joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f0680
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
movdqa xmmword [rbp - 0x10], xmm6
mov qword [rcx + 0x40], 0
mov qword [rcx + 0x28], 0
mov dword [rcx + 0x3c], 0x20
movaps xmm0, xmmword [0x008a6950]
movups xmmword [rcx + 0x6c], xmm0
movdqa xmm0, xmmword [0x008a6960]
xor eax, eax
movdqa xmm1, xmmword [0x008a6970]
movdqa xmm2, xmmword [0x008a6980]
movdqa xmm3, xmmword [0x008a6990]
nop word cs:[rax + rax]
movdqa xmm4, xmm0
psrld xmm4, 1
movdqa xmm5, xmm0
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
movdqu xmmword [rcx + rax*4 + 0x90], xmm5
add rax, 4
paddd xmm0, xmm3
cmp rax, 0x100
jne 0x7f06e0
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x10
pop rbp
ret
Function at 0x7f1050
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movdqa xmmword [rbp - 0x10], xmm6
mov rbx, rcx
mov ecx, dword [rbx + 8]
cmp ecx, 0xffffffff
je 0x7f107c
cmp dword [rbx + 0x50], 0
jne 0x7f11b6
jmp 0x7f1167
mov eax, 0xfffffffe
sub eax, dword [rbx + 0x7c]
and eax, 0xfffffc00
mov r10d, dword [rbx + 0x88]
add r10d, dword [rbx + 0x84]
je 0x7f10b1
mov r8, qword [rbx + 0x28]
mov ecx, r10d
xor r11d, r11d
cmp r10d, 8
jae 0x7f10bb
xor r9d, r9d
jmp 0x7f1139
mov ecx, 0xffffffff
jmp 0x7f1156
and r10d, 7
mov r9, rcx
sub r9, r10
movd xmm0, eax
pshufd xmm0, xmm0, 0
lea rdi, [r8 + 0x10]
movdqa xmm1, xmmword [0x008a69b0]
movdqa xmm2, xmm0
pxor xmm2, xmm1
mov rdx, r9
nop word cs:[rax + rax]
movdqu xmm3, xmmword [rdi - 0x10]
movdqu xmm4, xmmword [rdi]
movdqa xmm5, xmm3
pxor xmm5, xmm1
pcmpgtd xmm5, xmm2
movdqa xmm6, xmm4
pxor xmm6, xmm1
pcmpgtd xmm6, xmm2
psubd xmm3, xmm0
pand xmm3, xmm5
psubd xmm4, xmm0
pand xmm4, xmm6
movdqu xmmword [rdi - 0x10], xmm3
movdqu xmmword [rdi], xmm4
add rdi, 0x20
add rdx, 0xfffffffffffffff8
jne 0x7f10f0
test r10d, r10d
je 0x7f1153
sub rcx, r9
lea rdx, [r8 + r9*4]
mov edi, dword [rdx]
sub edi, eax
cmovbe edi, r11d
mov dword [rdx], edi
add rdx, 4
dec rcx
jne 0x7f1140
mov ecx, dword [rbx + 8]
sub dword [rbx + 0xc], eax
sub ecx, eax
mov dword [rbx + 8], ecx
sub dword [rbx + 0x10], eax
cmp dword [rbx + 0x50], 0
jne 0x7f11b6
mov eax, dword [rbx + 0x10]
sub eax, ecx
mov edx, dword [rbx + 0x68]
cmp edx, eax
jne 0x7f11b6
mov rax, qword [rbx]
mov rcx, qword [rbx + 0x40]
mov edi, dword [rbx + 0x60]
add rdi, rcx
sub rdi, rax
cmp rdi, rdx
ja 0x7f11ad
mov edi, dword [rbx + 0x64]
sub rax, rdi
lea r8d, [rdi + rdx]
mov rdx, rax
call fcn.007e6bc0
mov rcx, qword [rbx + 0x40]
mov eax, dword [rbx + 0x64]
add rax, rcx
mov qword [rbx], rax
cmp dword [rbx + 0x50], 0
jne 0x7f11b6
cmp dword [rbx + 0x8c], 0
je 0x7f120b
mov ecx, dword [rbx + 0x18]
mov eax, dword [rbx + 0x1c]
cmp ecx, eax
jne 0x7f11c9
mov dword [rbx + 0x18], 0
xor ecx, ecx
mov esi, dword [rbx + 8]
mov edi, dword [rbx + 0x10]
mov edx, esi
not edx
sub eax, ecx
cmp eax, edx
cmovae eax, edx
xor ecx, ecx
sub edi, esi
setne cl
mov edx, edi
sub edx, dword [rbx + 0x68]
cmova ecx, edx
cmp ecx, eax
cmovae ecx, eax
mov eax, dword [rbx + 0x20]
cmp edi, eax
cmova edi, eax
mov dword [rbx + 0x14], edi
add ecx, esi
mov dword [rbx + 0xc], ecx
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [rbx + 0x10]
sub edx, dword [rbx + 8]
add rax, rdx
mov edx, dword [rbx + 0x60]
add rcx, rdx
sub rcx, rax
mov qword [rbp - 0x18], rcx
je 0x7f11b6
lea rdi, [rbp - 0x18]
nop word [rax + rax]
mov r8, qword [rbx + 0x58]
mov rcx, rax
mov rdx, rdi
call qword [rbx + 0x48]
mov dword [rbx + 0x8c], eax
test eax, eax
jne 0x7f11b6
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x7f1280
add eax, dword [rbx + 0x10]
mov dword [rbx + 0x10], eax
sub eax, dword [rbx + 8]
cmp eax, dword [rbx + 0x68]
ja 0x7f11b6
mov eax, eax
add rax, qword [rbx]
mov ecx, dword [rbx + 0x60]
add rcx, qword [rbx + 0x40]
sub rcx, rax
mov qword [rbp - 0x18], rcx
jne 0x7f1230
jmp 0x7f11b6
mov dword [rbx + 0x50], 1
jmp 0x7f11b6
Function at 0x7f7ae0
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0xe0
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0xf0], rcx
mov rcx, qword [rbp + 0xf0]
call fcn.0040ff40
nop
mov rcx, qword [0x007f6650]
xor edx, edx
call fcn.007f9f10
lea rax, [0x007f7ce4]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
lea rax, [0x008eaf08]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
lea rcx, [rbp + 0x68]
lea rdx, [0x007f7cc4]
lea r8, [rbp + 0x38]
mov r9d, 2
call fcn.00435710
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0x68]
call fcn.00410470
lea rcx, [rbp + 0x70]
mov edx, 0x70
xor r8, r8
call fcn.0040bbc0
mov dword [rbp + 0x70], 0x70
mov dword [rbp + 0x74], 0x800540
lea rax, [0x007f7cf4]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x30]
call fcn.006322c0
mov rcx, qword [rbp + 0x30]
call fcn.00411170
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0xf0]
call fcn.00411170
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x28]
call fcn.00630bc0
mov rcx, qword [rbp + 0x28]
call fcn.00411170
mov qword [rbp + 0x98], rax
mov dword [rbp + 0xa0], 1
lea rcx, [rbp + 0x70]
call sub.shell32.dll_ShellExecuteExW
test eax, eax
setne al
mov byte [rbp + 0x27], al
movzx rax, byte [rbp + 0x27]
test al, al
je 0x7f7c2f
mov rcx, qword [rbp + 0xd8]
or edx, 0xffffffff
call fcn.00645260
mov rcx, qword [rbp + 0xd8]
call sub.kernel32.dll_CloseHandle
jmp 0x7f7c41
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
je 0x7f7c41
call fcn.004419a0
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040fe50
lea rcx, [rbp + 0x68]
call fcn.0040fd70
lea rcx, [rbp + 0xf0]
call fcn.0040fd70
movzx rax, byte [rbp + 0x27]
lea rsp, [rbp + 0xe0]
pop rbp
ret

Function at 0x7f7eb0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call fcn.00411170
mov rcx, rax
xor edx, edx
mov r8d, 4
call sub.kernel32.dll_MoveFileExW
add rsp, 0x28
ret

Function at 0x81b1f0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
mov eax, 0xfd8
sub rax, 0x1000
mov byte [rsp + rax], al
cmp rax, 0xfffffffffffdffd8
ja 0x81b1f7
sub rsp, 0x20028
mov rbp, rsp
mov rbx, rcx
mov rcx, rdx
call fcn.00411170
mov rcx, rax
lea rdx, [rbp + 0x22]
mov r8d, 0xffff
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
jne 0x81b239
call fcn.004419a0
mov rcx, rbx
lea rdx, [rbp + 0x22]
mov r8d, 0xffff
call fcn.00411260
mov rax, rbx
lea rsp, [rbp + 0x20028]
pop rbx
pop rbp
ret
Function at 0x82adf0
Capabilities:
Get session integrity level

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], rbp
nop
lea rcx, [0x0082b218]
call fcn.00419420
nop
lea rcx, [rbp + 0x40]
call fcn.007c32e0
lea rcx, [0x008eafe8]
mov rdx, qword [rbp + 0x40]
call fcn.004103e0
nop
mov rax, qword [0x008ac3d8]
cmp qword [rax], 0
jne 0x82ae6e
mov rcx, qword [0x007f4b20]
mov dl, 1
lea r8, [0x0082b15c]
call fcn.0043e350
mov rcx, rax
call fcn.0040f010
mov rax, qword [0x008abef8]
cmp byte [rax], 0
je 0x82aed9
lea rcx, [0x008eafe0]
call fcn.0040fd70
mov rcx, qword [0x008eafe8]
lea rdx, [0x0082b190]
mov r8, rax
call fcn.007c3190
test al, al
je 0x82aebf
mov rcx, qword [0x008eafe0]
xor edx, edx
call fcn.00433e60
mov rcx, qword [0x007f6650]
movsxd rdx, eax
call fcn.007f9f10
jmp 0x82aed9
call sub.shell32.dll_IsUserAnAdmin
test eax, eax
jne 0x82aed9
mov rcx, qword [0x008eafe8]
call fcn.007f7ae0
jmp 0x82b0d4
call sub.shell32.dll_IsUserAnAdmin
test eax, eax
jne 0x82aef8
mov rcx, qword [0x007f5160]
mov dl, 1
call fcn.007fb4a0
mov rcx, rax
call fcn.0040f010
mov rcx, qword [0x007f6780]
mov dl, 1
mov r8, qword [0x008eafe8]
call fcn.007fa1f0
mov rax, qword [0x008ac820]
mov rax, qword [rax]
cmp byte [rax + 0x60], 1
jne 0x82afb9
lea rcx, [0x008eaff0]
call fcn.0040fd70
mov rcx, qword [0x008eafe8]
lea rdx, [0x0082b1ac]
mov r8, rax
call fcn.007c3190
test al, al
je 0x82af6f
mov rcx, qword [0x008eaff0]
call fcn.006311f0
test al, al
je 0x82af6f
mov rax, qword [0x008ac820]
mov rcx, qword [rax]
mov rdx, qword [0x008eaff0]
call fcn.007fb070
jmp 0x82afb9
lea rcx, [rbp + 0x38]
call fcn.00630e10
lea rcx, [rbp + 0x30]
call fcn.006322e0
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0063bba0
test al, al
je 0x82afaf
mov rcx, qword [0x007f4ee0]
mov dl, 1
lea r8, [0x0082b1c4]
call fcn.0043e350
mov rcx, rax
call fcn.0040f010
call fcn.007f7830
jmp 0x82b0d4
mov rax, qword [0x008ac378]
mov rcx, qword [rax]
call fcn.0061f500
mov rax, qword [0x008ac378]
mov rcx, qword [rax]
mov dl, 1
call fcn.006220a0
mov rax, qword [0x008ac820]
mov rax, qword [rax]
mov rcx, qword [rax + 0x70]
call fcn.007fd600
mov rax, qword [0x008ac820]
mov rax, qword [rax]
movzx rax, byte [rax + 0x61]
test al, 8
je 0x82b066
mov rax, qword [0x008ac820]
mov rcx, qword [rax]
mov dl, 1
call fcn.007fac70
mov rax, qword [0x008ac820]
mov rcx, qword [rax]
call fcn.007fb030
test al, al
je 0x82b055
mov rax, qword [0x008ac820]
mov rax, qword [rax]
mov rcx, qword [rax + 0x18]
lea rdx, [rbp + 0x28]
call fcn.0062b470
mov rcx, qword [0x007f4da0]
mov dl, 1
mov r8, qword [rbp + 0x28]
call fcn.0043e350
mov rcx, rax
call fcn.0040f010
mov rax, qword [0x008ac820]
mov rcx, qword [rax]
call fcn.007fad20
jmp 0x82b0d3
mov rax, qword [0x008ac378]
mov rcx, qword [rax]
mov rdx, qword [0x00828ce0]
mov r8, qword [0x008ab9c8]
call fcn.0061f530
mov rax, qword [0x008ac378]
mov rcx, qword [rax]
call fcn.0061f720
jmp 0x82b0d3
nop
lea rcx, [rbp + 0x28]
mov edx, 4
call fcn.0040fe50
call fcn.0040f8a0
jmp 0x82b0f1
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x1400221a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400221d4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400221c0
ret
Function at 0x140028400
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400284cc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1400284cc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400284e5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1400284bc
cmp byte [rax], 0x5c
jne 0x1400284b6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x1400284b6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1400284a2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x1400284b3
test r8b, 0x10
jne 0x1400284b6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x1400284b6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140024060
test edi, edi
jne 0x140028420
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140024050
int3
Function at 0x14002a8d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14002a901
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14002a97b
mov rdi, r14
mov rcx, rbx
call fcn.14001fb60
test rax, rax
jle 0x14002a953
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140076ad0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14002a96b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002a973
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14002a915
sub r14, rdi
jmp 0x14002aa5f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002a992
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002a994
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002a9c6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140076ad0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14002aa5c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002aa01
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14002aa3d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140086630
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14002aa5c
cmp rbp, rax
ja 0x14002aa10
test rbp, rbp
je 0x14002aa5c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140086630
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002f1e0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400dbe70], 0
jne 0x14002f2d2
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x1400c3f20]
mov qword [rsp + 0x48], rbx
lea rcx, [0x1400c3f10]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x1400dbe70]
test eax, eax
js 0x14002f295
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x1400c3f00]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x14002f286
mov rcx, qword [rsp + 0x40]
lea r8, [0x1400c3ef0]
mov r9, rdi
lea rdx, [0x1400c3ee0]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14002f27b
mov rcx, qword [0x1400dbe70]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x14002f2d2
cmp qword [0x1400dbe70], 0
jne 0x14002f2d2
lea r9, [0x1400c3ef0]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400c3ee0]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x14002f2df
mov rcx, qword [0x1400dbe70]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x1400c3838]
lea rdx, [0x1400c3850]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140030a40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140030a8c
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140030ada
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140030ad5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140030af9
mov rcx, r8
call fcn.140074820
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14007b454
int3

Function at 0x140030b00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbx + 0x10]
mov rdx, rbx
add r8d, r8d
cmp qword [rbx + 0x18], 8
jb 0x140030b55
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140030ba4
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140030b9f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140030bc3
mov rcx, r8
call fcn.140074820
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14007b454
int3
Function at 0x140033000
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1400d8090]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
xor edi, edi
cmp qword [rcx + 0x18], 8
jb 0x14003304a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14003307e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140005700
jmp 0x1400331b4
mov ebp, 1
mov ecx, 0x208
call fcn.140074cd8
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdi, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x1400330cd
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400330da
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x1400330e9
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x1400330f7
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x140033178
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14003311f
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140033144
add rax, 2
test ecx, ecx
jne 0x140033130
test edx, edx
je 0x140033178
mov rcx, rsi
call fcn.140074820
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140074cd8
mov rsi, rax
jmp 0x1400330c0
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x140033180
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14001fcf0
mov rcx, rsi
call fcn.140074820
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140074800
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400343b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400d8090]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov dword [rsp + 0x24], ebp
lea rdx, [0x1400dc430]
lea rcx, [0x1400dc050]
call fcn.1400310b0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bp
mov dword [rsp + 0x24], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.140077170
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400344f2
cmp eax, 0x104
je 0x1400344f2
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x1400344f2
mov ecx, esi
call fcn.140074cd8
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.140077170
mov dword [rsp + 0x28], ebp
mov r9, rdi
mov r8d, esi
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400344ea
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.StringFileInfo000004b0ProductVersion
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400344ea
mov rdx, qword [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400344d4
lea rcx, [rsp + 0x40]
call fcn.14001fcf0
nop
mov rcx, rdi
call fcn.140074820
lea rdx, [rsp + 0x40]
lea rcx, [0x1400dc370]
call fcn.14001ee00
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140034542
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003453d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003456b
call fcn.140074820
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140074800
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14007b454
int3
Function at 0x1400376d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x1400dc4c0]
call fcn.140073920
test eax, eax
jne 0x14003777f
cmp dword [0x1400dc50c], 0x7fffffff
je 0x14003776a
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xc0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x1400dc4c0]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.140073928
mov ecx, 6
mov dword [0x1400dc50c], 0x7ffffffe
call fcn.140073674
int3
mov ecx, 5
call fcn.140073674
int3

Function at 0x140037db0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
movzx edi, dl
lea rcx, [0x1400dc4c0]
call fcn.140073920
test eax, eax
jne 0x140037e65
cmp dword [0x1400dc50c], 0x7fffffff
je 0x140037e50
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x40], rsi
lea r8d, [rax + 4]
xor esi, esi
mov dword [rsp + 0x58], 7
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
lea r8d, [rsi + 4]
mov dword [rsp + 0x58], edi
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x1400dc4c0]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140073928
mov ecx, 6
mov dword [0x1400dc50c], 0x7ffffffe
call fcn.140073674
int3
mov ecx, 5
call fcn.140073674
int3