joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003354
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
cmp ecx, 0x59
jle 0x1800033a9
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
cvttss2si rcx, dword [0x180037420]
xorps xmm1, xmm1
xorps xmm0, xmm0
lea rax, [rcx + 0xf96]
cvtsi2ss xmm1, rax
cvtsi2ss xmm0, rcx
mulss xmm1, dword [0x180037420]
addss xmm1, xmm0
jmp 0x18000357b
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ecx, 0x39
call fcn.18000359c
mov eax, 0x3d
mov ecx, eax
call fcn.180003354
movsxd rbx, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
call fcn.180003738
mov ecx, ebx
mov rdi, rax
call fcn.180003354
imul edi, ebx
imul edi, eax
cmp edi, 0x3e
jge 0x1800033be
cmp edi, 0x65
jle 0x1800033fa
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, 1
mov ebx, 0x48
cmp edi, 0x11
jne 0x180003414
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add rbx, rbx
mov edi, ebx
cmp ebx, 0x11
je 0x180003404
cmp edi, 0x4c
jg 0x18000344d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movsd xmm0, qword [0x180037178]
call fcn.180003738
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
cvttsd2si ecx, xmm6
call fcn.18000359c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm6, xmm0
cvttsd2si edi, xmm6
cmp edi, 0x7f
jg 0x1800033b9
cmp edi, 0x71
je 0x18000357f
call qword [sym.imp.USER32.dll_GetClipboardViewer]
mov ecx, 0x12
call fcn.18000359c
sub eax, 2
cmp eax, 0x44
je 0x180003487
mov ecx, 1
call fcn.180003354
movsx eax, al
sub eax, 0x2c
movsd xmm6, qword [0x1800371b8]
movss xmm8, dword [0x1800373b8]
cmp eax, 0x70
jg 0x1800034f0
movsd xmm7, qword [0x180037248]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
mulsd xmm7, xmm6
cvtps2pd xmm0, xmm8
movaps xmm1, xmm7
movaps xmm6, xmm7
subsd xmm1, xmm0
movaps xmm0, xmm7
mulsd xmm0, xmm7
cvttsd2si eax, xmm1
cvtpd2ps xmm8, xmm0
movsx eax, al
movd xmm7, eax
cvtdq2pd xmm7, xmm7
cvtps2pd xmm0, xmm8
movaps xmm1, xmm7
addsd xmm1, xmm6
subsd xmm1, xmm0
cvttsd2si eax, xmm1
cmp eax, 0x70
jle 0x1800034a5
cmp eax, 0x63
jne 0x180003500
call qword [sym.imp.KERNEL32.dll_GetACP]
mov eax, 1
cmp eax, 0x55
jge 0x18000353b
mov ecx, 0x5b
call fcn.180003354
movsxd rcx, eax
xorps xmm6, xmm6
cvtsi2ss xmm6, rcx
call fcn.180003354
movaps xmm1, xmm6
mulss xmm6, dword [0x1800373b0]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
addss xmm1, xmm6
jmp 0x18000357b
call qword [sym.imp.GDI32.dll_GdiFlush]
cvttss2si rax, dword [0x18003741c]
movsd xmm0, qword [0x180037208]
xorps xmm6, xmm6
cvtsi2ss xmm6, rax
call fcn.180003738
movss xmm0, dword [0x1800373b0]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
subss xmm0, xmm6
mulss xmm1, xmm6
mulss xmm1, xmm0
cvttss2si edi, xmm1
mov rbx, qword [rsp + 0x60]
mov eax, edi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x180003680
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
movss xmm6, dword [0x180037310]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cvttss2si ecx, xmm6
call fcn.180003354
movsxd rcx, eax
xorps xmm3, xmm3
mov rax, rcx
xorps xmm2, xmm2
imul rax, rcx
cvtsi2sd xmm3, rcx
movaps xmm0, xmm3
cvtsi2sd xmm2, rax
addsd xmm0, xmm2
cvtpd2ps xmm6, xmm0
cvtps2pd xmm1, xmm6
mulsd xmm1, xmm2
addsd xmm1, xmm3
cvttsd2si ecx, xmm1
cmp cl, 0x55
jne 0x1800036ee
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0xb
call fcn.18000359c
lea ecx, [rax + 0xb]
mov ebx, 0x34
jmp 0x180003715
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebx
call fcn.180003354
movsx rcx, al
imul rbx, rcx
movsx eax, al
movsx ecx, bl
imul ecx, eax
add cl, cl
cmp cl, 0x50
jne 0x1800036f5
cmp cl, 0x61
jne 0x180003693
movsd xmm0, qword [0x180037230]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret

Function at 0x1800037a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, 0x25
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
imul rbx, rbx
cmp bl, 0x15
jl 0x1800037af
mov dil, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov cl, dil
call fcn.1800037fc
movsx ebx, al
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
call fcn.180003ac8
mov rdi, rax
movsx ecx, al
mov eax, ebx
cdq
idiv ecx
cmp al, 0xf
jge 0x1800037c1
movsx eax, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800039e0
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm7
movsd xmm7, qword [0x180037248]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cvttsd2si ebx, xmm7
mov cl, bl
call fcn.1800037fc
mov cl, bl
mov edi, eax
call fcn.1800037a0
movd xmm0, edi
mov r10b, 0x7d
cvtdq2pd xmm0, xmm0
mov r9d, 0x71
movd xmm7, eax
cvtdq2pd xmm7, xmm7
subsd xmm0, xmm7
cvttsd2si ecx, xmm0
cmp cl, 0x53
jl 0x180003a66
lea r8d, [r9 + 0xc]
mov rax, r9
add r10b, r9b
cqo
movsx ecx, r10b
idiv r8
movsx r8, r10b
add r9, r8
movsx edx, r9b
imul edx, ecx
add dl, al
mov cl, dl
cmp dl, 0x53
jge 0x180003a40
mov bl, 0x18
jmp 0x180003a9b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov cl, bl
call fcn.1800037a0
mov cl, bl
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call fcn.1800037a0
movsx ecx, al
mov ebx, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
cvttsd2si ecx, xmm0
cmp cl, 0x68
jle 0x180003a6a
cmp cl, 0x27
jne 0x1800039fc
movss xmm0, dword [0x180037338]
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rdi
ret
Function at 0x180003d14
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov edi, 0xb
call qword [sym.imp.USER32.dll_EmptyClipboard]
movsd xmm2, qword [0x180037168]
mov eax, edi
cdq
idiv edi
movsx edi, al
mov r8d, eax
imul edi, edi
sub r8b, dil
movsx ecx, r8b
cmp ecx, 0x80
je 0x180003d97
movsd xmm1, qword [0x180037288]
movaps xmm0, xmm2
divsd xmm0, xmm1
cvttsd2si ecx, xmm2
cvttsd2si ebx, xmm0
call fcn.180003c84
movd xmm2, eax
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm2, xmm2
movaps xmm0, xmm1
addsd xmm0, xmm2
cvttsd2si eax, xmm0
movsx r8d, al
cmp r8d, 0x80
jne 0x180003d5b
cmp r8b, 0x3a
jge 0x180003dba
xor edx, edx
movsx eax, dl
movsx ecx, dl
imul ecx, eax
movsx eax, dl
cdq
movsx ecx, cl
idiv ecx
mov edx, eax
mov r8b, al
cmp al, 0x3a
jl 0x180003d9f
movsd xmm1, qword [0x180037258]
cmp r8b, 0x1e
jl 0x180003ddd
movaps xmm0, xmm1
addsd xmm0, xmm1
cvttsd2si eax, xmm0
movaps xmm1, xmm0
mov r8b, al
cmp al, 0x1e
jge 0x180003dc8
cmp r8b, 0x57
je 0x180003dec
call qword [sym.imp.SHELL32.dll_InitNetworkAddressControl]
mov r8b, 0xff
cmp r8b, 0x4e
jle 0x180003d28
movsd xmm6, qword [0x1800371d8]
mov ebx, 0x3b
cvttsd2si ecx, xmm6
call fcn.180003d14
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mov al, 0x28
mov cl, al
call fcn.180003d14
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
cvttsd2si eax, xmm0
cmp al, 0x7e
jg 0x180003e16
cmp al, 0x7b
jle 0x180003e4a
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
call fcn.180003b70
add al, al
sub al, bl
jmp 0x180003e5e
mov eax, 0x674
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
call fcn.180003b70
add al, 0x74
cmp al, 0x30
jge 0x180003e6a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov al, 0x64
cmp al, 0x11
jge 0x180003e03
mov rbx, qword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x20]
movsx rax, al
add rsp, 0x30
pop rdi
ret
Function at 0x180006394
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
jmp 0x1800063e1
mov r8, qword [rdx + 0x50]
xor ecx, ecx
movzx r9d, word [rdx + 0x48]
ror ecx, 0xd
cmp byte [r8], 0x61
jb 0x1800063c6
movzx eax, byte [r8]
sub eax, 0x20
cdqe
jmp 0x1800063ca
movzx eax, byte [r8]
add rcx, rax
inc r8
sub r9, 1
jne 0x1800063b2
cmp ecx, 0x6a4abc5b
je 0x1800063e9
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1800063a7
xor eax, eax
ret
mov r8, qword [rdx + 0x20]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
mov edx, dword [r11 + r8 + 0x20]
mov ecx, dword [r11 + r8 + 0x24]
add rdx, r8
add rcx, r8
mov r9d, dword [rdx]
add r9, r8
xor r10d, r10d
mov al, byte [r9]
inc r9
ror r10d, 0xd
movsx eax, al
add r10d, eax
mov al, byte [r9]
test al, al
jne 0x180006415
cmp r10d, 0x3bd09a55
je 0x18000643c
add rdx, 4
add rcx, 2
jmp 0x180006409
movzx edx, word [rcx]
mov ecx, dword [r11 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
ret

Function at 0x180006750
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x1800067e2
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x1800067bc
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800067db
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800067db
mov rdx, qword [rdi]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
jmp 0x1800067cb
cmp dword [rdi + 8], 0
je 0x1800067db
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x1800067cb
cmp byte [0x180040f00], 0
jne 0x18000682d
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180006819
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x180040ef8], rax
jmp 0x180006820
mov r10, qword [0x180040ef8]
mov eax, 1
mov byte [0x180040f00], al
jmp 0x180006834
mov r10, qword [0x180040ef8]
mov rcx, qword [rbx]
mov rdx, rsi
test r10, r10
je 0x1800067c5
mov r8d, dword [rbx + 8]
xor r9d, r9d
call r10
jmp 0x1800067cb
Function at 0x18000693c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x18003e008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r9d, dword [rcx + 8]
xor eax, eax
mov rsi, rdx
mov qword [rsp + 0x48], rax
mov r8, rdx
mov dword [rsp + 0x48], eax
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call fcn.18000684c
jmp 0x1800069ab
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.18000693c
mov ebx, eax
test eax, eax
jne 0x180006a15
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
xor ebx, ebx
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18000699c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180006a04
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbx
mov rdx, rsi
mov dword [rsp + 0x48], ebx
mov rcx, rdi
call fcn.180006750
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180006a25
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18000a6e0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006f44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x18003e008]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdi
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.18000d260
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180006fe3
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180006fe3
call fcn.180006474
mov ebx, eax
jmp 0x1800070f4
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180007004
call fcn.180006474
jmp 0x1800070e3
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180006ffa
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x18000703f
mov ebx, 0x8007000e
jmp 0x1800070e5
mov ecx, eax
test eax, eax
je 0x180007077
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18000706d
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180007077
lea rcx, [rsp + 0x70]
call fcn.18000a428
jmp 0x180007081
mov ecx, 0x80070216
call fcn.180006458
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180007093
cmp qword [rsp + 0x70], rdi
je 0x180007035
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x180006ffa
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180007d9c
mov ebx, eax
test rsi, rsi
je 0x1800070f4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000710b
lea rcx, [rsp + 0x70]
call fcn.18000a298
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18000a6e0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180009738
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18003e008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14d, edx
mov rdi, rcx
or ebx, 0xffffffff
xor esi, esi
cmp edx, ebx
jne 0x180009787
cmp edx, ebx
cmovne esi, edx
mov eax, esi
jmp 0x180009951
mov rax, qword [rcx + 0x40]
cmp qword [rax], rsi
je 0x1800097c1
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x1800097c1
lea ecx, [r8 - 1]
mov dword [rdx], ecx
mov rdx, qword [rdi + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], r14b
mov eax, r14d
jmp 0x180009951
cmp qword [rdi + 0x80], rsi
je 0x18000994f
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1800097fb
mov rdx, qword [rdi + 0x90]
mov rcx, qword [rdi + 0x88]
mov qword [r8], rcx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
cmp qword [rdi + 0x68], rsi
jne 0x18000981c
movsx ecx, r14b
mov rdx, qword [rdi + 0x80]
call fcn.180010e58
cmp eax, ebx
cmovne ebx, r14d
jmp 0x18000994f
mov byte [rbp - 1], r14b
mov qword [rbp + 0x1f], 0xf
mov qword [rbp + 0x17], rsi
mov byte [rbp + 7], sil
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp + 7]
call fcn.180002728
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 1]
lea rdx, [rdi + 0x74]
call qword [r10 + 0x38]
test eax, eax
js 0x180009931
cmp eax, 1
jg 0x180009916
lea rax, [rbp + 7]
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
cmovae rax, r10
mov r15, qword [rbp - 0x11]
sub r15, rax
je 0x1800098de
lea rcx, [rbp + 7]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x80]
mov r8, r15
mov edx, 1
call fcn.180011af4
cmp r15, rax
jne 0x180009931
mov byte [rdi + 0x71], 1
lea rax, [rbp - 1]
cmp qword [rbp - 9], rax
jne 0x180009911
test r15, r15
jne 0x180009841
cmp qword [rbp + 0x17], 0x20
jae 0x180009931
xor r8d, r8d
lea edx, [r15 + 8]
lea rcx, [rbp + 7]
call fcn.180002d74
jmp 0x180009841
mov ebx, r14d
jmp 0x180009931
cmp eax, 3
jne 0x180009931
movsx ecx, byte [rbp - 1]
mov rdx, qword [rdi + 0x80]
call fcn.180010e58
cmp eax, ebx
cmovne ebx, r14d
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
jb 0x18000994f
lea rdx, [r9 + 1]
mov r8d, 1
mov rcx, qword [rbp + 7]
call fcn.180001818
nop
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18000a6e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180009fa4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18003e008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x68], rbx
je 0x18000a0f0
cmp byte [rcx + 0x71], bl
je 0x18000a0f0
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x180009ffd
xor al, al
jmp 0x18000a0f2
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x30], bl
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.180002728
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea r8, [rbp - 0x30]
cmovae r8, qword [rbp - 0x30]
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
mov ecx, eax
test eax, eax
je 0x18000a060
sub ecx, 1
jne 0x18000a0c7
jmp 0x18000a063
mov byte [rdi + 0x71], bl
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov rsi, qword [rbp - 0x38]
sub rsi, rax
je 0x18000a0a5
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
call fcn.180011af4
cmp rsi, rax
jne 0x18000a0ce
cmp byte [rdi + 0x71], bl
je 0x18000a0cc
test rsi, rsi
jne 0x18000a01d
xor r8d, r8d
lea edx, [rsi + 8]
lea rcx, [rbp - 0x30]
call fcn.180002d74
jmp 0x18000a01d
cmp ecx, 2
jne 0x18000a0ce
mov bl, 1
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
jb 0x18000a0ec
lea rdx, [r9 + 1]
mov r8d, 1
mov rcx, qword [rbp - 0x30]
call fcn.180001818
nop
mov al, bl
jmp 0x18000a0f2
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000a6e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140009880
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1400098cc
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000991a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140009915
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009939
mov rcx, r8
call fcn.140028ec4
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], sil
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.14004a234
int3

Function at 0x140009940
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov rax, qword [rbx + 0x10]
jb 0x140009992
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r8d, [rax + rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400099e5
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400099e0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009a04
mov rcx, r8
call fcn.140028ec4
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.14004a234
int3
Function at 0x14000c320
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x140092088]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov r15, rdx
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
cmp qword [rcx + 0x18], 8
jb 0x14000c371
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000c3a6
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 7
mov word [r15], ax
lea r8d, [rax + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, r15
call fcn.140001ff0
jmp 0x14000c4c5
mov ecx, 0x208
mov r15d, 1
call fcn.1400291e8
mov rsi, rax
movdqa xmm0, xmmword [0x1400812f0]
movdqu xmmword [rsp + 0x58], xmm0
xor eax, eax
mov word [rsp + 0x48], ax
mov ebp, 0x104
lea rdi, [rax - 1]
nop word [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14000c3ed
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000c3fa
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14000c409
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14000c417
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [rbp - 1]
cmp eax, ecx
jb 0x14000c48b
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000c43d
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000c457
add rax, 2
test ecx, ecx
jne 0x14000c443
test edx, edx
je 0x14000c48b
mov rcx, rsi
call fcn.140028ec4
inc r15d
imul ebp, r15d, 0x104
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400291e8
mov rsi, rax
jmp 0x14000c3e0
mov r15, qword [rsp + 0x30]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14000c490
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140001ff0
mov rcx, rsi
call fcn.140028ec4
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [r15 + 0x10], xmm1
mov rax, r15
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140028ea0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret