Function at 0x140002f04
Capabilities:
Query environment variable
Reference http user-agent string
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
lea rax, str.APPDATA
mov rcx, rax
call sym.getenv
mov qword [rbp - 8], rax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x90]
mov r9, rdx
lea r8, str._sSafeExamBrowserSebClientSettings.seb
mov edx, 0x78
mov rcx, rax
call dbg.snprintf
lea rax, [rbp - 0x90]
lea rdx, [0x14006411b]
mov rcx, rax
call sym.fopen
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140002f79
lea rax, str.Error_creating_file
mov rcx, rax
call sym.perror
jmp 0x14000301d
mov rax, qword [rbp - 8]
lea r8, str.ReSebMod_finished.exe
mov rdx, rax
lea rax, str._________string__s_s__string_
mov rcx, rax
call dbg.printf
mov eax, 0x1e4a
cdqe
mov rdx, qword [rbp - 0x10]
mov r9, rdx
mov r8, rax
mov edx, 1
lea rax, str.__xml_version_1.0__encoding_utf_8____r_n__DOCTYPE_plist_PUBLIC_____Apple_Computer__DTD_PLIST_1.0__EN___https:__www.apple.com_DTDs_PropertyList_1.0.dtd___r_n_plist_version_1.0___r_n___dict__r_n_____key_originatorVersion__key__r_n_____string_SEB_Win_2.1.1__string__r_n_____key_startURL__key__r_n_____string_https:__al_hamidiyah.my.id_cbtahsanma24lsg___string__r_n_____key_startResource__key__r_n_____string____r_n_____key_sebServerURL__key__r_n_____string____r_n_____key_hashedAdminPassword__key__r_n_____string____r_n_____key_allowQuit__key__r_n_____true____r_n_____key_ignoreExitKeys__key__r_n_____true____r_n_____key_hashedQuitPassword__key__r_n_____string____r_n_____key_exitKey1__key__r_n_____integer_2__integer__r_n_____key_exitKey2__key__r_n_____integer_10__integer__r_n_____key_exitKey3__key__r_n_____integer_5__integer__r_n_____key_sebMode__key__r_n_____integer_0__integer__r_n_____key_browserMessagingSocket__key__r_n_____string_ws:__localhost:8706__string__r_n_____key_browserMessagingPingTime__key__r_n_____integer_120000__integer__r_n_____key_sebConfigPurpose__key__r_n_____integer_0__integer__r_n_____key_allowPreferencesWindow__key__r_n_____true____r_n_____key_useAsymmetricOnlyEncryption__key__r_n_____false____r_n_____key_browserViewMode__key__r_n_____integer_1__integer__r_n_____key_browserWindowAllowAddressBar__key__r_n_____false____r_n_____key_newBrowserWindowAllowAddressBar__key__r_n_____false____r_n_____key_mainBrowserWindowWidth__key__r_n_____string_100___string__r_n_____key_mainBrowserWindowHeight__key__r_n_____string_100___string__r_n_____key_mainBrowserWindowPositioning__key__r_n_____integer_1__integer__r_n_____key_enableBrowserWindowToolbar__key__r_n_____false____r_n_____key_hideBrowserWindowToolbar__key__r_n_____false____r_n_____key_showMenuBar__key__r_n_____false____r_n_____key_showTaskBar__key__r_n_____true____r_n_____key_showSideMenu__key__r_n_____true____r_n_____key_taskBarHeight__key__r_n_____integer_40__integer__r_n_____key_touchOptimized__key__r_n_____false____r_n_____key_enableZoomText__key__r_n_____false____r_n_____key_enableZoomPage__key__r_n_____true____r_n_____key_zoomMode__key__r_n_____integer_0__integer__r_n_____key_allowSpellCheck__key__r_n_____false____r_n_____key_allowDictionaryLookup__key__r_n_____false____r_n_____key_allowSpellCheckDictionary__key__r_n_____array___array__r_n_____key_additionalDictionaries__key__r_n_____array___array__r_n_____key_showReloadButton__key__r_n_____true____r_n_____key_showTime__key__r_n_____true____r_n_____key_showInputLanguage__key__r_n_____false____r_n_____key_enableTouchExit__key__r_n_____false____r_n_____key_oskBehavior__key__r_n_____integer_2__integer__r_n_____key_audioControlEnabled__key__r_n_____true____r_n_____key_audioMute__key__r_n_____false____r_n_____key_audioVolumeLevel__key__r_n_____integer_25__integer__r_n_____key_audioSetVolumeLevel__key__r_n_____false____r_n_____key_allowDeveloperConsole__key__r_n_____false____r_n_____key_batteryChargeThresholdCritical__key__r_n_____real_0.1__real__r_n_____key_batteryChargeThresholdLow__key__r_n_____real_0.2__real__r_n_____key_browserScreenKeyboard__key__r_n_____false____r_n_____key_newBrowserWindowByLinkPolicy__key__r_n_____integer_1__integer__r_n_____key_newBrowserWindowByScriptPolicy__key__r_n_____integer_2__integer__r_n_____key_newBrowserWindowByLinkBlockForeign__key__r_n_____false____r_n_____key_newBrowserWindowByScriptBlockForeign__key__r_n_____false____r_n_____key_newBrowserWindowByLinkWidth__key__r_n_____string_1000__string__r_n_____key_newBrowserWindowByLinkHeight__key__r_n_____string_100___string__r_n_____key_newBrowserWindowByLinkPositioning__key__r_n_____integer_2__integer__r_n_____key_newBrowserWindowShowURL__key__r_n_____integer_0__integer__r_n_____key_browserWindowShowURL__key__r_n_____integer_1__integer__r_n_____key_enablePlugIns__key__r_n_____true____r_n_____key_enableJava__key__r_n_____false____r_n_____key_enableJavaScript__key__r_n_____true____r_n_____key_blockPopUpWindows__key__r_n_____false____r_n_____key_allowVideoCapture__key__r_n_____false____r_n_____key_allowAudioCapture__key__r_n_____false__
mov rcx, rax
call sym.fwrite
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
lea r9, str.ReSebMod
mov r8, rdx
lea rdx, str._n_________string__s_s__string__n
mov rcx, rax
call dbg.fprintf
mov eax, 0x1cb5
cdqe
mov rdx, qword [rbp - 0x10]
mov r9, rdx
mov r8, rax
mov edx, 1
lea rax, str._________key_identifier__key__r_n_________string____r_n_________key_arguments__key__r_n_________array___array__r_n_________key_signature__key__r_n_________string____r_n________dict__r_n_______dict__r_n_________key_active__key__r_n_________true____r_n_________key_autostart__key__r_n_________false____r_n_________key_iconInTaskbar__key__r_n_________false____r_n_________key_runInBackground__key__r_n_________true____r_n_________key_allowUserToChooseApp__key__r_n_________false____r_n_________key_strongKill__key__r_n_________false____r_n_________key_os__key__r_n_________integer_1__integer__r_n_________key_title__key__r_n_________string_chrome__string__r_n_________key_description__key__r_n_________string____r_n_________key_executable__key__r_n_________string_chrome.exe__string__r_n_________key_originalName__key__r_n_________string_chrome.exe__string__r_n_________key_windowHandlingProcess__key__r_n_________string____r_n_________key_path__key__r_n_________string____r_n_________key_identifier__key__r_n_________string____r_n_________key_arguments__key__r_n_________array___array__r_n_________key_signature__key__r_n_________string_607a3edaa64933e94422fc8f0c80388e0590986c__string__r_n________dict__r_n______array__r_n_____key_prohibitedProcesses__key__r_n_____array___array__r_n_____key_enableURLFilter__key__r_n_____false____r_n_____key_enableURLContentFilter__key__r_n_____false____r_n_____key_URLFilterRules__key__r_n_____array___array__r_n_____key_URLFilterEnable__key__r_n_____false____r_n_____key_URLFilterEnableContentFilter__key__r_n_____false____r_n_____key_blacklistURLFilter__key__r_n_____string____r_n_____key_whitelistURLFilter__key__r_n_____string____r_n_____key_urlFilterTrustedContent__key__r_n_____true____r_n_____key_urlFilterRegex__key__r_n_____true____r_n_____key_embeddedCertificates__key__r_n_____array___array__r_n_____key_pinEmbeddedCertificates__key__r_n_____false____r_n_____key_proxySettingsPolicy__key__r_n_____integer_0__integer__r_n_____key_proxies__key__r_n_____dict__r_n_______key_ExceptionsList__key__r_n_______array___array__r_n_______key_ExcludeSimpleHostnames__key__r_n_______false____r_n_______key_AutoDiscoveryEnabled__key__r_n_______false____r_n_______key_AutoConfigurationEnabled__key__r_n_______false____r_n_______key_AutoConfigurationJavaScript__key__r_n_______string____r_n_______key_AutoConfigurationURL__key__r_n_______string____r_n_______key_FTPPassive__key__r_n_______true____r_n_______key_HTTPEnable__key__r_n_______false____r_n_______key_HTTPPort__key__r_n_______integer_80__integer__r_n_______key_HTTPProxy__key__r_n_______string____r_n_______key_HTTPRequiresPassword__key__r_n_______false____r_n_______key_HTTPUsername__key__r_n_______string____r_n_______key_HTTPPassword__key__r_n_______string____r_n_______key_HTTPSEnable__key__r_n_______false____r_n_______key_HTTPSPort__key__r_n_______integer_443__integer__r_n_______key_HTTPSProxy__key__r_n_______string____r_n_______key_HTTPSRequiresPassword__key__r_n_______false____r_n_______key_HTTPSUsername__key__r_n_______string____r_n_______key_HTTPSPassword__key__r_n_______string____r_n_______key_FTPEnable__key__r_n_______false____r_n_______key_FTPPort__key__r_n_______integer_21__integer__r_n_______key_FTPProxy__key__r_n_______string____r_n_______key_FTPRequiresPassword__key__r_n_______false____r_n_______key_FTPUsername__key__r_n_______string____r_n_______key_FTPPassword__key__r_n_______string____r_n_______key_SOCKSEnable__key__r_n_______false____r_n_______key_SOCKSPort__key__r_n_______integer_1080__integer__r_n_______key_SOCKSProxy__key__r_n_______string____r_n_______key_SOCKSRequiresPassword__key__r_n_______false____r_n_______key_SOCKSUsername__key__r_n_______string____r_n_______key_SOCKSPassword__key__r_n_______string____r_n_______key_RTSPEnable__key__r_n_______false____r_n_______key_RTSPPort__key__r_n_______integer_554__integer__r_n_______key_RTSPProxy__key__r_n_______string____r_n_______key_RTSPRequiresPassword__key__r_n_______false____r_n_______key_RTSPUsername__key__r_n_______string____r_n_______key_RTSPPassword__key__r_n_______string____r_n______dict__r_n_____key_se
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.fclose
lea rax, str.Successfully_created_SEB_Profile.
mov rcx, rax
call sym.puts
nop
add rsp, 0xb0
pop rbp
ret