joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc810
Capabilities:
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [rcx + 0x20]
lea rdx, [rax + 1]
mov rbx, rcx
mov qword [rsp + 0x28], rax
mov qword [rcx + 0x20], rdx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x4bc9d0
mov qword [rdx], rax
add rdx, 8
mov qword [rcx + 8], rdx
movabs rax, 0xffffffff00000008
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x68], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rdx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x78], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x80], rdx
mov rdx, qword [rbx + 0x38]
cmp rdx, qword [rbx + 0x40]
je 0x4bc9b0
mov qword [rdx], rax
mov rax, qword [rsp + 0x68]
cmp dword [rsp + 0x60], 0xb
mov qword [rdx + 8], rax
mov rax, qword [rsp + 0x70]
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x78]
mov qword [rdx + 0x18], rax
mov rax, qword [rsp + 0x80]
mov qword [rdx + 0x20], rax
jne 0x4bc916
mov qword [rdx + 0x18], 0
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
movdqu xmm0, xmmword [rdx + 8]
movups xmmword [rsp + 0x68], xmm0
mov qword [rdx + 8], r9
mov qword [rdx + 0x10], r10
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], 0
mov qword [rdx + 0x18], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x80], rax
mov qword [rdx + 0x20], rcx
mov rdx, qword [rbx + 0x38]
add rdx, 0x28
mov qword [rbx + 0x38], rdx
sub rdx, qword [rbx + 0x30]
mov rax, rdx
movabs rdx, 0xcccccccccccccccd
sar rax, 3
imul rax, rdx
cmp rax, 0x186a0
ja 0x4bc9df
cmp dword [rsp + 0x60], 0xb
lea ebx, [rax - 1]
je 0x4bc960
cmp dword [rsp + 0x30], 0xb
je 0x4bc981
mov eax, ebx
add rsp, 0x90
pop rbx
ret
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x4bc94d
lea rcx, [rsp + 0x68]
mov r8d, 3
mov rdx, rcx
call rax
cmp dword [rsp + 0x30], 0xb
jne 0x4bc954
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4bc954
lea rcx, [rsp + 0x38]
mov r8d, 3
mov rdx, rcx
call rax
mov eax, ebx
add rsp, 0x90
pop rbx
ret
lea rcx, [rbx + 0x30]
lea r8, [rsp + 0x60]
call method.void_std::vector_std::__detail::_State_char___std::allocator_std::__detail::_State_char_____::_M_realloc_insert_std::__detail._State_char______gnu_cxx::__normal_iterator_std::__detail::_State_char___std::vector_std::__detail::_State_char___std::al
mov rdx, qword [rbx + 0x38]
jmp 0x4bc91e
lea r8, [rsp + 0x28]
call method.void_std::vector_unsigned_long_long__std::allocator_unsigned_long_long___._M_realloc_insert_unsigned_long_long_const____gnu_cxx::__normal_iterator_unsigned_long_long__std::vector_unsigned_long_long__std::allocator_unsigned_long_long_______unsigne
jmp 0x4bc845
lea rdx, [0x0051a950]
mov ecx, 9
call method.std.__throw_regex_error_std::regex_constants::error_type__char_const_
cmp dword [rsp + 0x60], 0xb
mov rbx, rax
jne 0x4bca04
lea rcx, [rsp + 0x60]
call method.std::__detail::_State_char_._State____clone_.part.2182_
cmp dword [rsp + 0x30], 0xb
jne 0x4bca15
lea rcx, [rsp + 0x30]
call method.std::__detail::_State_char_._State____clone_.part.2182_
mov rcx, rbx
call sym._Unwind_Resume
nop
nop
nop
Function at 0x4bca20
Capabilities:
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rcx + 0xb8]
cmp qword [rcx + 0xb0], rax
je 0x4bca60
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x4bca45
cmp eax, 2
je 0x4bca50
cmp eax, 1
je 0x4bca55
ret
jmp method.std::__detail::_Scanner_char_._M_scan_normal__
jmp method.std::__detail::_Scanner_char_._M_scan_in_bracket__
jmp method.std::__detail::_Scanner_char_._M_scan_in_brace__
mov dword [rcx + 0x90], 0x1b
ret
Function at 0x4bcff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0xb0]
mov r8, qword [rcx + 0xb8]
mov rbx, rcx
cmp rax, r8
je 0x4bd208
mov r9, qword [rbx + 0xc0]
lea rcx, [rax + 1]
mov qword [rbx + 0xb0], rcx
movzx r10d, byte [rax]
mov r9, qword [r9 + 0x30]
test byte [r9 + r10*2], 8
jne 0x4bd0c0
cmp r10b, 0x2c
je 0x4bd0a0
test dword [rbx + 0x8c], 0x120
je 0x4bd1d0
cmp r8, rcx
je 0x4bd1f7
cmp r10b, 0x5c
jne 0x4bd1f7
cmp byte [rax + 1], 0x7d
jne 0x4bd1f7
mov dword [rbx + 0x88], 0
add rax, 2
mov dword [rbx + 0x90], 0xd
mov qword [rbx + 0xb0], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rbx + 0x90], 0x19
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8, qword [rbx + 0xd0]
movsx edx, r10b
mov dword [rbx + 0x90], 0x1a
mov r9d, 1
lea r12, [rbx + 0xc8]
mov dword [rsp + 0x20], edx
xor edx, edx
mov rcx, r12
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_replace_aux_unsigned_long_long__unsigned_long_long__unsigned_long_long__char_
mov rax, qword [rbx + 0xb0]
cmp rax, qword [rbx + 0xb8]
je 0x4bd08d
mov rdx, qword [rbx + 0xc0]
movzx ecx, byte [rax]
mov rdx, qword [rdx + 0x30]
test byte [rdx + rcx*2], 8
je 0x4bd08d
lea r13, [rbx + 0xd8]
jmp 0x4bd164
mov byte [rax + rsi], bpl
mov rax, qword [rbx + 0xc8]
mov qword [rbx + 0xd0], rdi
mov byte [rax + rsi + 1], 0
mov rax, qword [rbx + 0xb0]
cmp rax, qword [rbx + 0xb8]
je 0x4bd08d
mov rdx, qword [rbx + 0xc0]
movzx ecx, byte [rax]
mov rdx, qword [rdx + 0x30]
test byte [rdx + rcx*2], 8
je 0x4bd08d
lea rdx, [rax + 1]
mov rsi, qword [rbx + 0xd0]
mov qword [rbx + 0xb0], rdx
movzx ebp, byte [rax]
mov rax, qword [rbx + 0xc8]
lea rdi, [rsi + 1]
cmp rax, r13
je 0x4bd1c0
mov rdx, qword [rbx + 0xd8]
cmp rdi, rdx
jbe 0x4bd121
mov qword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_mutate_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long_
mov rax, qword [rbx + 0xc8]
jmp 0x4bd121
mov edx, 0xf
jmp 0x4bd190
cmp r10b, 0x7d
jne 0x4bd1f7
mov dword [rbx + 0x88], 0
mov dword [rbx + 0x90], 0xd
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [0x0051a430]
mov ecx, 7
call method.std.__throw_regex_error_std::regex_constants::error_type__char_const_
lea rdx, [0x0051a3f8]
mov ecx, 6
call method.std.__throw_regex_error_std::regex_constants::error_type__char_const_
nop
nop
nop
nop
nop
nop
nop
Function at 0x4bd900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0xb0]
mov rbx, rcx
mov rcx, qword [rcx + 0xb8]
cmp rax, rcx
je 0x4bdacc
lea r8, [rax + 1]
mov qword [rbx + 0xb0], r8
movsx edx, byte [rax]
cmp dl, 0x2d
je 0x4bda40
cmp dl, 0x5b
je 0x4bd990
cmp dl, 0x5d
je 0x4bd9f0
cmp dl, 0x5c
jne 0x4bda02
test byte [rbx + 0x8c], 0x90
je 0x4bda02
mov rcx, qword [rbx + 0xf0]
mov rax, qword [rbx + 0xe8]
add rcx, rbx
test al, 1
je 0x4bd977
mov rdx, qword [rcx]
mov rax, qword [rdx + rax - 1]
call rax
mov byte [rbx + 0xa8], 0
add rsp, 0x30
pop rbx
ret
cmp rcx, r8
je 0x4bdadd
movzx edx, byte [rax + 1]
cmp dl, 0x2e
je 0x4bda81
cmp dl, 0x3a
je 0x4bdac0
cmp dl, 0x3d
je 0x4bdab0
mov r8, qword [rbx + 0xd0]
mov r9d, 1
xor edx, edx
mov dword [rbx + 0x90], 1
lea rcx, [rbx + 0xc8]
mov dword [rsp + 0x20], 0x5b
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_replace_aux_unsigned_long_long__unsigned_long_long__unsigned_long_long__char_
jmp 0x4bda2b
test byte [rbx + 0x8c], 0x10
jne 0x4bda60
cmp byte [rbx + 0xa8], 0
je 0x4bda60
mov r8, qword [rbx + 0xd0]
mov dword [rsp + 0x20], edx
xor edx, edx
mov r9d, 1
mov dword [rbx + 0x90], 1
lea rcx, [rbx + 0xc8]
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_replace_aux_unsigned_long_long__unsigned_long_long__unsigned_long_long__char_
mov byte [rbx + 0xa8], 0
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x90], 0x1c
mov byte [rbx + 0xa8], 0
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x90], 0xb
mov dword [rbx + 0x88], 0
mov byte [rbx + 0xa8], 0
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x90], 0x10
lea rdx, [rax + 2]
mov rcx, rbx
mov qword [rbx + 0xb0], rdx
movsx edx, byte [rax + 1]
call method.std::__detail::_Scanner_char_._M_eat_class_char_
mov byte [rbx + 0xa8], 0
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x90], 0x11
jmp 0x4bda8b
mov dword [rbx + 0x90], 0xf
jmp 0x4bda8b
lea rdx, [0x0051a488]
mov ecx, 4
call method.std.__throw_regex_error_std::regex_constants::error_type__char_const_
lea rdx, [0x0051a4c0]
mov ecx, 4
call method.std.__throw_regex_error_std::regex_constants::error_type__char_const_
nop
nop
Function at 0x4bdaf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0xb0]
cmp rax, qword [rcx + 0xb8]
mov rbx, rcx
je 0x4bdc53
movsx ebp, byte [rax]
mov rdi, qword [rcx + 0xc0]
movzx r12d, bpl
mov esi, ebp
movsx edx, byte [rdi + r12 + 0x139]
test dl, dl
jne 0x4bdb55
mov rax, qword [rdi]
lea rcx, [method.std::ctype_char_.do_narrow_char__char__const]
mov edx, ebp
mov r9, qword [rax + 0x40]
mov eax, ebp
cmp r9, rcx
jne 0x4bdc42
test al, al
je 0x4bdb55
mov byte [rdi + r12 + 0x139], al
mov rcx, qword [rbx + 0xa0]
call sym.strchr
test rax, rax
je 0x4bdb6b
cmp byte [rax], 0
jne 0x4bdbe0
mov eax, dword [rbx + 0x8c]
test al, 0x80
jne 0x4bdc30
test eax, 0x120
mov r8, qword [rbx + 0xd0]
lea rcx, [rbx + 0xc8]
je 0x4bdba9
mov rdx, qword [rbx + 0xc0]
movzx eax, sil
mov rdx, qword [rdx + 0x30]
test byte [rdx + rax*2], 8
je 0x4bdba9
cmp sil, 0x30
jne 0x4bdc10
mov dword [rsp + 0x20], ebp
mov r9d, 1
xor edx, edx
mov dword [rbx + 0x90], 1
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_replace_aux_unsigned_long_long__unsigned_long_long__unsigned_long_long__char_
add qword [rbx + 0xb0], 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, qword [rbx + 0xd0]
mov dword [rsp + 0x20], ebp
mov r9d, 1
xor edx, edx
mov dword [rbx + 0x90], 1
lea rcx, [rbx + 0xc8]
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_replace_aux_unsigned_long_long__unsigned_long_long__unsigned_long_long__char_
jmp 0x4bdbc4
mov dword [rsp + 0x20], ebp
mov r9d, 1
xor edx, edx
mov dword [rbx + 0x90], 4
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_replace_aux_unsigned_long_long__unsigned_long_long__unsigned_long_long__char_
jmp 0x4bdbc4
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp method.std::__detail::_Scanner_char_._M_eat_escape_awk__
xor r8d, r8d
mov rcx, rdi
call r9
movsx edx, al
jmp 0x4bdb49
lea rdx, [0x00515280]
mov ecx, 2
call method.std.__throw_regex_error_std::regex_constants::error_type__char_const_
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4d5ac0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14000a7e0]
mov dword [rax], 1
mov rax, qword [0x14000a7f0]
mov dword [rax], 1
mov rax, qword [0x14000a800]
mov dword [rax], 1
mov rax, qword [0x14000a7a0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001b10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400027e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000f168]
test eax, eax
je 0x14000287a
lea rax, [0x14000f140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000f170]
mov qword [rbp - 8], rax
jmp 0x14000285e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002852
cmp qword [rbp - 0x10], 0
je 0x140002852
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002818
lea rax, [0x14000f140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000287b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140059020
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x1403372b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.140058f80
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rcx, [0x140349410]
call fcn.140054e90
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.140015610
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140054e90
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x48]
call fcn.14000d5e0
call fcn.140058f80
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14023b5b0
add rsp, 0x80
pop rdi
ret

Function at 0x140059100
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [0x1403372b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0
call fcn.140058f80
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rcx, [0x140349410]
call fcn.140054e90
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x88]
call fcn.140054e90
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call fcn.140058f80
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call fcn.14000d6f0
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x88]
call fcn.14000d5e0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14023b5b0
add rsp, 0x60
pop rdi
ret
Function at 0x1400591e0
Capabilities:
Read .ini file

Disassembly:
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x1403372b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.140058f80
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rcx, [0x140349410]
call fcn.140054e90
mov qword [rsp + 0x38], rax
movss xmm1, dword [rsp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.140058f40
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140054e90
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x48]
call fcn.14000d5e0
call fcn.140058f80
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14023b5b0
add rsp, 0x80
pop rdi
ret

Function at 0x140059b40
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x1403372b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x58]
lea rcx, str._pipediscord_ipc_0
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_46
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x50], reloc.WS2_32.dll_setsockopt
mov eax, 2
imul rax, rax, 0x15
mov ecx, Ordinal_50
mov word [rsp + rax + 0x58], cx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x48]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x140059bf2
mov rax, qword [rsp + 0x48]
mov byte [rax], 1
mov al, 1
jmp 0x140059c6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 2
jne 0x140059c3c
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
cmp eax, 0x39
jge 0x140059c3a
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
inc ax
mov ecx, 2
imul rcx, rcx, 0x15
mov word [rsp + rcx + 0x58], ax
jmp 0x140059ba2
jmp 0x140059c63
cmp dword [rsp + 0x40], 0xe7
jne 0x140059c63
mov edx, 0x2710
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x140059c5e
xor al, al
jmp 0x140059c6c
jmp 0x140059ba2
xor al, al
jmp 0x140059c6c
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14023b5b0
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x140059cd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1403372b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x70], 0
jne 0x140059d01
mov al, 1
jmp 0x140059d90
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140059d17
xor al, al
jmp 0x140059d90
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x140059d27
xor al, al
jmp 0x140059d90
cmp qword [rsp + 0x68], 0
jne 0x140059d33
xor al, al
jmp 0x140059d90
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140059d83
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
jne 0x140059d83
mov dword [rsp + 0x34], 1
jmp 0x140059d8b
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14023b5b0
add rsp, 0x58
ret

Function at 0x140059db0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1403372b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x68], 0
jne 0x140059de1
xor al, al
jmp 0x140059ea8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140059dfa
xor al, al
jmp 0x140059ea8
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x140059e0d
xor al, al
jmp 0x140059ea8
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140059e9c
mov eax, dword [rsp + 0x3c]
cmp rax, qword [rsp + 0x70]
jb 0x140059e9a
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140059e90
mov al, 1
jmp 0x140059ea8
mov rcx, qword [rsp + 0x60]
call fcn.140059c90
jmp 0x140059ea6
mov rcx, qword [rsp + 0x60]
call fcn.140059c90
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14023b5b0
add rsp, 0x58
ret
Function at 0x14005a240
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1403372b0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
cmp qword [rsp + 0x88], 0
je 0x14005a304
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
movzx eax, word [rcx + rax]
test eax, eax
je 0x14005a304
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14005a2fa
mov eax, dword [rsp + 0x50]
jmp 0x14005a364
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x98]
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x60], 0
je 0x14005a360
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x60], rax
je 0x14005a360
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14023b5b0
add rsp, 0x78
ret