
call qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x58]
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
call qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x60]
cmp dword [rsp + 0x80], 1
jne 0x180053e16
mov dword [rsp + 0x34], 1
jmp 0x180053e1e
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0x88]
call fcn.180008410
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.180098830
add rsp, 0x108
ret
Function at 0x180053e60
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x60], 0x1f0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x88], 3
mov dword [rsp + 0x90], 0x244
lea rax, [rsp + 0x100]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], 8
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0x244
lea rax, [rsp + 0x88]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], 8
mov qword [rsp + 0xc8], 0
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf8]
call qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x90]
lea rdx, [0x1800cfcb0]
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x50]
movzx eax, al
test eax, eax
jne 0x180053f92
xor al, al
jmp 0x180054013
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf8]
call qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x58]
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf8]
call qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x60]
cmp dword [rsp + 0x80], 1
jne 0x180054006
mov dword [rsp + 0x30], 1
jmp 0x18005400e
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180098830
add rsp, 0xe8
ret
Function at 0x180057850
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x80], 0xfffffffe
mov dword [rsp + 0x60], 0x1f0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x40], 0x1f0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x60]
lea rdx, str.SELECT_STATUS_FROM_HOME_MODULE_LIST_WHERE_MODULE_ID_
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x30]
movzx eax, al
test eax, eax
jne 0x18005791b
mov eax, 0xfffffffe
jmp 0x18005795a
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x38]
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa0]
call qword [rax + 0x60]
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180098830
add rsp, 0x98
ret
Function at 0x180057ea0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xa0], 0
mov dword [rsp + 0x60], 0x1f0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 0x244
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], 8
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x80]
lea rdx, str.SELECT_IS_ROLE_FROM_PROFILE_MAIN_WHERE_ID_
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x50]
movzx eax, al
test eax, eax
jne 0x180057f8f
xor al, al
jmp 0x180058010
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x58]
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x60]
cmp dword [rsp + 0xa0], 1
jne 0x180058003
mov dword [rsp + 0x30], 1
jmp 0x18005800b
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180098830
add rsp, 0xb8
ret
Function at 0x180058030
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x98], 0
mov dword [rsp + 0x58], 0x1f0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x78], 0x244
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 8
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x78]
lea rdx, str.SELECT_TYPE_FROM_PROFILE_MAIN_WHERE_ID_
mov rcx, qword [rsp + 0x30]
call qword [rsp + 0x48]
movzx eax, al
test eax, eax
jne 0x180058116
xor eax, eax
jmp 0x18005817d
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x50], rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x50]
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x60]
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180098830
add rsp, 0xb8
ret
Function at 0x180058650
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x98], 0x244
lea rax, [rsp + 0x188]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 8
mov qword [rsp + 0xb0], 0
lea rcx, [rsp + 0xc0]
call fcn.180060780
mov dword [rsp + 0x100], 0x244
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x110], 8
mov qword [rsp + 0x118], 0
mov dword [rsp + 0x120], 0x1c4
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x128], rax
mov dword [rsp + 0x130], 0x32
mov qword [rsp + 0x138], 0
mov dword [rsp + 0x140], 0x1f4
lea rax, [rsp + 0xfa]
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x150], 2
mov qword [rsp + 0x158], 0
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x180]
call qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x28], 3
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x98]
lea rdx, str.SELECT_ID_EMAIL_VERIFIED_FROM_PROFILE_EMAIL_WHERE_USER_ID_
mov rcx, qword [rsp + 0x30]
call qword [rsp + 0x58]
movzx eax, al
test eax, eax
jne 0x1800587bc
mov eax, 0xfffffff9
jmp 0x18005891f
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x180]
call qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x60], rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x60]
movzx eax, al
test eax, eax
je 0x1800588f3
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x68], rax
xor edx, edx
mov rcx, qword [rsp + 0x190]
call qword [rsp + 0x68]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x70], rax
lea rdx, [0x1800cf7e4]
mov rcx, qword [rsp + 0x190]
call qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x78]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x80], rax
lea rdx, [0x1800cfc54]
mov rcx, qword [rsp + 0x190]
call qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x88]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rsp + 0x90], rax
xor edx, edx
mov rcx, qword [rsp + 0x190]
call qword [rsp + 0x90]
jmp 0x1800587bc
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x180]
call qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x60]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180098830
add rsp, 0x178
ret
Function at 0x180067000
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x180067055
lea rax, [0x1800d5e98]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.18006b740
test eax, eax
jne 0x180067053
lea rax, [0x1800d5ec8]
mov qword [rsp + 0x30], rax
jmp 0x18006707b
lea rax, [0x1800d5ef0]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.18006b740
test eax, eax
jne 0x18006707b
lea rax, [0x1800d5f28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add rsp, 0x48
ret

Function at 0x18006b740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x18006b766
cmp dword [rsp + 0x20], 0xffffffff
jne 0x18006b76a
xor eax, eax
jmp 0x18006b78b
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
jbe 0x18006b77f
mov dword [rsp + 0x24], 0
jmp 0x18006b787
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x18006b820
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax + 0x68], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret

Function at 0x18006dcc0
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1800f68a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x18006dd05
cmp qword [rsp + 0x58], 0
je 0x18006dd05
cmp dword [rsp + 0x60], 1
jae 0x18006dd09
xor eax, eax
jmp 0x18006dd3c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18006dd38
xor eax, eax
jmp 0x18006dd3c
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180098830
add rsp, 0x48
ret
Function at 0x18006e380
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x5be0cd19
ret

Function at 0x18008ed60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1800792a6
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x180079289
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x180079274
Function at 0x1800bba60
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800bba90
xor eax, eax
jmp 0x1800bbb53
mov rbp, rbx
cmp word [rax], si
je 0x1800bbab5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800bba9c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800bba98
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800b7650
movsxd r14, eax
test eax, eax
jne 0x1800bbaf3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800bba89
mov rcx, r14
call fcn.1800b5d70
mov rdi, rax
test rax, rax
jne 0x1800bbb0c
xor ecx, ecx
call fcn.1800b5ae8
jmp 0x1800bbae8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800b7650
test eax, eax
jne 0x1800bbb3d
mov rcx, rdi
call fcn.1800b5ae8
jmp 0x1800bbb47
xor ecx, ecx
call fcn.1800b5ae8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800bbb70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1800bbbf7
mov rsi, rbx
cmp word [rax], bp
je 0x1800bbbb6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1800bbba0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1800bbb9c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1800b5d70
mov rdi, rax
test rax, rax
je 0x1800bbbe4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.18009a890
mov rbp, rdi
xor ecx, ecx
call fcn.1800b5ae8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret