joyce8/EMBER2024-capa huggingface dataset:
Function at 0x181403f83
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsxd rax, eax
mov r11d, dword [rsp + r10*2 - 0x64]
dec cl
shr word [rsp + r10*8 - 0x1a2], 0xee
adc r8, rax
rol edx, 0x89
cmovae esi, edi
mov r10w, word [rdx + rbx - 0x6f963e8a]
mov qword [rsp + rdx - 0x6f963e8e], 0xffffffffee8ada94
sub di, 0x6031
and esi, ecx
lea rbx, [rdx + rbx - 0x6f963e88]
xor r10w, bp
sar r11w, 0x66
mov qword [rsp + rdx - 0x6f963e7e], rdx
inc r10w
xor word [rsp + rdx - 0x6f963e83], cx
neg r10w
dec r10w
pop rcx
ror r10w, 1
call fcn.1813bd52a
mov esi, 0x96b60791
add esi, esi
movzx edi, si
mov edx, dword [rbx + rsi - 0x2d6c0f22]
lea rax, [rdi + 0x3a026825]
movsx ecx, ax
lea rbx, [rbx + rdi*2 - 0x1e40]
xor edx, ebp
ror edx, 2
lea edx, [rdx + rsi*2 - 0x10314a38]
bt di, ax
setb sil
not edx
lea r11, [rdi + rsi*4 - 0x34ce9ed1]
shr r11, 0x6f
cdqe
lea edx, [rdx + rsi*2 + 0x65b8090b]
add ecx, esi
lea r10, [rax + rax*4 - 0x54fa88e2]
xor edx, 0x5bb9c921
add sil, al
push rbp
movzx ebp, r11b
add r10w, r10w
not di
xor dword [rsp + rdi - 0xf0dd], edx
pop rbp
sal r11w, 0x88
shl al, 0x87
movsxd rdx, edx
add r8, rdx
movzx esi, word [rbx + rsi*2 - 0x5ad81e8e]
call fcn.1813f1211

Function at 0x181405b99
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
mul qword [rsp + r11 - 0xb5d]
mov qword [rsp + r11*2 - 0x16ca], rbp
movsx ebp, ax
xor dword [rsp + r11 - 0xb5d], edi
bswap rsi
mov rbp, qword [rsp + r11 - 0xb5d]
call fcn.18137c807

Function at 0x181407172
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rdi, [r9 + rax*4 + 0x1c2a8db9]
call fcn.18133ff75
mov edi, 0x14ad923b
rdtsc
mov ecx, edi
bts ecx, 6
movzx r10d, cl
lea r9, [r9 + rdi*2 - 0x295b247e]
ror edi, 0x86
mov esi, edi
inc rcx
mov dword [rcx + r9 - 0x14ad9278], eax
cmovge ecx, esi
adc ecx, ecx
shr r10d, cl
mov dword [r9 + r10*8], edx
mov edx, r10d
btr esi, r10d
mov esi, dword [rbx + r10*2]
xchg edi, ecx
call fcn.1813f34a4
call fcn.1814042ad

Function at 0x18140b179
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
xor r8b, bpl
dec rbx
xor di, di
xor r8b, 0x86
not r8b
ror r8b, 1
and di, di
and rbx, 0xffffffffc31c8827
movzx eax, word [rsp + rdx - 0xa09c]
neg r8b
rol r8b, 1
shl rax, 0x65
pop rax
xor bpl, r8b
btr ebx, eax
push rdx
lea r8, [rsp + r8 + 8]
btc eax, r9d
sal r9b, 0x47
mov word [rdx + r8 - 0xa0a0], cx
movsx ecx, word [rsp + rdx - 0xa0a0]
jns 0x181394f7e
pop rbx
sal di, 0xa8
mov cx, word [rsi + rdx*2 - 0x138]
lea rsi, [rsi + rdx - 0x96]
sal r8d, 0x7f
xadd dl, dh
adc r8b, byte [r11 + r8*8 - 6]
add word [rsp + rdx - 0xa09b], r9w
lea r11, [r11 + rdx*8 - 0x50506]
lea rbx, [rdi + rdi - 0x4ecf394a]
rol word [rsp + rdx - 0xa09f], 0x8b
jns 0x181359df3
Function at 0x18140bd8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc cx, word [rsp + rbx*8 + 0x14]
rol r9d, 1
cdqe
mov qword [rsp + rbx*8 + 0x10], rbp
mov ebp, eax
and rdx, 0x6057cb0
xor dword [rsp + rax + 0x14a65b4f], r9d
shl byte [rsp + rax*2 + 0x294cb684], cl
lea rcx, [rbx + rbx*2 + 0x54b10d8f]
mov rbp, qword [rsp + rax + 0x14a65b4f]
and rdx, 0xffffffffe304a2b4
and byte [rsp + rbx*8 + 0xe], ch
movsxd r9, r9d
push rcx
rol rbx, cl
adc r10, r9
mul r8
dec qword [rsp + rbx*8 - 0x37ff2]
mov qword [rsp + rbx - 0x7000], r10
ret 0x18
mov rdi, qword [rdi + rsi - 0xb2d5ea4]
mov ecx, dword [rdi + rbx*8]
lea r9, [rax*4 - 0x8c6057a]
mov dword [rsi + rbx*8 + 8], ecx
movsx edi, r9w
lea rsi, [rsi + rbx*8 + 8]
mov r9d, dword [r11 + rbx*8 - 6]
mov ecx, dword [rsp + rbx*8]
lea r11, [r11 + rbx*8 - 6]
imul dil
xor r9d, ebp
ror qword [rsp + rbx*8 + 8], cl
sbb r9d, ebx
push rdi
imul rdi
jae 0x18140e4f0
bswap r9d
lea r8, [rcx + rax*2 - 0x21ecece0]
sbb r9d, ebx
ror eax, 0xb5
jb 0x181382d53
sub r11, 1
mov r9d, 0x5502d529
movzx edi, r9w
movzx ebx, r9b
movzx edx, byte [r11 + r9 - 0x5502d529]
bswap edi
sub bl, bh
xor dl, bpl
lea rax, [r9*4 - 0x126522c8]
bswap r9d
inc dl
lea rcx, [rax*8 - 0x25729a55]
mov r8d, edi
not r9b
not dl
inc dl
inc di
xor dl, 0xa2
sub dl, 0x11
shl ax, cl
setp al
xor bpl, dl
bts ecx, ebx
adc rdx, rsp
xor r8b, byte [rdx + rbx - 0x29]
lea rsi, [rsi + r9*2 - 0x53aa0556]
sal ax, 0xc
mov word [rsi + rdi - 0x29d50001], r8w
xadd ecx, edi
lea r11, [r9 + r11 - 0x29d502ae]
push rdi
and r9w, 0x6d04
mov r8d, dword [r11 + r9 - 0x29d50000]
xor rdi, 0x643eb135
xor r8d, ebp
jmp 0x1814173a8
ror r8w, 1
inc r8w
shr dil, cl
rol r8w, 1
sar edi, cl
inc bl
mov qword [rsp + rbx*2 - 0x230e], rbx
dec r8w
imul edi, eax
xor r8w, 0x4586
xchg word [rsp + rdi - 0xb2d5ea5], cx
push rax
rol byte [rsp + rdi*2 - 0x165abd49], 0xc2
neg r8w
xor bp, r8w
push rdi
sal rbx, 0xbb
lea r8, [rsp + r8 + 0x18]
cbw
pop rdi
bt di, di
mov dword [r8 + rdi*4 - 0x2cb57aa0], edx
not qword [rsp + rdi*2 - 0x165abd4d]
ror rbx, 0x3e
jb 0x1813b2d65
rol eax, 1

Function at 0x18140c09c
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp], rdx
movzx edi, byte [r11 + riz - 1]
lea r9, [rdx + rdx*2 - 0x68ead075]
xor dil, bpl
sub byte [rsp + 1], 0x3d
sbb dil, 0x90
shr dword [rsp + 1], 0x1c
sar qword [rsp], 0x44
xor dil, 0x25
lea r8, [rdx - 0x2effedc1]
inc dil
xchg dword [rsp + r8 - 0x60a299d2], edx
bswap r9d
xchg byte [rsp + rdx], r9b
xor dil, 0x2c
movsx eax, r9b
xor bpl, dil
xchg r9w, ax
sal al, 0x25
xchg qword [rsp + rdx], rdx
lea rdi, [rsp + rdi + 8]
sbb dl, byte [rsp + rax*2 - 0x1f839]
cqo
lea r8, [rdx + r8*8 + 0x6708eea0]
mov qword [rdi + rdx*4], rbx
mov rcx, qword [rsi + rdx*2 + 8]
cdq
mov r9, qword [rcx + rdx*4]
mov qword [rsi + rdx + 8], r9
lea r9, [rax*2 + 0x1e2fadaf]
lea rsi, [rdx + rsi + 8]
mov r9d, dword [rdx + r11 - 5]
ror byte [rsp + rdx + 5], 0xe1
jae 0x18137107b
Function at 0x18140c13e
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
xadd qword [rsp + rcx - 0x78856800], rcx
mov r10, qword [rcx + r9 - 0x78854e2c]
lea r9, [rcx + r9 - 0x78854e24]
rol ecx, 0x5d
lea rdi, [rax*4 - 0x77cb0e2]
mov qword [rsp + rax*4 - 0x818], rax
mov qword ss:[r11 + rax*4 - 0x820], r10
or word [rsp + rax*4 - 0x820], cx
js 0x18139e368
mov ebx, dword [rsi]
mov edx, 0x3fbca602
movsx ecx, dl
push rcx
mov edi, dword [rdx + rsi - 0x3fbca5fe]
mov r8d, 0x2c1aaf2a
or ebx, edi
sal dx, cl
adc edx, dword [rsp + rcx*2 - 1]
sar dx, cl
not ebx
mov dword [rsi + rdx - 0x3fbce5fe], ebx
call fcn.1813f97c2
movzx r11d, al
mov qword [rsp + rax*8 - 0x1040], r8
ret 8
bt r10, 0xb0
inc esi
sal r11b, 0x22
lea rax, [r10 + 0x399dc3bd]
mov qword [rsp + r11 - 0x78854e2c], rbp
mov qword [rsp + r10 - 0x78854e8d], r11
add dx, 0xdd8d
xor dword [rsp + r11 - 0x78854e2c], esi
mov rbp, qword [rsp + r10 - 0x78854e85]
cdq
and rax, 0x2612478c
movsxd rsi, esi
cwde
adc r8, rsi
cwd
mov r11, qword [r11 + r9 - 0x78854e34]
jmp 0x1813718e9

Function at 0x18140ef84
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal dword [rsp + r11*2 + 0x24], 0xa7
mov eax, edx
mov qword [rsp + r11*4 + 0x20], rbp
jae 0x1813cb72a

Function at 0x181411bd4
Capabilities:
Execute anti-debugging instructions
Manually build aes constants

Disassembly:
sal bl, 0x62
movsxd r8, r8d
add r9w, r9w
btr edx, 0xb6
jae 0x181376799
xor r8d, 0x3122cfa8
mov qword [rsp + rdi*4], rdx
mov eax, edi
inc r8d
mov dword [rsp + rdi*4 + 9], edx
or bx, 0x2a2b
rol r8d, 2
pop r9
or qword [rsp + rdi], r9
sar qword [rsp + rdi], 0x3c
neg r8d
add qword [rsp + rdi], rbp
cbw
lea rbp, [rbx + rdx - 0x6dfef6eb]
xor dword [rsp + rdi*2], r8d
rol rdx, 0xdd
pop rbp
jae 0x181383d42

Function at 0x181413e01
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, ebp
mov qword [rsp + rbx*2 - 0xab0a], 0xdaa8321
neg r8d
or word [rsp + r9*2 - 0x6e23cc96], 0xc3a6
ror edx, 3
bt r9d, r8d
lea edx, [rdi + rdx - 0x72a70b1e]
not edx
call fcn.1813cfcd6
mov esi, dword [rbx + r10*2 + 0x29a2d244]
dec edi
and r10w, r10w
neg dil
lea rbx, [rbx + r10 + 0x14d16926]
shl r10b, 0x66
mov r11d, edx
movsx ecx, dl
xor esi, ebp
bswap r10d
shr dx, cl
sbb esi, 0x57000514
imul edi, ecx
sar rdx, 0xf5
xadd r11, rdx
neg esi
ror edi, 6
movsx eax, cl
rol esi, 2
inc esi
push rbp
dec dl
xor dword [rsp + rdi - 0x4000006d], esi
pop rbp
and r11b, al
movsxd rsi, esi
div ecx
call fcn.181365755

Function at 0x181413e93
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal eax, cl
xor r11d, 0x1f9112b4
mov qword [rsp + rcx - 0x725da27c], rbp
xor dword [rsp + rcx - 0x725da27c], r11d
div sil
cdqe
rol r10w, cl
mov rbp, qword [rsp + rax + 0x32a4bf3e]
mov qword [rsp + rax + 0x32a4bf3e], 0x26b6df07
and r10w, r10w
jbe 0x18139b8c6
movsxd r11, r11d
mov qword [rsp + rax + 0x32a4bf16], rsi
adc r8, r11
xchg word [rsp + rsi - 0x5b8f8b8d], r10w
cqo
lea rdi, [rsi + rsi*8 - 0x404b8167]
mov qword [rsp + rsi - 0x5b8f8ba0], r8
ret 0x28
Function at 0x18141917c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1813c870e
mov edi, dword [rsi + rdx - 0x158a05f]
mov r9d, dword [rsi + rdx*2 - 0x2b140ba]
pop rbx
lea rax, [rcx + rbx*8 - 0x3557ab62]
not edi
not r9d
mov qword [rsp + rdx - 0x158a05f], rdx
not r8w
and edi, r9d
rol word [rsp + rdx - 0x158a059], 0xad
sar word [rsp + rdx - 0x158a05d], 0x2c
push rax
mov dword [rdx + rsi - 0x158a05b], edi
adc r8d, ecx
movzx r9d, word [r11 + r8 - 0x129f53a4]
lea r11, [r11 + r8*2 - 0x253ea742]
add ecx, ebx
xor r9w, bp
xor word [rsp + rdx - 0x158a05d], r8w
shl ecx, cl
inc r9w
xor r9w, 0xbf90
push rbx
div dword [rsp + r8*2 - 0x253ea734]
ror r9w, 1
pop rdi
sub edx, 0xf868a23
not r9w
xor bp, r9w
mov word [rsi + r8 - 0x129f539c], r9w
sal dword [rsp + r8 - 0x129f5399], 7
lea rsi, [rsi + r8 - 0x129f539c]
call fcn.1813609bd
mov r8d, 0xf7985280
mov ecx, dword [r11 + riz - 4]
movzx edi, r8w
call fcn.18136e481

Function at 0x18141d318
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x30]
je 0x18133d786
mov esi, 0x4491661c
dec esi
mov edx, esi
lea rsi, [0x1813a9b98]
Function at 0x1400087bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008808
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140008800
cmp dword [rcx + 0x3c], edx
jl 0x140008800
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140008800
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140008808
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll___p__environ]
xor edx, edx
mov rcx, qword [rax]
mov qword [0x1400040e8], rcx
xor ecx, ecx
call sub.jli.dll_JLI_InitArgProcessing
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000107a
lea rcx, str.Windows_original_main_args:_n
call fcn.140001158
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x14000107a
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call fcn.140001158
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000104f
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010c6
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010b3
mov rcx, qword [str.openjdk]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010dd
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010ec
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 1
xor r8d, r8d
mov byte [rsp + 0x58], 1
mov rdx, rbx
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022dc]
mov qword [rsp + 0x38], rax
lea rax, str.11.0.208_adhoc..jdk11u
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14000ca40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx edi, r8b
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
lea rcx, [rsp + 0x58]
call fcn.140002b30
mov byte [rsp + 0x78], dil
mov qword [rsp + 0x80], rsi
lea ecx, [rbp + 0x30]
call fcn.1400378b8
test rax, rax
je 0x14000cacc
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x140065b10]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], bpl
mov byte [rax + 0x20], dil
mov qword [rax + 0x28], rsi
jmp 0x14000cacf
mov rax, rbp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140008b30]
xor edx, edx
xor ecx, ecx
call fcn.140045c7c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000cbe6
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000cb40
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cbf5
call fcn.1400378f4
cmp dword [rsp + 0x38], 0
je 0x14000cbdb
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1400399a0
test eax, eax
jne 0x14000cbdb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000cba3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000cb9e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cbfb
mov rcx, r8
call fcn.1400378f4
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140037a10
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 1
call fcn.140039d68
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.140039d68
nop
call fcn.140040380
nop
call fcn.140040380
int3

Function at 0x14000cc10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x140087bd0]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.140039a40
test eax, eax
jne 0x14000cc9e
cmp dword [0x140087c1c], 0x7fffffff
je 0x14000cc89
lea edx, [rax + 2]
mov rcx, rbx
call fcn.1400110b0
mov eax, dword [rbx + 0x60]
mov dword [rsp + 0x50], eax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140039a48
mov dword [0x140087c1c], 0x7ffffffe
mov ecx, 6
call fcn.140039d68
int3
mov ecx, 5
call fcn.140039d68
int3
Function at 0x14000d1d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rdx
xor ebp, ebp
mov dword [rsp + 0x3c], ebp
lea r14, [0x140087bd0]
mov qword [rsp + 0x50], r14
mov rcx, r14
call fcn.140039a40
test eax, eax
jne 0x14000d2fb
cmp dword [0x140087c1c], 0x7fffffff
je 0x14000d2e6
lea edx, [rbp + 8]
mov rcx, rdi
call fcn.1400110b0
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140002b30
mov rdx, rax
mov rcx, rdi
call fcn.140010920
nop
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x34]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x34]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x3c], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x14000d2a8
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
call fcn.140008f80
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000d2b5
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.140039a48
mov rax, rbx
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [0x140087c1c], 0x7ffffffe
mov ecx, 6
call fcn.140039d68
int3
mov ecx, 5
call fcn.140039d68
int3
Function at 0x140010920
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
lea r8d, [rsi + 4]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x140010971
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400109bf
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400109ba
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400109de
mov rcx, r8
call fcn.1400378f4
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140040380
int3

Function at 0x1400109f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
mov rbx, rdx
add eax, eax
mov dword [rsp + 0x30], 0
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbx + 0x10]
mov rdx, rbx
add r8d, r8d
cmp qword [rbx + 0x18], 7
jbe 0x140010a4d
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140005330
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140010b50
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r15, rcx
mov qword [rsp + 0x40], rdx
mov rdi, qword [rsp + 0xe0]
xor ebx, ebx
call fcn.140020f40
test al, al
jne 0x140010bc0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
lea r8d, [rbx + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140001390
jmp 0x140010d33
mov ebp, 1
mov ecx, 0x208
call fcn.140037c9c
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rbx, 0xffffffffffffffff
mov r14d, 0x104
nop word [rax + rax]
mov rax, r15
cmp qword [r15 + 0x18], 7
jbe 0x140010c0d
mov rax, qword [r15]
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140010c1a
mov r8, qword [rdi]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140010c29
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x140010c37
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r14 - 1]
cmp eax, ecx
jb 0x140010cb8
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140010c5f
mov r8, qword [rdi]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140010c84
add rax, 2
test ecx, ecx
jne 0x140010c70
test edx, edx
je 0x140010cb8
mov rcx, rsi
call fcn.1400378f4
inc ebp
imul r14d, ebp, 0x104
mov ecx, r14d
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140037c9c
mov rsi, rax
jmp 0x140010c00
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140010cc0
mov rax, qword [rsp + 0x60]
cmp rbx, rax
ja 0x140010d03
lea rdi, [rsp + 0x48]
cmp rax, 7
cmova rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14005e680
xor r14d, r14d
mov word [rbx + rdi], r14w
jmp 0x140010d19
mov r9, rsi
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140001d30
mov rcx, rsi
call fcn.1400378f4
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140037a10
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140010f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov ebx, ecx
mov rsi, r8
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14001108c
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test rbx, rbx
je 0x14001108c
test eax, eax
je 0x14001108c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001108c
mov rcx, qword [rsi]
mov dword [rbp - 0x20], 0x84cfae7c
mov dword [rbp - 0x1c], 0xfebfc8d2
mov dword [rbp - 0x18], 0x6b3e348e
mov dword [rbp - 0x14], 0x5b422840
mov dword [rbp - 0x10], 0x269598d8
mov dword [rbp - 0xc], 0xb99f7013
mov dword [rbp - 8], 0xbe6c8efb
mov dword [rbp - 4], 0x8036dd6e
cmp rcx, qword [rsi + 8]
je 0x14001102b
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
sub rax, rcx
mov qword [rbp + 0x38], rdi
cmp rdi, rax
jbe 0x140011047
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.140010eb0
xor ebx, ebx
test rdi, rdi
je 0x140011088
nop
mov rdx, qword [rsi + 8]
mov rax, rbx
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x20]
xor cl, byte [r14 + rbx]
mov byte [rbp + 0x20], cl
cmp rdx, qword [rsi + 0x10]
je 0x140011074
mov byte [rdx], cl
inc qword [rsi + 8]
jmp 0x140011080
lea r8, [rbp + 0x20]
mov rcx, rsi
call fcn.140010d60
inc rbx
cmp rbx, rdi
jb 0x140011050
mov al, 1
jmp 0x14001108e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x1400110b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x48]
xor eax, eax
mov dword [rsp + 0x40], edx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret