joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14003d746
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14003d736
cmp byte [rax], cl
jne 0x14003d746
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14003d727
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14003d8a4
cmp byte [r8 + 1], dl
je 0x14003d8a4
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14003d782
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14003d7aa
sub dl, 0x61
cmp dl, 0x19
ja 0x14003d79c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14003d7aa
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14003d765
jmp 0x14003d7ad
inc r9
cmp r8, r9
jae 0x14003d7df
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14003d7d4
bt rdx, rax
jb 0x14003d7da
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14003d7c0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.1400028c0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14003d818
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14003d810
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14003d896
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14003d833
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14003d849
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14003d884
movsd xmm2, qword [0x140072c58]
cmp al, 0x39
ja 0x14003d884
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14003d860
cmp r9b, 0x2d
jne 0x14003d89f
xorps xmm1, xmmword [0x140072f80]
movaps xmm0, xmm1
jmp 0x14003d8a7
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14003d8a7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400662c0
add rsp, 0x90
pop rbx
ret
Function at 0x1400502c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005033d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140050334
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x140050360
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140050310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400662c0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14005033f

Function at 0x140050370
Capabilities:
Query service status

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x1400503ae
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400662c0
add rsp, 0x50
pop rdi
ret
mov r8d, 4
mov qword [rsp + 0x68], rsi
lea rdx, str.EasyAntiCheat_EOSSys
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1400503f4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400662c0
add rsp, 0x50
pop rdi
ret
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x60], rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
mov rbx, qword [rsp + 0x60]
je 0x1400503da
cmp dword [rsp + 0x24], 4
jne 0x1400503da
mov al, 1
jmp 0x1400503dc

Function at 0x140050510
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140050546
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
pop rbx
ret
Function at 0x140050550
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.Farlight84Launcher.exe
call fcn.1400502c0
mov ecx, 0xfffffff4
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
test ebx, ebx
je 0x140050623
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400505d0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400505b9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Failed_to_Clean..._n_Error_code:
jmp 0x1400505e5
mov edx, 0xc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140057c60
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140057e30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140055190
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400551b8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400551de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400551e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140055239
test ecx, ecx
jle 0x140055219
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140055239
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140055239
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140055260
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140055282
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140055298
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400552b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400552b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400552f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14005538e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14005532d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14005536e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14005538e
cmp rbx, rax
ja 0x140055340
test rbx, rbx
je 0x14005538e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400557c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400557ed
xor eax, eax
jmp 0x140055959
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140055827
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140055827
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140055959
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14005594c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005586a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140055895
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140055951
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140055904
sub eax, 1
je 0x140055904
cmp eax, 2
jne 0x14005594c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140055951
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140055932
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14005594c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140055951
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400662c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140057170
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140057243
cmp byte [rcx + 0x71], 0
je 0x140057243
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005723f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140057204
sub eax, 1
je 0x140057208
cmp eax, 2
jne 0x14005723f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400662c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140057236
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005723f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400571ec
xor al, al
jmp 0x1400571ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400662c0
add rsp, 0x60
pop rbx
ret

Function at 0x140066190
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140066214
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14006aa40]
cmp byte [rcx + rax], 0
je 0x140066214
dec r8
sub rdx, 1
jne 0x1400661fa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140067004
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006704e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006704e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006704e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006704e
cmp dword [rcx + 0x84], 0xe
jbe 0x14006704e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140067050
xor al, al
add rsp, 0x28
ret
Function at 0x1800010d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
xor ebx, ebx
movsxd rbp, edx
xor r11d, r11d
xor r10d, r10d
mov r14, r9
mov r15, r8
mov rdi, rcx
test edx, edx
jle 0x18000120c
mov rsi, rcx
lea r12, [0x18002c520]
neg rsi
mov rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x3d
jne 0x180001126
inc r11d
cmp r11d, 2
jg 0x180001179
cmp al, 0x7f
ja 0x180001179
movzx eax, al
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x180001179
cmp cl, 0x40
jae 0x180001141
test r11d, r11d
jne 0x180001179
inc rdx
inc ebx
inc r10d
lea rax, [rsi + rdx]
cmp rax, rbp
jl 0x180001116
test ebx, ebx
je 0x18000120c
lea eax, [rbx + rbx*2]
lea eax, [rax*2 + 7]
sar eax, 3
cmp dword [r9], eax
jge 0x180001183
mov dword [r9], eax
mov eax, 0xfffffff0
jmp 0x18000120e
mov eax, 0xffffffee
jmp 0x18000120e
xor r8d, r8d
xor r11d, r11d
mov r9d, 3
mov rax, r15
test r10d, r10d
jle 0x180001206
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rcx + r12]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r9d, ecx
inc r11d
mov ecx, r8d
mov r8d, edx
shl ecx, 6
or r8d, ecx
cmp r11d, 4
jne 0x1800011fb
xor r11d, r11d
test r9d, r9d
jle 0x1800011de
mov ecx, r8d
shr ecx, 0x10
mov byte [rax], cl
inc rax
cmp r9d, 1
jle 0x1800011ef
mov ecx, r8d
shr ecx, 8
mov byte [rax], cl
inc rax
cmp r9d, 2
jle 0x1800011fb
mov byte [rax], r8b
inc rax
dec r10d
inc rdi
test r10d, r10d
jg 0x1800011a0
sub eax, r15d
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x180001230
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x68], 0
xor eax, eax
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x18000126c
mov rdx, qword [rdx]
call fcn.180002750
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x180003890
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180042080]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov edi, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rcx
lea r9, [rcx + 0xb8]
cmp qword [r9 + 0x18], 8
jb 0x1800038df
mov r9, qword [r9]
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x180003a5b
mov qword [rsp + 0x50], 7
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
xor r8d, r8d
lea rdx, [0x18002c890]
lea rcx, [rsp + 0x38]
call fcn.180002e20
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.180013bf0
mov r8d, edi
lea rdx, [0x18002c738]
lea rcx, [rbp - 0x80]
call fcn.1800030a0
lea rax, [rbp - 0x80]
mov r9, r14
mov r8, rsi
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
cmp byte [rbx + 9], r15b
je 0x1800039b6
call fcn.180003750
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x1800039b4
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180003992
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180002f70
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180002980
nop
jmp 0x180003a07
call fcn.180003850
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180003a07
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1800039e5
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180002f70
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180002980
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x180003a24
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.180002f70
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180018b04
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180003a59
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180002f70
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.180010da0
add rsp, 0x898
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180003a80
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180042080]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor edi, edi
mov dword [rsp + 0x30], edi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.180013bf0
lea rax, [rbp + 0xb8]
cmp qword [rax + 0x18], 8
jb 0x180003aed
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x180003b26
mov rax, qword [rbx]
jmp 0x180003b29
mov rax, rbx
mov word [rax], di
cmp word [rsp + 0x70], di
je 0x180003b4a
lea rax, [rsp + 0x70]
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180003b40
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.180002e20
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x180003b6e
mov rax, qword [rbx]
jmp 0x180003b71
mov rax, rbx
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x180003b96
add rax, 2
test edx, edx
jne 0x180003b80
test r10d, r10d
jne 0x180003be8
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, r14
lea rdx, [rsp + 0x48]
mov rcx, rbp
cmp byte [rbp + 9], r10b
je 0x180003bbb
call fcn.180003750
jmp 0x180003bc0
call fcn.180003850
mov rdx, rax
mov rcx, rbx
call fcn.1800028d0
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180003be8
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.180002f70
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180010da0
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180004cb0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
mov rax, qword [0x180042080]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180013bf0
cmp qword [rdi + 0x50], 8
lea r8, [rdi + 0x38]
jb 0x180004cfe
mov r8, qword [r8]
lea r9, str.CfgPath
lea rdx, [0x18002c930]
lea rcx, [rsp + 0x40]
call fcn.1800030a0
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180004d2f
lea rcx, [rsp + 0x40]
call fcn.18000aa30
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.180013bf0
lea r9, str.Use.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x150]
call fcn.1800030a0
xor ebx, ebx
cmp word [rbp + 0x150], bx
jne 0x180004d72
mov r8d, ebx
jmp 0x180004d8a
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180004d80
lea rcx, [rdi + 0xb8]
lea rdx, [rbp + 0x150]
call fcn.180002e20
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.180013bf0
lea r9, str.UseCache.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x360]
call fcn.1800030a0
cmp word [rbp + 0x360], bx
jne 0x180004dde
mov r8, rbx
jmp 0x180004dfa
lea rax, [rbp + 0x360]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180004df0
lea rcx, [rdi + 0xd8]
lea rdx, [rbp + 0x360]
call fcn.180002e20
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x208
call fcn.180013bf0
lea rdx, str.CCYSPath
lea rcx, [rsp + 0x20]
call fcn.18000af50
cmp qword [rax + 0x18], 8
jb 0x180004e3c
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x18002c984]
lea rcx, [rbp + 0x570]
call fcn.1800030a0
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x180004e6f
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
inc r8
call fcn.180002f70
lea rcx, [rbp + 0x570]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180004e8c
lea rcx, [rbp + 0x570]
call fcn.18000aa30
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.180013bf0
lea r9, str.UseCache.ini
lea r8, [rbp + 0x570]
lea rdx, str._s_s
lea rcx, [rbp + 0x780]
call fcn.1800030a0
cmp word [rbp + 0x780], bx
je 0x180004edf
lea rax, [rbp + 0x780]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180004ed5
lea rcx, [rdi + 0xf8]
mov r8, rbx
lea rdx, [rbp + 0x780]
call fcn.180002e20
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.180010da0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret