joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x140016cd0]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x1400098ae
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140009890
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140009a95
mov ecx, 3
call fcn.14000ee40
cmp eax, 1
je 0x140009a4c
mov ecx, 3
call fcn.14000ee40
test eax, eax
jne 0x1400098e5
cmp dword [0x140016064], 1
je 0x140009a4c
cmp edi, 0xfc
je 0x140009a95
mov qword [rsp + 0x50], rbp
lea rbp, [0x140017bd0]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.140006bd0
test eax, eax
je 0x140009929
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006890
lea rdx, [0x140017be9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x140017ced], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140009979
lea r8, str._program_name_unknown_
lea rcx, [0x140017be9]
mov edx, 0x2fb
call fcn.140006bd0
test eax, eax
je 0x140009979
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006890
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140017be9]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x1400099c8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x140017ee4]
lea r9d, [rax + 3]
lea r8, [0x140011d64]
sub rdx, rcx
call fcn.14000b890
test eax, eax
je 0x1400099c8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006890
lea r8, [0x140011d60]
mov edx, 0x314
mov rcx, rbp
call fcn.14000b7d0
test eax, eax
je 0x1400099f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006890
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.14000b7d0
test eax, eax
je 0x140009a24
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006890
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.14000ebe0
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140009a95
cmp rax, 0xffffffffffffffff
je 0x140009a95
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140009ab0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.14000ee40
cmp eax, 1
je 0x140009ae2
mov ecx, 3
call fcn.14000ee40
test eax, eax
jne 0x140009b96
cmp dword [0x140016064], 1
jne 0x140009b96
mov qword [rsp + 0x48], rbx
lea rbx, [0x140016cd0]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x140009b0e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140009af8
jmp 0x140009b82
cmp edi, 0x17
jae 0x140009b82
mov ecx, 3
call fcn.14000ee40
cmp eax, 1
je 0x140009b39
mov ecx, 3
call fcn.14000ee40
test eax, eax
jne 0x140009b82
cmp dword [0x140016064], 1
jne 0x140009b82
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140009b82
cmp rax, 0xffffffffffffffff
je 0x140009b82
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140009870
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x14000a2f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x140017ff8]
test eax, eax
jne 0x14000a343
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14000a323
mov dword [0x140017ff8], 1
jmp 0x14000a35e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14000a33d
mov dword [0x140017ff8], 2
jmp 0x14000a439
mov eax, dword [0x140017ff8]
cmp eax, 1
jne 0x14000a430
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14000a483
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x14000a385
add rbx, 2
cmp word [rbx], 0
jne 0x14000a371
add rbx, 2
cmp word [rbx], 0
jne 0x14000a371
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x14000a423
mov rcx, rbp
call fcn.14000b010
test rax, rax
mov rsi, rax
je 0x14000a423
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14000a3fd
mov rcx, rsi
call fcn.140006b80
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x14000a409
cmp eax, 2
je 0x14000a439
test eax, eax
jne 0x14000a483
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x14000a483
cmp byte [rax], 0
je 0x14000a462
nop
add rax, 1
cmp byte [rax], 0
jne 0x14000a450
add rax, 1
cmp byte [rax], 0
jne 0x14000a450
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.14000b010
test rax, rax
mov rdi, rax
jne 0x14000a495
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000b1b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x14000bb70
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14000bbb7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140004c00
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.14000f120
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140004c00
add rsp, 0x38
ret
Function at 0x14000dc90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x5f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
xor edi, edi
test r8d, r8d
mov r13d, r8d
mov rbp, rdx
movsxd rbx, ecx
mov r14d, edi
mov esi, edi
jne 0x14000dcce
xor eax, eax
jmp 0x14000e476
test rdx, rdx
jne 0x14000dd01
call fcn.140006ac0
mov dword [rax], edi
call fcn.140006a90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rdi
call fcn.140006930
or eax, 0xffffffff
jmp 0x14000e476
mov qword [rsp + 0x648], r12
mov qword [rsp + 0x5f0], r15
mov r12b, bl
and r12d, 0x1f
mov r15, rbx
lea rcx, [0x140018420]
sar r15, 5
mov qword [rsp + 0x50], r15
imul r12, r12, 0x58
mov rcx, qword [rcx + r15*8]
mov qword [rsp + 0x58], r12
Function at 0x14000ebe0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140006140
xor ebx, ebx
cmp qword [0x1400182b0], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x14000ed0c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14000ee1f
lea rdx, [0x140012808]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ee1f
mov rcx, rax
call fcn.140006070
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400182b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006070
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400182b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006070
lea rcx, [rsp + 0x98]
mov qword [0x1400182c0], rax
call fcn.140009510
test eax, eax
je 0x14000ecbf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140006890
cmp dword [rsp + 0x98], 2
jne 0x14000ed0c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006070
test rax, rax
mov qword [0x1400182d0], rax
je 0x14000ed0c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006070
mov qword [0x1400182c8], rax
mov rcx, qword [0x1400182c8]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x14000edb8
cmp qword [0x1400182d0], rbp
je 0x14000edb8
call fcn.140006230
mov rcx, qword [0x1400182d0]
mov rsi, rax
call fcn.140006230
test rsi, rsi
mov r12, rax
je 0x14000edb8
test rax, rax
je 0x14000edb8
call rsi
test rax, rax
je 0x14000ed83
lea rcx, [rsp + 0x34]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000ed83
test byte [rsp + 0x40], 1
jne 0x14000edb8
lea rcx, [rsp + 0x30]
call fcn.140009560
test eax, eax
je 0x14000eda5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140006890
cmp dword [rsp + 0x30], 4
jb 0x14000edb2
bts edi, 0x15
jmp 0x14000edf6
bts edi, 0x12
jmp 0x14000edf6
mov rcx, qword [0x1400182b8]
cmp rcx, rbp
je 0x14000edf6
call fcn.140006230
test rax, rax
je 0x14000edf6
call rax
test rax, rax
mov rbx, rax
je 0x14000edf6
mov rcx, qword [0x1400182c0]
cmp rcx, rbp
je 0x14000edf6
call fcn.140006230
test rax, rax
je 0x14000edf6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400182b0]
call fcn.140006230
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x14000ee1f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14000ee21
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x180004cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rsi
push rdi
sub rsp, 0x98
mov byte [rsp + 2], 1
mov dword [rsp + 0xc], 9
lea rax, [rsp + 0x38]
lea rcx, str.CXvubjsNmgPTzVxicO
mov rdi, rax
mov rsi, rcx
mov ecx, 0x13
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x20], 8
mov byte [rsp + 1], 0
jmp 0x180004d51
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180004e2f
mov byte [rsp], 0
jmp 0x180004d6e
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180004e2a
movzx eax, byte [rsp + 1]
mov rcx, qword [rsp + 0xb8]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 0xb0]
shl edx, 2
movzx edi, byte [rsp + 1]
shl edi, 2
lea edx, [rdi + rdx*4]
movzx edi, byte [rsp]
add edx, edi
movsxd rdx, edx
mov rdi, qword [rsp + 0xc0]
movzx edx, byte [rdi + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 1]
mov rdi, qword [rsp + 0xb8]
lea rdx, [rdi + rdx*4]
mov byte [rdx + rcx], al
lea rax, [rsp + 0x50]
lea rcx, str.xcgNdUZFqrBmVQplfRJHznDMaCAehYTGiEtKOWkIXovsbuLwj
mov rdi, rax
mov rsi, rcx
mov ecx, 0x32
rep movsb byte [rdi], byte [rsi]
mov eax, 3
mov word [rsp + 4], ax
mov eax, 7
mov word [rsp + 8], ax
mov byte [rsp + 3], 1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x10], 9
mov qword [rsp + 0x30], 9
jmp 0x180004d65
jmp 0x180004d46
add rsp, 0x98
pop rdi
pop rsi
ret

Function at 0x180004e40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 0x10], 1
mov qword [rsp + 0x18], 6
mov byte [rsp + 2], 0x72
mov byte [rsp + 3], 1
mov byte [rsp + 1], 0
jmp 0x180004e76
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180004ef5
mov byte [rsp], 0
jmp 0x180004e8f
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180004ef0
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, [0x1800500b0]
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x30]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
mov byte [rsp + 4], 0x66
mov eax, 2
mov word [rsp + 8], ax
mov eax, 1
mov word [rsp + 0xc], ax
mov byte [rsp + 5], 1
jmp 0x180004e86
jmp 0x180004e6b
add rsp, 0x28
ret
Function at 0x180005ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x108
mov rax, qword [0x180057080]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 1
mov eax, 9
mov word [rsp + 0x60], ax
mov byte [rsp + 0x2a], 0x63
mov eax, 8
mov word [rsp + 0x64], ax
mov dword [rsp + 0x68], 0
mov byte [rsp + 0x2b], 1
mov eax, 2
mov word [rsp + 0x34], ax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0x10
jmp 0x180005b5a
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x130]
cmp dword [rsp + 0x24], eax
jae 0x180005d99
lea rax, [rsp + 0xe0]
mov rcx, qword [rsp + 0x120]
mov rdi, rax
lea rsi, [rcx + 0xb0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x6c], 4
mov byte [rsp + 0x2c], 0x70
mov rax, qword [rsp + 0x120]
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1800058c0
mov eax, 5
mov word [rsp + 0x38], ax
mov eax, 1
mov word [rsp + 0x3c], ax
mov qword [rsp + 0x80], 5
mov byte [rsp + 0x2d], 0x42
mov dword [rsp + 0x20], 0xf
jmp 0x180005bf3
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x180005d2a
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x120]
movzx eax, byte [rcx + rax + 0xb0]
cmp eax, 0xff
jne 0x180005cae
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x120]
mov byte [rcx + rax + 0xb0], 0
mov dword [rsp + 0x70], 8
lea rax, [rsp + 0xb8]
lea rcx, str.qJayvzRDiLktKMC
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, 7
mov word [rsp + 0x40], ax
jmp 0x180005be9
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x120]
movzx eax, byte [rcx + rax + 0xb0]
inc eax
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x120]
mov byte [rdx + rcx + 0xb0], al
jmp 0x180005d2a
mov dword [rsp + 0x20], 0
mov eax, 6
mov word [rsp + 0x54], ax
mov byte [rsp + 0x31], 0x70
mov eax, 7
mov word [rsp + 0x58], ax
mov byte [rsp + 0x32], 1
mov qword [rsp + 0xa0], 4
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x128]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x20]
movzx ecx, byte [rsp + rcx + 0xe0]
xor eax, ecx
mov ecx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x128]
mov byte [rdx + rcx], al
mov eax, 4
mov word [rsp + 0x5c], ax
jmp 0x180005b46
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18001c960
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x18000abb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180057080]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x18000abe4
xor eax, eax
jmp 0x18000ad90
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x18000ac0c
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.18000b880
jmp 0x18000ad90
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call fcn.180010470
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x18000aca8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.18000adb0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.180010630
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1800115a0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.180010590
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x18000ad80
mov rcx, qword [rsp + 0x70]
call fcn.18000fe60
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x18000ad48
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.180028274
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x18000ad46
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x18000ad90
jmp 0x18000acce
cmp qword [rsp + 0x40], 0
jbe 0x18000ad80
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.180028274
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001c960
add rsp, 0x68
ret

Function at 0x18003185c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180031872
mov al, 1
jmp 0x1800318d2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180031883
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800318d0
mov ecx, dword [rcx + 0x18]
nop
call fcn.180037d80
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800318d0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800318d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800318d0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800318d2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180032ef0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18001d470
sub rsp, rax
mov rax, qword [0x180057080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18002f224
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180032f3f
mov rax, rbp
jmp 0x180033047
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x599d0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180032b2c
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x599d0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180033043
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180033043
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180032b2c
test rax, rax
js 0x180033043
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180033043
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180033035
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180033035
cmp byte [rcx], 0xd
jne 0x18003301b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18003302a
cmp byte [rcx + 1], 0xa
jne 0x18003302a
inc rcx
jmp 0x18003302a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x574c0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180032ffd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180033047
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18001c960
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180033170
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1800599d0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1800331c7
cmp word [rdx], r13w
jne 0x1800331c7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1800331cc
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1800332f1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x180033312
lea r9, [rdx + 2]
cmp cx, r11w
je 0x180033205
mov rdx, r9
mov word [rbx], cx
jmp 0x18003322c
cmp r9, r8
jae 0x18003323c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1800331e6
jmp 0x1800332f1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800332e6
cmp dword [rsp + 0x80], esi
je 0x1800332e6
lea r8, [0x1800599d0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1800332be
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18003328e
mov word [rbx], r13w
jmp 0x1800332ee
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18003329b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1800332ee
cmp word [rsp + 0x70], r13w
jne 0x1800332cb
cmp rbx, r14
je 0x180033288
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.180032b34
cmp word [rsp + 0x70], r13w
je 0x1800332f1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1800599d0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1800332eb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1800332f1