joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001dc90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rdx, [0x14010a148]
lea rcx, [0x14010a168]
call fcn.140062f80
mov r8d, 0xa
mov edx, 0x139
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14001dcf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14010a170]
lea rcx, str._s___FindResource_API_fail._LastError_u._n
call fcn.140062f80
xor eax, eax
jmp 0x14001de37
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x14001dd2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14010a1c0]
lea rcx, str._s___SizeofResource_API_fail._LastError_u._n
call fcn.140062f80
xor eax, eax
jmp 0x14001de37
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14001dd6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14010a210]
lea rcx, str._s___LoadResource_API_fail._LastError_u._n
call fcn.140062f80
xor eax, eax
jmp 0x14001de37
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001dda7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14010a260]
lea rcx, str._s_LockResource_API_fail._LastError_u._n
call fcn.140062f80
xor eax, eax
jmp 0x14001de37
mov eax, dword [rsp + 0x28]
add eax, 1
mov ecx, eax
call fcn.140096bcc
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ddec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CLicenseDlg::kLoadBinaryData
lea rcx, str._s_Memory_Allocation_error._LastError_u._n
call fcn.140062f80
xor eax, eax
jmp 0x14001de37
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call fcn.1400c7b40
mov r11d, dword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov byte [rax + r11], 0
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.140001d20
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140096bc4
mov eax, 1
add rsp, 0x68
ret
Function at 0x14001e870
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140002bb0
nop
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x70], 0
je 0x14001e996
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x14001e996
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400016d0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x3c], 1
xor eax, eax
cmp eax, 1
je 0x14001e978
mov rcx, qword [rsp + 0x30]
call fcn.1400c7f08
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x38]
test eax, eax
jne 0x14001e8f9
jmp 0x14001e978
movzx eax, word [rsp + 0x38]
cmp eax, 0x2e
jne 0x14001e90d
mov dword [rsp + 0x3c], 1
jmp 0x14001e963
cmp dword [rsp + 0x3c], 0
je 0x14001e95b
movzx eax, word [rsp + 0x38]
cmp eax, 0x30
jne 0x14001e95b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call fcn.1400c7b40
jmp 0x14001e8d4
mov dword [rsp + 0x3c], 0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [rsp + 0x30], rax
jmp 0x14001e8d4
mov edx, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.1400032b0
lea rcx, [rsp + 0x20]
call fcn.1400018a0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x20]
call fcn.140003a70
mov eax, dword [rsp + 0x4c]
add rsp, 0x68
ret
Function at 0x140025070
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.1400c6930
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1400c6930
mov dword [rsp + 0xb0], 0x68
mov dword [rsp + 0xec], 1
mov eax, 0xa
mov word [rsp + 0xf0], ax
call fcn.140007560
mov dword [rax + 0x678], 0
mov r8, qword [rsp + 0x138]
lea rdx, [0x14010c830]
lea rcx, str._s___lpCommandLine____s__n
call fcn.140062f80
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x138]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140025154
xor eax, eax
jmp 0x1400252e4
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
cmp qword [rsp + 0x60], 0
jne 0x140025173
xor eax, eax
jmp 0x1400252e4
xor edx, edx
mov rcx, qword [rsp + 0x130]
call fcn.1400a152c
mov dword [rsp + 0x58], 1
xor eax, eax
cmp eax, 1
je 0x14002524c
mov dword [rsp + 0x20], 0x40
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov ecx, 1
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x1400251c8
jmp 0x14002524c
cmp dword [rsp + 0x54], 1
jne 0x140025234
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140025232
mov r8d, dword [rsp + 0x80]
lea rdx, [0x14010c870]
lea rcx, str._s___msg.message__d_._n
call fcn.140062f80
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [rsp + 0x80]
cmp dword [0x14017ab9c], eax
jne 0x140025230
jmp 0x140025232
jmp 0x1400251cf
jmp 0x140025236
jmp 0x14002524c
mov eax, dword [rsp + 0x80]
cmp dword [0x14017ab9c], eax
jne 0x140025247
jmp 0x14002524c
jmp 0x14002518a
mov edx, 1
mov rcx, qword [rsp + 0x130]
call fcn.1400a152c
mov dword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r8d, dword [rsp + 0x50]
lea rdx, str.CMainFrame::kCreateProcess
lea rcx, str._s___GetExitCodeProcess____u__n
call fcn.140062f80
cmp dword [rsp + 0x140], 0
jne 0x1400252c9
cmp dword [rsp + 0x50], 0
je 0x1400252c9
cmp dword [rsp + 0x50], 0x4c7
jne 0x1400252ba
call fcn.140007560
mov dword [rax + 0x678], 1
jmp 0x1400252c9
call fcn.140007560
mov dword [rax + 0x244], 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x128
ret
Function at 0x140047410
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov rax, qword [0x1401787a0]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x38]
call fcn.140003950
nop
mov r8d, 0x94
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1400c6930
mov dword [rsp + 0x60], 0x94
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400474cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x100], eax
mov r8d, dword [rsp + 0x100]
lea rdx, str.CRP_SETUPApp::kRebootExit
lea rcx, str._s___return_FALSE__1__LastError_u_GetVersionEx_returned_FALSE._n
call fcn.140062f80
mov dword [rsp + 0x104], 0
lea rcx, [rsp + 0x38]
call fcn.140003a70
mov eax, dword [rsp + 0x104]
jmp 0x140047578
cmp dword [rsp + 0x70], 2
jne 0x1400474dd
cmp dword [rsp + 0x64], 4
je 0x1400474eb
cmp dword [rsp + 0x70], 2
jne 0x14004754f
cmp dword [rsp + 0x64], 4
jbe 0x14004754f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x44]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [rsp + 0x108], 1
lea rcx, [rsp + 0x38]
call fcn.140003a70
mov eax, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.1400c6ac0
add rsp, 0x128
ret
Function at 0x140050bb0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x50]
call fcn.14000e990
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x34], eax
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
jne 0x140050c1f
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140050c6f
mov r8d, 1
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x140050c4b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140050c6f
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [rsp + 0x38], eax
xor r8d, r8d
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x38], eax
add rsp, 0x48
ret
Function at 0x140062f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
cmp dword [0x14017abc0], 0
je 0x1400630cf
call fcn.140097090
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140062fd1
mov ecx, 0x80004005
call fcn.140001a00
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x38], rbp
mov rsi, qword [rsp + 0x70]
test rsi, rsi
jne 0x140063002
mov ecx, 0x80070057
call fcn.140001a00
int3
mov rdx, rbp
mov rcx, rsi
call fcn.1400c65ec
movsxd rdi, eax
mov edx, 1
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, edi
or ecx, edx
jge 0x140063032
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.1400015a0
mov rbx, qword [rsp + 0x28]
lea eax, [rdi + 1]
movsxd rdx, eax
mov r9, rbp
mov r8, rsi
mov rcx, rbx
call fcn.1400c6770
test edi, edi
js 0x1400630c4
cmp edi, dword [rbx - 0xc]
jg 0x1400630c4
mov dword [rbx - 0x10], edi
mov byte [rdi + rbx], 0
mov qword [rsp + 0x20], 0
lea r8, [0x140126920]
mov rdx, qword [0x14017abc8]
lea rcx, [rsp + 0x20]
call fcn.1400c91a8
test eax, eax
jne 0x1400630a7
mov r9, qword [rsp + 0x20]
test r9, r9
je 0x1400630a7
movsxd r8, dword [rbx - 0x10]
lea edx, [rax + 1]
mov rcx, rbx
call fcn.1400c97b0
mov rcx, qword [rsp + 0x20]
call fcn.1400c8ff8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400630cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400630cf
mov ecx, 0x80070057
call fcn.140001a00
nop
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140063300
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, rcx
mov rcx, r9
mov rdi, r9
mov rbp, r8
mov r12, rdx
call fcn.140001350
mov ebx, 0x80
nop word [rax + rax]
mov rax, qword [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x14006335e
mov edx, ebx
mov rcx, rdi
call fcn.1400015a0
mov r9, qword [rdi]
lea r8, [0x14013fbf1]
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rcx, qword [rdi]
mov esi, eax
test rcx, rcx
jne 0x14006338b
xor eax, eax
jmp 0x14006339c
movsxd rdx, dword [rcx - 0xc]
call fcn.1400c6574
test eax, eax
js 0x14006342b
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14006342b
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], 0
mov rcx, qword [rdi]
lea rdx, [0x14013fbf1]
call fcn.1400c784c
test eax, eax
je 0x1400633f5
lea eax, [rsi + 2]
cmp ebx, eax
ja 0x1400633d7
sub ebx, 0xffffff80
jmp 0x140063340
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetPrivateProfile___return_FALSE__1__LastError_u_pstrString_is_empty._n
mov edx, eax
call fcn.1400631f0
lea rcx, str.__pszSection__s__n
mov rdx, r12
call fcn.1400631f0
lea rcx, str.__pszKey__s__n
mov rdx, rbp
call fcn.1400631f0
xor eax, eax
jmp 0x1400633dc
mov ecx, 0x80070057
call fcn.140001a00
int3

Function at 0x140063440
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, r9d
mov rsi, r8
mov rdi, rdx
mov r9, rcx
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov rbx, qword [rsp + 0x50]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetPrivateProfileInt___return_FALSE__1__LastError_u_pstrString_is_NOKEY._n
mov edx, eax
call fcn.140062f80
lea rcx, str.__pszSection__s__n
mov rdx, rdi
call fcn.140062f80
lea rcx, str.__pszKey__s__n
mov rdx, rsi
call fcn.140062f80
mov edx, dword [rbx]
lea rcx, str.__pUint__d__n
call fcn.140062f80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400634d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063525
test al, 1
je 0x140063525
and eax, 0xfffffffc
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x140063525
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kResetReadOnly___return_FALSE__1__LastError_u_SetFileAttributes_returned_FALSE._n
mov edx, eax
call fcn.140062f80
lea rcx, str.__strFileName__s__n
mov rdx, rbx
call fcn.140062f80
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400637c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063811
test al, 1
je 0x140063811
and eax, 0xfffffffc
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x140063811
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kResetReadOnly___return_FALSE__1__LastError_u_SetFileAttributes_returned_FALSE._n
mov edx, eax
call fcn.140062f80
lea rcx, str.__strFileName__s__n
mov rdx, rbx
call fcn.140062f80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test eax, eax
jne 0x140063848
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxDeleteFile___return___d___1__LastError_u_n
xor edx, edx
mov r8d, eax
call fcn.140062f80
lea rcx, str.__pstrFilePath__s__n
mov rdx, rbx
call fcn.140062f80
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140064240
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r13, rcx
mov rcx, r9
mov rbx, r9
mov rbp, r8
mov r12, rdx
call fcn.140001350
mov r14, qword [rsp + 0x70]
mov edi, 0x80
mov dword [r14], 1
nop word [rax + rax]
mov rax, qword [rbx]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x1400642ae
mov edx, edi
mov rcx, rbx
call fcn.1400015a0
mov r9, qword [rbx]
lea r8, [0x140127080]
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rcx, qword [rbx]
mov esi, eax
test rcx, rcx
jne 0x1400642db
xor eax, eax
jmp 0x1400642ec
movsxd rdx, dword [rcx - 0xc]
call fcn.1400c6574
test eax, eax
js 0x1400643f8
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400643f8
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov byte [rcx + rax], 0
mov rcx, qword [rbx]
lea rdx, [0x14013fbf1]
call fcn.1400c784c
test eax, eax
je 0x1400643c4
mov rcx, qword [rbx]
lea rdx, [0x140127080]
call fcn.1400c772c
test eax, eax
je 0x140064345
lea eax, [rsi + 2]
cmp edi, eax
ja 0x14006433e
sub edi, 0xffffff80
jmp 0x140064290
mov eax, 1
jmp 0x1400643a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetPrivateProfile___return_FALSE__2__LastError_u_pstrString_is_NOKEY._n
mov edx, eax
call fcn.1400631f0
lea rcx, str.__pszSection__s__n
mov rdx, r12
call fcn.1400631f0
lea rcx, str.__pszKey__s__n
mov rdx, rbp
call fcn.1400631f0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x14013fbf1]
lea rdx, [0x14013fbf1]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.1400017b0
mov dword [r14], 0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetPrivateProfile___return_FALSE__1__LastError_u_pstrString_is_empty._n
mov edx, eax
call fcn.1400631f0
lea rcx, str.__pszSection__s__n
mov rdx, r12
call fcn.1400631f0
lea rcx, str.__pszKey__s__n
mov rdx, rbp
call fcn.1400631f0
jmp 0x1400643a3
mov ecx, 0x80070057
call fcn.140001a00
int3
Function at 0x140064410
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1401787a0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x140064483
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetFullPath___return_FALSE__1__LastError_u_GetCurrentDirectory_returned_zero._n
mov edx, eax
call fcn.140062f80
lea rcx, str.__pszRootPath__s__n
mov rdx, rdi
call fcn.140062f80
lea rcx, str.__pszRelativePath__s__n
mov rdx, rsi
call fcn.140062f80
xor eax, eax
jmp 0x1400645cb
test rdi, rdi
je 0x1400644db
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1400644db
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1400644db
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetFullPath___return_FALSE__2__LastError_u_SetCurrentDirectory_returned_FALSE._n
mov edx, eax
call fcn.140062f80
lea rcx, str.__pszRootPath__s__n
mov rdx, rdi
call fcn.140062f80
lea rcx, str.__pszRelativePath__s__n
mov rdx, rsi
call fcn.140062f80
xor eax, eax
jmp 0x1400645cb
mov edx, 0x3a
mov rcx, rsi
mov qword [rsp + 0x178], rbx
call fcn.1400c94ec
mov rdi, rax
test rax, rax
je 0x140064545
lea rdx, [0x1401271a4]
mov rcx, rax
call fcn.1400c8078
mov rbx, rax
cmp rdi, rax
je 0x140064545
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetFullPath___return_FALSE__3__LastError_u_pszPathA_not_equal_pszPathB._n
mov edx, eax
call fcn.140062f80
lea rcx, str.__pszPathA__s__n
mov rdx, rdi
call fcn.140062f80
lea rcx, str.__pszPathB__s__n
mov rdx, rbx
call fcn.140062f80
xor eax, eax
jmp 0x1400645c3
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call fcn.1400c9b4c
mov rbx, rax
test rax, rax
jne 0x14006458e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetFullPath___return_FALSE__4__LastError_u_pszPathA_not_equal_pszPathB._n
mov edx, eax
call fcn.140062f80
lea rdx, [rsp + 0x20]
lea rcx, str.__szCurrentPath__s__n
call fcn.140062f80
xor eax, eax
jmp 0x1400645c3
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdx, rbx
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.1400017b0
mov rcx, rbx
call fcn.1400c9b0c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, 1
mov rbx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400c6ac0
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
Function at 0x140064b60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.140001350
xor edi, edi
nop dword [rax]
add edi, 0x104
mov ecx, edi
call fcn.140096bcc
mov rbx, rax
test rax, rax
je 0x140064c10
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140064be2
cmp edi, eax
jb 0x140064b80
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdx, rbx
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.1400017b0
mov rcx, rbx
call fcn.140096bc4
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetSystemDirectory___return_FALSE__2__LastError_u_n
mov edx, eax
call fcn.140062f80
mov rcx, rbx
call fcn.140096bc4
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CCommonFunction::kStdAfxGetSystemDirectory___return_FALSE__1__LastError_u_n
mov edx, eax
call fcn.140062f80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret