joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004aa80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1401a7008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0x104
lea rdx, [rsp + 0x30]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov qword [rbx], rdi
lea rax, [rsp + 0x30]
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
inc r8
cmp byte [rax + r8], dil
jne 0x14004aad7
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400039e0
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005f260
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x14004ab20
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a7e20]
mov ecx, 1
mov dword [rax + 0x130], 0
mov byte [rax + 0x134], 0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004ab5a
mov rax, qword [0x1401a7e20]
mov byte [rax + 0x130], 1
add rsp, 0x28
ret
Function at 0x14005ffec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140060036
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140060036
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140060036
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140060036
cmp dword [rcx + 0x84], 0xe
jbe 0x140060036
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140060038
xor al, al
add rsp, 0x28
ret
Function at 0x180001040
Capabilities:
Encrypt data using blowfish

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1800c6d00]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [0x1800a5748]
mov esi, 0x38
mov qword [rcx], rax
cmp r8, rsi
mov eax, dword [r9]
mov rbx, rcx
mov dword [rcx + 8], eax
cmovbe rsi, r8
mov eax, dword [r9 + 4]
mov r8, rsi
mov dword [rcx + 0xc], eax
mov eax, dword [r9]
mov dword [rcx + 0x10], eax
mov eax, dword [r9 + 4]
mov dword [rcx + 0x14], eax
lea rcx, [rsp + 0x28]
call fcn.1800a1e50
movaps xmm0, xmmword [0x1800a46f0]
lea rbp, [rbx + 0x18]
movups xmmword [rbp], xmm0
lea rcx, [rbx + 0x60]
mov r8d, 0x1000
movaps xmm1, xmmword [0x1800a4700]
lea rdx, [0x1800a4740]
movups xmmword [rbp + 0x10], xmm1
movaps xmm0, xmmword [0x1800a4710]
movups xmmword [rbp + 0x20], xmm0
movaps xmm1, xmmword [0x1800a4720]
movups xmmword [rbp + 0x30], xmm1
movsd xmm0, qword [0x1800a4730]
movsd qword [rbp + 0x40], xmm0
call fcn.1800a1e50
xor edi, edi
lea r9, [rsp + 0x28]
mov r10d, edi
mov r14d, 0x12
nop dword [rax]
mov eax, edi
mov r11d, 4
nop dword [rax + rax]
movzx ecx, byte [r9]
lea r8d, [r10 + 1]
inc r9
shl eax, 8
or eax, ecx
mov edx, r8d
cmp rdx, rsi
lea rcx, [rsp + 0x28]
mov r10d, edi
cmovne rcx, r9
cmovne r10d, r8d
mov r9, rcx
sub r11d, 1
jne 0x180001110
xor dword [rbp], eax
add rbp, 4
sub r14, 1
jne 0x180001100
mov qword [rsp + 0x20], rdi
mov esi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180001ce0
mov eax, dword [rsp + 0x20]
mov ecx, esi
inc esi
mov dword [rbx + rcx*4 + 0x18], eax
mov eax, dword [rsp + 0x24]
mov dword [rbx + rsi*4 + 0x18], eax
inc esi
cmp esi, 0x12
jb 0x180001153
mov rbp, rdi
lea rsi, [rbx + 0x64]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180001ce0
mov eax, dword [rsp + 0x20]
add rbp, 2
mov dword [rsi - 4], eax
lea rsi, [rsi + 8]
mov eax, dword [rsp + 0x24]
mov dword [rsi - 8], eax
cmp rbp, 0x100
jl 0x180001182
mov rbp, rdi
lea rsi, [rbx + 0x464]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180001ce0
mov eax, dword [rsp + 0x20]
add rbp, 2
mov dword [rsi - 4], eax
lea rsi, [rsi + 8]
mov eax, dword [rsp + 0x24]
mov dword [rsi - 8], eax
cmp rbp, 0x100
jl 0x1800011c0
mov rbp, rdi
lea rsi, [rbx + 0x860]
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180001ce0
mov eax, dword [rsp + 0x20]
add rbp, 2
mov dword [rsi], eax
lea rsi, [rsi + 8]
mov eax, dword [rsp + 0x24]
mov dword [rsi - 4], eax
cmp rbp, 0x100
jl 0x180001200
lea rsi, [rbx + 0xc60]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180001ce0
mov ecx, dword [rsp + 0x20]
add rdi, 2
mov dword [rsi], ecx
lea rsi, [rsi + 8]
mov ecx, dword [rsp + 0x24]
mov dword [rsi - 4], ecx
cmp rdi, 0x100
jl 0x180001232
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180032180
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800043e0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
xor edx, edx
mov rbp, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test eax, eax
je 0x180004481
lea rcx, [rsi + 0x1310]
mov qword [rsp + 0x40], rdi
call fcn.1800429e8
mov rdi, rax
test rax, rax
je 0x18000446f
lea r9, [rax + 0x1308]
mov qword [rsp + 0x30], rbx
mov r8d, esi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoA
lea r9, [rsp + 0x38]
mov r8, rdi
lea rdx, [0x1800a5c10]
lea rcx, [rdi + 0x1308]
call sub.VERSION.dll_VerQueryValueA
mov rbx, qword [rsp + 0x30]
test eax, eax
je 0x180004467
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rcx, rdi
call fcn.1800429d4
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rbp, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180004610
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x2a8
mov rax, qword [0x1800c6d00]
xor rax, rsp
mov qword [rsp + 0x290], rax
cmp qword [0x1800c4e38], 0xffffffffffffffff
je 0x18000472d
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x2a0], rbx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x6a]
lea rcx, [0x1800a5cc0]
movzx edx, word [rsp + 0x76]
lea rbx, [0x1800a5de4]
movzx r8d, word [rsp + 0x74]
movzx r9d, word [rsp + 0x72]
movzx r11d, word [rsp + 0x68]
lea rcx, [rcx + rax*8]
movzx eax, word [rsp + 0x6e]
add rcx, 0xfffffffffffffff8
movzx r10d, word [rsp + 0x70]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], r11d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], edx
mov edx, 0x104
mov dword [rsp + 0x30], r8d
lea r8, str.___s:__02u:_02u:_02u._03u__2u._s._u_s
mov dword [rsp + 0x28], r9d
lea r9, [0x1800a5de8]
mov dword [rsp + 0x20], r10d
call fcn.1800045b0
mov rbx, qword [rsp + 0x2a0]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800046e4
mov rcx, qword [0x1800c4e38]
lea r9, [rsp + 0x60]
add r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1800c4e38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1800c4e38], 0xffffffffffffffff
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180032180
add rsp, 0x2a8
ret
Function at 0x180004b40
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1800c6d00]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x1800c94e0], 0
mov rbx, rdx
jne 0x180004bcc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, rbx
lea r8, str._s__08X
lea rcx, [rsp + 0x30]
mov dword [0x1800c94e8], eax
mov edx, 0x104
mov dword [rsp + 0x20], eax
call fcn.1800045b0
lea r8, [rsp + 0x30]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x180004bcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180004bc3
mov qword [0x1800c94e0], rbx
xor eax, eax
jmp 0x180004bd1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180032180
add rsp, 0x250
pop rbx
ret

Function at 0x180005210
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
mov rdi, rdx
movsxd rdx, dword [r8]
mov rbx, r8
mov rsi, rcx
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx]
lea r8, str._S_d
call fcn.180004550
mov r9, qword [rsi]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x180005250
inc eax
mov ecx, eax
add rcx, r9
mov qword [rsi], rcx
add dword [rdi], eax
sub dword [rbx], eax
cmp dword [rbx], 5
jge 0x1800052a9
lea rcx, str._Error_Space_infMWrInt1W_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x1800c94f8], 0
jne 0x1800052a9
mov r9d, 0x10
lea r8, str.Fatal_Error__SCANSUB_
lea rdx, str._Error_Space_infMWrInt1W_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x1800c94f8], 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180005ad0
Capabilities:
Identify system language via api

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x270
mov rax, qword [0x1800c6d00]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp dword [0x1800c9b38], 0
lea rbp, [0x1800c9520]
mov ebx, edx
mov rsi, rcx
jne 0x180005b67
mov r8d, 0x104
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
lea r9, [0x1800c9730]
mov qword [rsp + 0x40], rax
lea rdx, [0x1800c9720]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], 0x100
mov r8d, 3
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0x100
call fcn.180078fe0
mov dword [0x1800c9b38], 1
test ebx, ebx
jns 0x180005b7b
jmp 0x180005d46
test ebx, ebx
js 0x180005d46
cmp dword [0x1800c9510], ebx
je 0x180005d46
mov ecx, ebx
mov qword [rsp + 0x2a0], rdi
mov dword [0x1800c9510], ebx
call qword [0x1800c55f8]
test ebx, ebx
je 0x180005ba7
mov edx, ebx
mov rcx, rsi
call fcn.180006080
mov rdi, rax
test rax, rax
jne 0x180005c24
lea rax, [0x1800a60a0]
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [0x1800c9730]
lea r8, [0x1800c9720]
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0x50]
call fcn.1800780a4
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.180005eb0
mov rdi, rax
test rax, rax
jne 0x180005c24
test ebx, ebx
jne 0x180005c07
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edx, ax
mov rcx, rsi
call fcn.180006080
mov rdi, rax
test rax, rax
jne 0x180005c24
mov rcx, qword [0x1800cc980]
lea r8, str._Cant_load_Language_Resource__Lng0x_02X_
mov r9d, ebx
mov edx, 2
call fcn.1800073b0
jmp 0x180005c50
mov rcx, qword [0x1800c9508]
mov eax, dword [0x1800c9514]
mov qword [0x1800c9500], rdi
mov dword [0x1800c9518], eax
test rcx, rcx
je 0x180005c49
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1800c9508], rdi
test ebx, ebx
je 0x180005c63
mov ecx, ebx
call fcn.180005d80
test eax, eax
jne 0x180005cf8
lea rdi, [0x1800a60e8]
mov edx, 0x104
mov qword [rsp + 0x28], rdi
lea r9, [0x1800c9730]
lea r8, [0x1800c9720]
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0x50]
call fcn.1800780a4
lea rcx, [rsp + 0x50]
call fcn.18000c940
test eax, eax
je 0x180005ccf
lea r8, [rsp + 0x50]
mov edx, 0x104
lea rcx, [0x1800c9930]
call fcn.1800423bc
mov rdx, rdi
mov rcx, rdi
call fcn.180077a14
neg eax
sbb ecx, ecx
add ecx, 2
mov dword [0x1800c951c], ecx
jmp 0x180005cfe
test ebx, ebx
jne 0x180005ce5
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
call fcn.180005d80
test eax, eax
jne 0x180005cf8
cmp ebx, 9
je 0x180005d23
mov ecx, 9
call fcn.180005d80
test eax, eax
je 0x180005d23
mov ecx, dword [0x1800c951c]
mov dword [rsp + 0x20], ecx
lea r9, [0x1800c9930]
mov rcx, qword [0x1800cc980]
lea r8, str.Using_Help_File___S___d
mov edx, 8
call fcn.1800073b0
jmp 0x180005d3e
mov rcx, qword [0x1800cc980]
lea r8, str._Cant_load_Help_File__Lng0x_02X_
mov r9d, ebx
mov edx, 2
call fcn.1800073b0
mov rdi, qword [rsp + 0x2a0]
mov eax, dword [0x1800c9518]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180032180
add rsp, 0x270
pop rsi
pop rbp
pop rbx
ret
Function at 0x180005eb0
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0xb0
mov rax, qword [0x1800c6d00]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r15, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x18000605a
mov qword [rsp + 0xa8], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0xa0], r14
mov rcx, rdi
mov qword [rsp + 0xe0], rbp
xor r14d, r14d
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
lea ecx, [rsi - 1]
cmp ecx, 0x752e
ja 0x180006037
mov ecx, esi
call fcn.1800429e8
mov rbp, rax
test rax, rax
je 0x180006037
mov r9, rax
mov qword [rsp + 0x30], r14
mov r8d, esi
xor edx, edx
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x3c]
mov rcx, rbp
lea r8, [rsp + 0x30]
lea rdx, str.VarFileInfoTranslation
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x180006025
mov r9d, 0x13
lea r8, [rsp + 0x40]
mov edx, 0x7d00
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x13
lea r8, [rsp + 0x68]
mov edx, 0x7d00
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x68]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180005fc4
add rax, 2
test ecx, ecx
jne 0x180005fb0
mov r9, rdi
test edx, edx
jne 0x180005ff9
mov rax, qword [rsp + 0x30]
lea r8, str.Using_RC_File___S_
mov edx, 8
mov r14d, 1
movzx ecx, word [rax]
mov dword [0x1800c9514], ecx
mov rcx, qword [0x1800cc980]
call fcn.1800073b0
jmp 0x180006025
mov rcx, qword [0x1800cc980]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, str._Language_RC___S___ID_S__not_linked___S_required_
lea rax, [rsp + 0x68]
mov edx, 2
mov qword [rsp + 0x20], rax
call fcn.1800073b0
mov rcx, rbp
call fcn.1800429d4
test r14d, r14d
je 0x180006037
mov rax, rbx
jmp 0x180006042
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbp, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180032180
add rsp, 0xb0
pop r15
pop rdi
pop rbx
ret
Function at 0x180007490
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rdx + 0x194], 2
mov rsi, rcx
mov rbx, 0xffffffffffffffff
jne 0x1800074e1
lea rdi, [rdx + 0x198]
mov dword [rsp + 0x28], 0x7d0
xor edx, edx
mov qword [rsp + 0x20], rdi
mov r9d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1800074d3
add ebx, ebx
jmp 0x1800074ee
mov rdi, r8
inc rbx
cmp byte [r8 + rbx], 0
jne 0x1800074e4
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000b140
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea r8, str.ReadParams:___S____S__Profyle_d
mov rcx, qword [0x1800cc980]
mov r9, rdx
mov edx, 2
call fcn.1800073b0
test ebx, ebx
je 0x18000b1e0
mov qword [rsp + 0x28], rdi
lea r9, [0x1800cab90]
lea r8, [0x1800a5b48]
mov dword [rsp + 0x20], 0x40
lea rdx, str.Name
lea rcx, [0x1800a6f34]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [0x1800cac10]
mov qword [rsp + 0x28], rdi
lea r8, [0x1800a5b48]
mov dword [rsp + 0x20], 0x20
lea rdx, [0x1800a6f3c]
lea rcx, [0x1800a6f34]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x18000b1f0
xor eax, eax
mov word [0x1800cab90], ax
mov word [0x1800cac10], ax
mov rax, qword [0x1800c5658]
mov rdx, rdi
mov rcx, rsi
call rax
mov rdx, rdi
mov rcx, rsi
mov ebx, eax
call qword [0x1800c5958]
mov r8, rdi
lea rcx, [0x1800cab90]
mov rdx, rsi
call fcn.18002fd10
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000c8f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000c90d
test al, 0x10
je 0x18000c90d
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x18000c920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x18000c940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x18000c990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000c9af
mov ecx, 1
and al, 0x11
cmp al, cl
cmove ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18000dc40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x40], rbx
mov rdi, rcx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x18000dc60
dec rbx
mov qword [rsp + 0x48], rbp
cmp rbx, 2
jbe 0x18000dc90
cmp word [rcx + rbx*2], 0x5c
lea rax, [rcx + rbx*2]
jne 0x18000dc90
mov r14, rbx
dec rbx
xor ebp, ebp
mov word [rax], bp
jmp 0x18000dc95
xor ebp, ebp
mov r14d, ebp
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15d, 0x5c
cmp eax, 0xffffffff
je 0x18000dcb6
test al, 0x10
je 0x18000dcb6
mov esi, 1
jmp 0x18000dd19
xor edx, edx
mov rcx, rdi
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18000dcce
mov esi, 1
jmp 0x18000dd19
cmp rbx, 2
jbe 0x18000dd19
movzx eax, word [rdi + rbx*2]
cmp ax, 0x3a
je 0x18000dd19
cmp ax, r15w
je 0x18000dcef
dec rbx
cmp rbx, 2
ja 0x18000dcd4
jmp 0x18000dd19
cmp rbx, 2
jbe 0x18000dd19
mov rcx, rdi
mov word [rdi + rbx*2], bp
call fcn.18000dc40
mov word [rdi + rbx*2], r15w
mov esi, eax
test eax, eax
je 0x18000dd19
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rbp, qword [rsp + 0x48]
mov eax, esi
mov rbx, qword [rsp + 0x40]
test r14, r14
je 0x18000dd2f
mov word [rdi + r14*2], r15w
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800276d0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1800c6d00]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebx, ebx
cmp dword [0x1800cc9c8], ebx
jne 0x180027905
cmp dword [0x1800cab44], ebx
xorps xmm0, xmm0
movdqu xmmword [0x1800cad6c], xmm0
mov qword [rsp + 0x188], rdi
mov dword [0x1800cc9c8], 1
mov dword [0x1800c6548], 0xffffffff
mov dword [0x1800c6540], 1
mov dword [0x1800c6544], 0xc8
mov dword [0x1800c6550], 0xffffffff
mov dword [0x1800c654c], 1
mov qword [0x1800cad7c], rbx
je 0x18002776b
mov dword [0x1800cad78], 1
mov dword [0x1800cad6c], 1
mov eax, dword [0x1800cad4c]
lea rdx, [0x1800c6570]
mov r8d, 0x104
mov dword [0x1800cad5c], eax
lea rcx, str.APPDATA
mov dword [0x1800cad58], ebx
mov dword [0x1800cad60], ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
lea rcx, [0x1800c6570]
mov qword [rsp + 0x28], rbx
mov r8d, 3
mov qword [rsp + 0x20], 0x100
call fcn.180078f10
lea rax, str..IMG
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, str._TWAIN_
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800c6570]
call fcn.180077f0c
lea r8, [0x1800c6570]
mov edx, 0x104
lea rcx, [0x1800ccdb0]
call fcn.180065ef0
mov eax, dword [0x1800cad48]
mov ecx, 1
mov dword [0x1800cad54], eax
mov dword [0x1800cad50], ebx
call fcn.18000a230
mov edi, eax
test eax, eax
je 0x1800278ed
mov r9, qword [0x1800c5818]
lea rcx, [0x1800aac34]
mov qword [rsp + 0x180], rsi
mov r8d, 0x3e7
mov dword [0x1800c6540], 1
mov eax, ebx
nop
cmp dword [rcx], 1
lea rsi, [0x1800aac30]
je 0x180027889
inc eax
add rcx, 8
cmp eax, 0x13
jb 0x180027870
jmp 0x18002788f
cdqe
mov r8d, dword [rsi + rax*8]
xor edx, edx
mov ecx, r8d
call r9
test eax, eax
jne 0x1800278cf
mov rax, qword [0x1800c5818]
mov edx, 0xffffffff
xor ecx, ecx
call rax
mov edx, eax
mov rcx, rsi
mov eax, ebx
cmp edx, dword [rcx]
je 0x1800278c3
inc eax
add rcx, 8
cmp eax, 0x13
jb 0x1800278b2
jmp 0x1800278c9
cdqe
mov ebx, dword [rsi + rax*8 + 4]
mov dword [0x1800c6540], ebx
mov rax, qword [0x1800c5810]
mov edx, 0xffffffff
xor ecx, ecx
call rax
mov rsi, qword [rsp + 0x180]
mov dword [0x1800c6544], eax
mov eax, dword [0x1800c6548]
mov dword [0x1800c6550], eax
mov eax, edi
mov rdi, qword [rsp + 0x188]
jmp 0x180027907
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180032180
add rsp, 0x170
pop rbx
ret
Function at 0x180029f90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1800c6d00]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov eax, dword [0x1800c667c]
lea r9, [0x1800c6680]
mov qword [rsp + 0x28], rcx
mov esi, r8d
mov rdi, rdx
mov dword [rsp + 0x20], eax
lea r8, str._sCUSTDATA__03u__s.bin
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.180004550
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002a05d
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1800cc980]
lea r9, [rsp + 0x50]
lea r8, str.Data_written_to_file___s_
mov edx, 0x20
call fcn.1800073b0
inc dword [0x1800c667c]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180032180
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002fd10
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call fcn.18002a080
mov r8d, dword [rsi + 0xc0]
lea rdx, [0x1800aaf10]
mov r9, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsi + 0xc4]
lea rdx, [0x1800aaf38]
mov r9, rbx
mov dword [rsi + 0xc0], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsi + 0xc8]
lea rdx, [0x1800aaf60]
mov r9, rbx
mov dword [rsi + 0xc4], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsi + 0xcc]
lea rdx, [0x1800aaf90]
mov r9, rbx
mov dword [rsi + 0xc8], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsi + 0xd4]
lea rdx, [0x1800aafb0]
mov r9, rbx
mov dword [rsi + 0xcc], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsi + 0xd8]
lea rdx, [0x1800aafe0]
mov r9, rbx
mov dword [rsi + 0xd4], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsi + 0xd0]
lea rdx, [0x1800ab010]
mov r9, rbx
mov dword [rsi + 0xd8], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsi + 0xdc]
lea rdx, [0x1800ab038]
mov r9, rbx
mov dword [rsi + 0xd0], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x30]
mov dword [rsi + 0xdc], eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret