joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008330
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xc8]
sub rsp, 0x1c0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], reloc.WS2_32.dll_shutdown
lea r9, str.DeferToInstanceFinder
lea r8, [0x1406e4ae0]
mov rdx, qword [0x1406e4b08]
lea rcx, [rbp + 0x10]
call fcn.14000a0b4
nop
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
lea edi, [rbx + 7]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
lea r8d, [rbx + 0x15]
lea rdx, str.InstanceFinderDlg.exe
lea rcx, [rsp + 0x48]
call fcn.140009144
nop
lea rcx, [rbp - 0x78]
call fcn.140012f40
nop
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140012940
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x78]
call fcn.140008e38
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140008e38
lea rcx, [rbp - 0x58]
call fcn.140013980
test al, al
jne 0x14000842d
lea r9, str.Cant_find_instanceFinderDlgEXE
lea edx, [rdi + 0x79]
lea r8d, [rbx + 0x1b]
lea rcx, [rbp + 0x10]
call fcn.14000a4e0
jmp 0x140008520
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x80], rdi
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x68], bx
mov r8d, 2
lea rdx, [0x1403ca450]
lea rcx, [rsp + 0x68]
call fcn.140009144
nop
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
mov r8d, 1
lea rdx, [0x1403ca458]
lea rcx, [rsp + 0x48]
call fcn.140009144
nop
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.140009690
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400095e0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.1400096fc
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x38]
call fcn.140008e38
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x18]
call fcn.140008e38
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140008e38
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.140008e38
lea rcx, [rbp - 0x78]
call fcn.14001442c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x78]
call fcn.140008e38
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x58]
call fcn.140008e38
nop
lea rcx, [rbp + 0x10]
call fcn.14000a1fc
xor eax, eax
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000d808
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov edi, r15d
cmp dword [rcx + 0x358], r15d
jle 0x14000d943
cmp rdx, 0xffffffffffffffff
je 0x14000d943
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
lea r8d, [r15 + 0x1a]
lea rdx, str.____Queued_Lines_End_____r_n
lea rcx, [rbp - 0x30]
call fcn.140009144
nop
lea rbx, [rsi + 0x338]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14000fb24
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.140008e38
jmp 0x14000d936
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.1400108ec
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x14000d8c7
mov rax, r15
jmp 0x14000d8ca
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
dec rcx
and rcx, qword [rdx + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000d8eb
mov rdx, qword [rdx]
lea r8d, [rax + rax]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000d908
add edi, dword [rbp - 0x40]
mov rcx, qword [rbx + 0x10]
dec rcx
and rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 8]
xor r8d, r8d
mov dl, 1
mov rcx, qword [rax + rcx*8]
call fcn.140008e38
sub qword [rbx + 0x20], 1
jne 0x14000d932
mov qword [rbx + 0x18], r15
jmp 0x14000d936
inc qword [rbx + 0x18]
cmp qword [rsi + 0x358], r15
ja 0x14000d8ab
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024cd60
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e6d4
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rbp + 0x58]
xor r15d, r15d
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov edx, dword [rdx + 0x10]
call fcn.14000e31c
bt ebx, 0x1b
jb 0x14000e743
test dword [rsi + 0x10], 0x80000
je 0x14000e7a3
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rdi + 0x90]
test rcx, rcx
je 0x14000e772
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14000e772
add rcx, 0x30
jmp 0x14000e77d
mov rcx, qword [rdi + 0xe0]
add rcx, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14000e787
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1403ce090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14000e7bc
add rcx, 8
cmp qword [rcx + 0x18], 8
jb 0x14000e7c3
mov rcx, qword [rcx]
jmp 0x14000e7c3
lea rcx, [0x1403ca788]
call fcn.140255170
test rax, rax
jne 0x14000e7d6
cmp qword [rdi + 0x360], r15
je 0x14000e7f2
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
mov r9, r14
mov rdx, rsi
mov rcx, rdi
call fcn.14000d968
test dword [rsi + 0x10], 0x10000000
je 0x14000e809
lea rcx, [rdi + 0xb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.140008e38
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024cd60
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000e830
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rsi, rcx
mov r8d, edx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x14000e8c8
lea r9, [rsp + 0x20]
mov r8d, 0x800
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x14000e8bf
test dword [rsp + 0x20], 0xfffffff8
jbe 0x14000e8bf
mov ecx, ebx
lea rdx, [rsi + 0x110]
mov r8d, 0x104
mov rcx, qword [rsp + rcx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rsp + 0x20]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x14000e898
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001117c
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
mov qword [rbp - 0x31], rcx
xor esi, esi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rsi
lea r14d, [rsi + 7]
mov qword [rbp + 0x17], r14
mov qword [rbp + 0xf], rsi
mov word [rbp - 1], si
cmp qword [rcx + 0x10], rsi
jne 0x14001126e
mov qword [rbp - 0x11], rsi
mov qword [rbp - 9], rsi
mov qword [rbp - 9], r14
mov qword [rbp - 0x11], rsi
mov word [rbp - 0x21], si
lea rdx, [rbp - 1]
lea rcx, str.ExtMonitor
call fcn.140012818
lea r8, str.Lock
lea rdx, [rbp - 1]
lea rcx, [rbp + 0x1f]
call fcn.14001186c
mov rdi, rax
lea rax, [rbp - 0x21]
cmp rax, rdi
je 0x140011236
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x21]
call fcn.140008e38
mov rdx, rdi
lea rcx, [rbp - 0x21]
call fcn.140009900
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x1f]
call fcn.140008e38
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae r8, qword [rbp - 0x21]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0x10], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x21]
call fcn.140008e38
mov edx, 0x32
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140011375
lea r8, str.MappedFile
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.14001186c
nop
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rax, qword [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], WSAStartup
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 8], rax
test rax, rax
je 0x14001135c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, esi
cmp eax, 0xb7
setne dil
mov qword [rsp + 0x20], WSAStartup
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14001135c
test edi, edi
je 0x140011349
mov qword [rbp - 0x29], rax
mov dword [rax + 8], esi
lea rcx, vtable.NGLogging::CExtMonitorSettings.0
mov qword [rax], rcx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov byte [rax + 0x20], sil
mov qword [rax + 0x40], r14
mov qword [rax + 0x38], rsi
mov word [rax + 0x28], si
mov qword [rax + 0x60], r14
mov qword [rax + 0x58], rsi
mov word [rax + 0x48], si
mov dword [rax + 0x68], esi
mov rax, qword [rbx + 0x18]
lea rcx, [rax + 8]
neg rax
sbb rdx, rdx
and rdx, rcx
inc dword [rdx]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x21]
call fcn.140008e38
mov rbx, qword [rbx + 0x18]
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 1]
call fcn.140008e38
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400125fc
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14001264c
mov r11, rsp
push rbx
sub rsp, 0x40
mov rbx, r8
test rbx, rbx
je 0x140012647
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x20], rax
lea r9, [r11 + 0x20]
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012647
cmp dword [rsp + 0x68], 4
jne 0x140012647
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
add rsp, 0x40
pop rbx
ret

Function at 0x140012650
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x140012722
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea rax, [r11 + 8]
mov r15, r8
xor ebx, ebx
mov qword [r11 - 0x30], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x38], rbx
xor r8d, r8d
mov dword [rsp + 0x60], ebx
mov r14, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012712
cmp dword [rsp + 0x78], 1
jne 0x140012712
mov ecx, dword [rsp + 0x60]
lea eax, [rbx + 2]
shr ecx, 1
lea rsi, [rbx - 1]
inc ecx
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400b41f0
mov rdi, rax
test rax, rax
je 0x140012712
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001270a
cmp word [rdi], bx
je 0x1400126fc
inc rsi
cmp word [rdi + rsi*2], bx
jne 0x1400126f0
mov rbx, rsi
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.140009144
mov rcx, rdi
call fcn.1400b41f8
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001321c
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x120
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rdi, rdx
mov rbx, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x17e
lea r9, str.NGUtils::CPathUtils::CreatePathHierarchy
lea r8, [0x1406e4e80]
mov rdx, qword [0x1406e5290]
lea rcx, [rsp + 0x70]
call fcn.14000a0b4
nop
cmp qword [rbx + 0x10], 0
jbe 0x14001333e
mov rcx, rbx
call fcn.140013378
test al, al
jne 0x140013346
cmp qword [rbx + 0x18], 8
jb 0x1400132a5
mov rax, qword [rbx]
jmp 0x1400132a8
mov rax, rbx
mov qword [rsp + 0x20], rax
lea r9, str.wstrPathToCreate__s
mov edx, reloc.WS2_32.dll_recv
mov r8d, 0x184
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140012ca0
nop
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.14001321c
mov dword [rsp + 0x78], eax
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1400132fb
cmp eax, 0x8004ffff
jne 0x14001332d
cmp qword [rbx + 0x18], 8
jb 0x140013305
mov rbx, qword [rbx]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001332d
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
and eax, 0x80004005
mov dword [rsp + 0x78], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140008e38
jmp 0x140013346
mov dword [rsp + 0x78], 0x8004ffff
mov ebx, dword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000a1fc
mov eax, ebx
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.14024cd60
mov rbx, qword [rsp + 0x140]
add rsp, 0x120
pop rdi
ret
Function at 0x140013980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov ecx, 0xfa00
call fcn.1400b41f0
mov rdi, rax
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
lea r8d, [r14 + 4]
lea rdx, [0x140590d88]
lea rcx, [rsp + 0x28]
call fcn.140009144
nop
lea r9d, [r14 + 2]
cmp qword [rbx + 0x10], r9
jbe 0x140013a46
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140013440
nop
lea rdx, [0x140590d94]
mov rcx, rax
call fcn.1400116d8
mov esi, eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140008e38
test esi, esi
jne 0x140013a46
xor r8d, r8d
lea rdx, [0x1403ca788]
lea rcx, [rsp + 0x28]
call fcn.140009144
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009014
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
xor r9d, r9d
mov r8, rdi
mov edx, 0x7d00
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
dec eax
cmp eax, 0x7cfe
ja 0x140013a8a
mov rcx, rdi
jmp 0x140013a9b
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, rdi
call fcn.1400b41f8
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.140008e38
cmp ebx, 0xffffffff
jne 0x140013ac4
xor al, al
jmp 0x140013ad3
test bl, 0x10
je 0x140013acd
xor al, al
jmp 0x140013ad3
mov al, 1
jmp 0x140013ad3
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140013e70
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x180
lea r9, str.NGUtils::CFileUtils::CreateDirectoryW
lea r8, [0x1406e4ea8]
mov rdx, qword [0x1406e5290]
lea rcx, [rsp + 0x70]
call fcn.14000a0b4
nop
mov sil, bl
mov r14d, ebx
lea rdi, [0x1406e5f40]
test sil, sil
jne 0x140014038
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
mov r8d, 4
lea rdx, [0x140590d88]
lea rcx, [rsp + 0x48]
call fcn.140009144
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140009014
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
sete sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
test sil, sil
jne 0x140013fc2
cmp eax, 0xb7
je 0x14001401d
mov edx, 0x80
cmp eax, 5
jne 0x140013fdf
mov rcx, rdi
cmp qword [0x1406e5f58], 8
cmovae rcx, qword [0x1406e5f40]
mov dword [rsp + 0x30], eax
mov rax, qword [0x1406e5f50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, str.::CreateDirectory__s__len_d___error_d._Sleeping_...
mov r8d, SafeArrayCopyData
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140008e38
inc r14d
cmp r14d, 2
jae 0x140014038
jmp 0x140013ee5
cmp qword [0x1406e5f58], 8
cmovae rdi, qword [0x1406e5f40]
mov dword [rsp + 0x30], eax
mov rax, qword [0x1406e5f50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.::CreateDirectory__s__len_d___error_d
mov r8d, 0x19e
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
jmp 0x140014027
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov bl, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140008e38
jmp 0x14001403b
mov bl, sil
lea rcx, [rsp + 0x70]
call fcn.14000a1fc
mov al, bl
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140014070
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1ac
lea r9, str.NGUtils::CFileUtils::DeleteFileW
lea r8, [0x1406e4ea8]
mov rdx, qword [0x1406e5290]
lea rcx, [rsp + 0x50]
call fcn.14000a0b4
nop
cmp qword [rbx + 0x18], 8
jb 0x1400140df
mov rcx, qword [rbx]
jmp 0x1400140e2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400141a2
mov sil, 1
test sil, dil
je 0x140014154
and edi, 0xfffffffe
cmp qword [rbx + 0x18], 8
jb 0x14001410a
mov rcx, qword [rbx]
jmp 0x14001410d
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140014154
cmp qword [rbx + 0x18], 8
jb 0x140014123
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
lea r9, str.::SetFileAttributes__s__0x_X___error_d
mov edx, 0x80
mov r8d, 0x1bb
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
jmp 0x1400141a2
cmp qword [rbx + 0x18], 8
jb 0x140014160
mov rcx, qword [rbx]
jmp 0x140014163
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400141a5
cmp qword [rbx + 0x18], 8
jb 0x140014177
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, str.::DeleteFile__s___error_d
mov edx, 0x80
mov r8d, 0x1c2
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
xor sil, sil
lea rcx, [rsp + 0x50]
call fcn.14000a1fc
mov al, sil
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140018094
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rax - 0x28], ebx
cmp qword [rdx + 0x18], 8
jb 0x1400180cf
mov rcx, qword [rdx]
jmp 0x1400180d2
mov rcx, rdi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r15d, eax
mov eax, 2
add r15d, eax
movsxd rcx, r15d
mul rcx
mov r14, 0xffffffffffffffff
cmovo rax, r14
mov rcx, rax
call fcn.1400b41f0
mov rbp, rax
cmp qword [rdi + 0x18], 8
jb 0x14001810e
mov rdi, qword [rdi]
mov r8d, r15d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
mov word [rsi], bx
cmp word [rbp], bx
je 0x140018140
inc r14
cmp word [rbp + r14*2], bx
jne 0x140018132
mov rbx, r14
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.140009144
mov dword [rsp + 0x20], 1
mov rcx, rbp
call fcn.1400b41f8
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1400183e0
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r12, r8
mov ebp, ebx
mov edi, ebx
or rsi, 0xffffffffffffffff
mov r13, rdx
mov r15, rcx
add ebp, 0x200
test rdi, rdi
je 0x140018426
mov rcx, rdi
call fcn.1400b41f8
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400b41f0
mov rdi, rax
test rax, rax
je 0x1400184b0
mov word [rax], bx
lea rax, [r15 + 8]
cmp qword [rax + 0x18], 8
jb 0x140018455
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea r8, [0x1403ca788]
mov r9, rdi
mov dword [rsp + 0x20], ebp
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r14d, eax
lea eax, [rbp - 1]
cmp r14d, eax
jae 0x140018413
cmp word [rdi], bx
jne 0x140018489
mov rsi, rbx
jmp 0x140018492
inc rsi
cmp word [rdi + rsi*2], bx
jne 0x140018489
mov rcx, qword [rsp + 0x78]
mov r8, rsi
mov rdx, rdi
call fcn.140009144
mov rcx, rdi
call fcn.1400b41f8
test r14d, r14d
setne al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret