joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x517314
jb 0x517373
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00517060
aeskeygenassist xmm1, xmm0, 1
call fcn.00517080
aeskeygenassist xmm1, xmm2, 2
call fcn.00517060
aeskeygenassist xmm1, xmm0, 2
call fcn.00517080
aeskeygenassist xmm1, xmm2, 4
call fcn.00517060
aeskeygenassist xmm1, xmm0, 4
call fcn.00517080
aeskeygenassist xmm1, xmm2, 8
call fcn.00517060
aeskeygenassist xmm1, xmm0, 8
call fcn.00517080
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00517060
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00517080
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00517060
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00517080
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00517060
jmp 0x5173e1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00516fc0
aeskeygenassist xmm1, xmm2, 2
call fcn.00517020
aeskeygenassist xmm1, xmm2, 4
call fcn.00516fc0
aeskeygenassist xmm1, xmm2, 8
call fcn.00517020
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00516fc0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00517020
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00516fc0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00517020
jmp 0x5173e1
aeskeygenassist xmm1, xmm0, 1
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 2
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 4
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 8
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00516f80
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00516f80
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x5173ee
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x517940
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x517a74
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.00517660
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x5179d4
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x517a17
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x517a41
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x5179ce
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x5179ce
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x517a2a
mov rax, rsi
mov ecx, 0x20
call fcn.00465b00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00463840
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00517940
Function at 0x518e20
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x518ea5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x519006
cmp rcx, 0xe
jne 0x518f20
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x519006
cmp rcx, 0xf
jne 0x518f97
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x519006
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x5238a0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5238b8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5238b8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5238c0
xor eax, eax
ret
cmp rbx, 3
je 0x5238cc
cmp rbx, 4
jne 0x5238f9
cmp al, 0x2c
ja 0x5238e6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5238f6
cmp al, 0x24
je 0x5238f6
nop dword [rax]
cmp al, 0x26
jae 0x5238f6
jmp 0x5238f9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5238f6
cmp al, 0x5b
je 0x5238f6
cmp al, 0x5d
jne 0x5238f9
xor eax, eax
ret
cmp al, 0x2f
ja 0x523932
nop dword [rax]
cmp al, 0x26
ja 0x523911
cmp al, 0x24
je 0x523951
cmp al, 0x26
je 0x523951
jmp 0x5239cb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x523951
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5239c8
cmp al, 0x2f
je 0x523951
jmp 0x5239cb
cmp al, 0x3d
ja 0x523949
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x523951
nop
cmp al, 0x3d
je 0x523951
jmp 0x5239cb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5239c0
cmp rbx, 2
jg 0x523987
cmp rbx, 1
je 0x523981
nop dword [rax]
cmp rbx, 2
jne 0x5239cb
cmp al, 0x2f
je 0x523972
cmp al, 0x3b
je 0x523972
cmp al, 0x2c
jne 0x523979
mov ecx, 1
jmp 0x52397e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5239aa
cmp al, 0x40
je 0x523999
cmp al, 0x2f
je 0x523999
cmp al, 0x3f
jne 0x5239a2
mov ecx, 1
nop
jmp 0x5239a7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5239b9
cmp rbx, 7
jne 0x5239cb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5239c8
cmp al, 0x7e
jne 0x5239cb
xor eax, eax
ret
cmp rbx, 7
jne 0x5239e1
cmp al, 0x21
je 0x5239dd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5239e1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x52b9e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x52bab5
movdqa xmm0, xmmword [0x00628d90]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x52ba21
movdqa xmm0, xmmword [0x00628da0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x52bb37
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x52bb0b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00628b20]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00628db0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x1400019f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a3a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a3a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a3a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a3c
xor al, al
add rsp, 0x28
ret
Function at 0x140006d60
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.140006a1c
xor edi, edi
test eax, eax
js 0x140006efc
call fcn.140006410
call fcn.1400062e8
test eax, eax
js 0x140006efc
mov rax, qword [0x14000b008]
lea r9, [0x14000b020]
xorps xmm1, xmm1
lea r8, [section..data]
lea rdx, [0x140001340]
lea rcx, [rsp + 0xa0]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [0x14000b028], xmm1
movdqu xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.ntdll.dll_EtwEventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x140006e13
mov rax, qword [0x14000b5f8]
test rax, rax
je 0x140006e13
mov r8, qword [0x14000b008]
lea edx, [rdi + 2]
mov rcx, qword [0x14000b020]
movzx r9d, word [r8]
call qword [0x1400084c8]
mov eax, edi
test eax, eax
js 0x140006efc
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov rbx, rax
mov dl, dil
movzx eax, word [rax]
test ax, ax
je 0x140006e75
movzx ecx, ax
cmp cx, 0x20
ja 0x140006e47
movzx eax, cx
test dl, dl
je 0x140006e70
cmp cx, 0x22
jne 0x140006e52
test dl, dl
sete dl
add rbx, 2
movzx eax, word [rbx]
movzx ecx, ax
test ax, ax
jne 0x140006e3a
jmp 0x140006e70
cmp ax, 0x20
ja 0x140006e75
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140006e63
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop dword [rax + rax]
lea rdx, str._install
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140006eba
lea rdx, str._uninstall
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006ec1
mov ebx, 0x80004001
jmp 0x140006ef2
mov r8d, 0x17
lea rdx, str.GlobalGameInputSession
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006eeb
mov rcx, rbx
call fcn.1400059f8
jmp 0x140006ef0
call fcn.1400036a4
mov ebx, eax
call fcn.140006c74
shr ebx, 0x1f
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140006f60
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
sub rsp, 0x28
call fcn.14009c000
add rsp, 0x28
jmp 0x140006d60
Function at 0x1400ba050
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
lea r13, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, r13
je 0x1400ba0be
test byte [rcx + 0x1c], 1
je 0x1400ba0be
cmp byte [rcx + 0x19], 5
jb 0x1400ba0be
mov edx, 0x53
mov qword [rax - 0x58], r8
mov r9, rdi
lea r8, [0x1400e7210]
mov rcx, qword [rcx + 0x10]
call fcn.14000a2d8
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140004a80
nop
lea rcx, [rbp - 0x28]
call fcn.1400336f0
mov r8, qword [rbp - 0x28]
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.1400bbe70
mov ebx, eax
test eax, eax
jne 0x1400ba174
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400ba135
cmp dword [rbp - 0x2c], 4
je 0x1400ba133
lea ebx, [rax + 0xd]
xor ebx, ebx
cmp ebx, 2
jne 0x1400ba194
mov ebx, 0x490
mov r10, qword [0x140106190]
cmp r10, r13
je 0x1400ba1d5
test byte [r10 + 0x1c], 2
je 0x1400ba19b
cmp byte [r10 + 0x19], 4
jb 0x1400ba19b
mov edx, 0x54
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.140003538
jmp 0x1400ba194
cmp eax, 2
jne 0x1400ba194
mov rax, qword [r14]
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, r14
mov rax, qword [rax + 0x38]
call qword [case.0x14006d218.0]
mov ebx, eax
Function at 0x10000bae0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100011df8], rdi
je 0x10000bb40
cmp rax, rdi
jne 0x10000bb33
mov r12d, 1
jmp 0x10000bb40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000bb19
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bb55
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10000bbbc
mov eax, dword [0x100011df0]
cmp eax, ebx
jne 0x10000bbb2
mov dword [0x100011df0], 1
lea r13, [0x100001448]
lea rdi, [0x100001430]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000bba4
cmp eax, ebx
jne 0x10000bba4
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10000bb99
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10000bb82
cmp eax, ebx
je 0x10000bbbc
mov eax, 0xff
jmp 0x10000bd04
mov dword [0x1000115d4], 1
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bbe4
lea rdx, [0x100001428]
lea rcx, [0x1000013f0]
call sub.msvcrt.dll__initterm
mov dword [0x100011df0], 2
cmp r12d, ebx
jne 0x10000bbf3
mov rax, rbx
xchg qword [0x100011df8], rax
cmp qword [0x100011e10], rbx
je 0x10000bc1b
lea rcx, [0x100011e10]
call fcn.10000c0cc
cmp eax, ebx
je 0x10000bc1b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100011e10]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10000bc31
mov eax, 0xff
jmp 0x10000bd04
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc4c
cmp edx, ebx
jne 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc62
cmp word [rcx], 0x20
ja 0x10000bc62
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc4c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100002d14
mov dword [0x1000115d0], eax
cmp dword [0x1000115b4], ebx
jne 0x10000bca0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000115d4], ebx
jne 0x10000bcb4
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000115d0]
jmp 0x10000bd04
cmp word [rcx], 0x22
jne 0x10000bcc9
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc3d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10013b000
add rsp, 0x28
jmp 0x10000bae0
Function at 0x140009cc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140009d0c
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140009d5a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140009d55
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009d79
mov rcx, r8
call fcn.14002c374
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], sil
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.140050bc0
int3

Function at 0x140009d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov rax, qword [rbx + 0x10]
jb 0x140009dd2
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r8d, [rax + rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140009e25
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140009e20
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009e44
mov rcx, r8
call fcn.14002c374
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.140050bc0
int3
Function at 0x14000bd40
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x14009c080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov r15, rdx
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
cmp qword [rcx + 0x18], 8
jb 0x14000bd91
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000bdc6
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 7
mov word [r15], ax
lea r8d, [rax + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, r15
call fcn.1400020a0
jmp 0x14000bee5
mov ecx, 0x208
mov r15d, 1
call fcn.14002c698
mov rsi, rax
movdqa xmm0, xmmword [0x140089b80]
movdqu xmmword [rsp + 0x58], xmm0
xor eax, eax
mov word [rsp + 0x48], ax
mov ebp, 0x104
lea rdi, [rax - 1]
nop word [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14000be0d
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000be1a
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14000be29
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14000be37
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [rbp - 1]
cmp eax, ecx
jb 0x14000beab
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000be5d
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000be77
add rax, 2
test ecx, ecx
jne 0x14000be63
test edx, edx
je 0x14000beab
mov rcx, rsi
call fcn.14002c374
inc r15d
imul ebp, r15d, 0x104
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14002c698
mov rsi, rax
jmp 0x14000be00
mov r15, qword [rsp + 0x30]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14000beb0
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400020a0
mov rcx, rsi
call fcn.14002c374
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [r15 + 0x10], xmm1
mov rax, r15
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002c350
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret