joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bc210
Capabilities:
Read file via mapping

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x84], 0
lea rcx, [rsp + 0x30]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bb1f0
test eax, eax
je 0x1800bc32f
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.180134bb0
mov edx, 0x211
lea rcx, str.CTSandboxClass::GetSystemPolicyLib
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180134c00
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x1800bc2e7
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
mov dword [rsp + 0x84], eax
lea rcx, [rsp + 0x30]
call fcn.180134be0
mov dword [rsp + 0x8c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov r9d, 0x223
lea r8, str.CTSandboxClass::GetSystemPolicyLib
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x8c]
call fcn.1800beb30
lea rcx, [rsp + 0x30]
call fcn.180134ba0
cmp dword [rsp + 0x80], 0
jbe 0x1800bc47b
cmp qword [rsp + 0xf8], 0
je 0x1800bc47b
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x100], eax
jb 0x1800bc47b
mov eax, dword [rsp + 0x84]
and eax, 2
mov dword [rsp + 0xa8], eax
mov r8d, dword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bbc30
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov r8, qword [rsp + 0xc0]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x1800bc46e
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x1800bc454
mov eax, dword [rsp + 0x100]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0xf8]
call fcn.1800f8b90
mov eax, dword [rsp + 0x80]
mov r8d, eax
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
call fcn.1800fa600
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0xb0], 0
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x98], 0
lea rcx, [rsp + 0xa0]
call fcn.1800e5c00
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x30]
call fcn.180134d40
mov eax, dword [rsp + 0xb8]
add rsp, 0xe8
ret
Function at 0x1800bc4b0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x94], 0
lea rcx, [rsp + 0x40]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x100]
call fcn.1800bb1f0
test eax, eax
je 0x1800bc5d3
mov edx, 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.180134bb0
mov edx, 0x24e
lea rcx, str.CTSandboxClass::GetSystemPolicyLib2
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180134c00
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x1800bc58b
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 8]
mov dword [rsp + 0x94], eax
lea rcx, [rsp + 0x40]
call fcn.180134be0
mov dword [rsp + 0x9c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x98], eax
mov r9d, 0x260
lea r8, str.CTSandboxClass::GetSystemPolicyLib2
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x9c]
call fcn.1800beb30
lea rcx, [rsp + 0x40]
call fcn.180134ba0
cmp dword [rsp + 0x90], 0
jbe 0x1800bc722
mov eax, dword [rsp + 0x94]
and eax, 2
mov dword [rsp + 0xb8], eax
mov r8d, dword [rsp + 0xb8]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x100]
call fcn.1800bbc30
nop
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd8], rax
mov r8, qword [rsp + 0xd8]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x1800bc715
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x1800bc6fb
mov eax, dword [rsp + 0x90]
mov ecx, eax
call fcn.1800f8d24
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800bc6e1
mov eax, dword [rsp + 0x90]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1800f8b90
mov eax, dword [rsp + 0x90]
mov r8d, eax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
call fcn.1800fa600
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0xc0], 0
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0xb0]
call fcn.1800e5c00
cmp qword [rsp + 0x108], 0
je 0x1800bc73e
mov rax, qword [rsp + 0x108]
mov ecx, dword [rsp + 0x90]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x40]
call fcn.180134d40
mov rax, qword [rsp + 0xd0]
add rsp, 0xf8
ret
Function at 0x1800bca30
Capabilities:
Read file via mapping

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0xf8], 0
je 0x1800bcc75
cmp dword [rsp + 0x100], 0
jbe 0x1800bcc75
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0x60]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bb1f0
test eax, eax
jne 0x1800bcac7
lea rcx, [rsp + 0x60]
call fcn.180134d40
jmp 0x1800bccbb
mov edx, 0xffffffff
lea rcx, [rsp + 0x60]
call fcn.180134bb0
mov edx, 0x2e4
lea rcx, str.CTSandboxClass::SetClassPolicyLib
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180134c00
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x1800bcb29
mov rax, qword [rsp + 0xb8]
mov eax, dword [rax + 8]
and eax, 2
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x60]
call fcn.180134be0
mov dword [rsp + 0xb4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xb0], eax
mov r9d, 0x2f5
lea r8, str.CTSandboxClass::SetClassPolicyLib
mov edx, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0xb4]
call fcn.1800beb30
lea rcx, [rsp + 0x60]
call fcn.180134ba0
nop
lea rcx, [rsp + 0x60]
call fcn.180134d40
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bc7a0
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc0], rax
call fcn.1800f6870
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x100]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8d, 4
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800bcbf3
lea rcx, [rsp + 0x48]
call fcn.1800e5c00
jmp 0x1800bccbb
mov dword [rsp + 0x54], 6
mov eax, dword [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1800bcc38
lea rcx, [rsp + 0x48]
call fcn.1800e5c00
jmp 0x1800bccbb
mov eax, dword [rsp + 0x100]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.1800f8b90
mov eax, dword [rsp + 0x100]
mov r8d, eax
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x38]
call fcn.1800fa600
nop
lea rcx, [rsp + 0x48]
call fcn.1800e5c00
mov r9d, dword [rsp + 0x100]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bc850
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1800bccb1
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
xor eax, eax
test eax, eax
jne 0x1800bca6c
cmp qword [rsp + 0x38], 0
je 0x1800bccd7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x30], 0
je 0x1800bccf3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x40]
add rsp, 0xe8
ret
Function at 0x1800bcd00
Capabilities:
Read file via mapping

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x84], 0
lea rcx, [rsp + 0x30]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bb1f0
test eax, eax
je 0x1800bce1f
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.180134bb0
mov edx, 0x331
lea rcx, str.CTSandboxClass::GetClassPolicyLib
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180134c00
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x1800bcdd7
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
mov dword [rsp + 0x84], eax
lea rcx, [rsp + 0x30]
call fcn.180134be0
mov dword [rsp + 0x8c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov r9d, 0x343
lea r8, str.CTSandboxClass::GetClassPolicyLib
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x8c]
call fcn.1800beb30
lea rcx, [rsp + 0x30]
call fcn.180134ba0
cmp dword [rsp + 0x80], 0
jbe 0x1800bcf6b
cmp qword [rsp + 0xf8], 0
je 0x1800bcf6b
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x100], eax
jb 0x1800bcf6b
mov eax, dword [rsp + 0x84]
and eax, 2
mov dword [rsp + 0xa8], eax
mov r8d, dword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bc7a0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov r8, qword [rsp + 0xc0]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x1800bcf5e
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x1800bcf44
mov eax, dword [rsp + 0x100]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0xf8]
call fcn.1800f8b90
mov eax, dword [rsp + 0x80]
mov r8d, eax
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
call fcn.1800fa600
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0xb0], 0
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x98], 0
lea rcx, [rsp + 0xa0]
call fcn.1800e5c00
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x30]
call fcn.180134d40
mov eax, dword [rsp + 0xb8]
add rsp, 0xe8
ret
Function at 0x1800bcfa0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x94], 0
lea rcx, [rsp + 0x40]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x100]
call fcn.1800bb1f0
test eax, eax
je 0x1800bd0c3
mov edx, 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.180134bb0
mov edx, 0x36e
lea rcx, str.CTSandboxClass::GetClassPolicyLib2
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180134c00
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x1800bd07b
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 8]
mov dword [rsp + 0x94], eax
lea rcx, [rsp + 0x40]
call fcn.180134be0
mov dword [rsp + 0x9c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x98], eax
mov r9d, 0x380
lea r8, str.CTSandboxClass::GetClassPolicyLib2
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x9c]
call fcn.1800beb30
lea rcx, [rsp + 0x40]
call fcn.180134ba0
cmp dword [rsp + 0x90], 0
jbe 0x1800bd212
mov eax, dword [rsp + 0x94]
and eax, 2
mov dword [rsp + 0xb8], eax
mov r8d, dword [rsp + 0xb8]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x100]
call fcn.1800bc7a0
nop
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd8], rax
mov r8, qword [rsp + 0xd8]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x1800bd205
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x1800bd1eb
mov eax, dword [rsp + 0x90]
mov ecx, eax
call fcn.1800f8d24
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800bd1d1
mov eax, dword [rsp + 0x90]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1800f8b90
mov eax, dword [rsp + 0x90]
mov r8d, eax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
call fcn.1800fa600
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0xc0], 0
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0xb0]
call fcn.1800e5c00
cmp qword [rsp + 0x108], 0
je 0x1800bd22e
mov rax, qword [rsp + 0x108]
mov ecx, dword [rsp + 0x90]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x40]
call fcn.180134d40
mov rax, qword [rsp + 0xd0]
add rsp, 0xf8
ret
Function at 0x1800bfb10
Capabilities:
Read file via mapping

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0xf8], 0
je 0x1800bfd55
cmp dword [rsp + 0x100], 0
jbe 0x1800bfd55
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0x60]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bef00
test eax, eax
jne 0x1800bfba7
lea rcx, [rsp + 0x60]
call fcn.180134d40
jmp 0x1800bfd9b
mov edx, 0xffffffff
lea rcx, [rsp + 0x60]
call fcn.180134bb0
mov edx, 0x1b3
lea rcx, str.CTSandboxInstance::SetInstancePolicyLib
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180134c00
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x1800bfc09
mov rax, qword [rsp + 0xb8]
mov eax, dword [rax + 0xc]
and eax, 2
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x60]
call fcn.180134be0
mov dword [rsp + 0xb4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xb0], eax
mov r9d, 0x1c4
lea r8, str.CTSandboxInstance::SetInstancePolicyLib
mov edx, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0xb4]
call fcn.1800beb30
lea rcx, [rsp + 0x60]
call fcn.180134ba0
nop
lea rcx, [rsp + 0x60]
call fcn.180134d40
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bf870
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc0], rax
call fcn.1800f6870
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x100]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8d, 4
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800bfcd3
lea rcx, [rsp + 0x48]
call fcn.1800e5c00
jmp 0x1800bfd9b
mov dword [rsp + 0x54], 6
mov eax, dword [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1800bfd18
lea rcx, [rsp + 0x48]
call fcn.1800e5c00
jmp 0x1800bfd9b
mov eax, dword [rsp + 0x100]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.1800f8b90
mov eax, dword [rsp + 0x100]
mov r8d, eax
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x38]
call fcn.1800fa600
nop
lea rcx, [rsp + 0x48]
call fcn.1800e5c00
mov r9d, dword [rsp + 0x100]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bf930
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1800bfd91
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
xor eax, eax
test eax, eax
jne 0x1800bfb4c
cmp qword [rsp + 0x38], 0
je 0x1800bfdb7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x30], 0
je 0x1800bfdd3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x40]
add rsp, 0xe8
ret
Function at 0x1800bfde0
Capabilities:
Read file via mapping

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x84], 0
lea rcx, [rsp + 0x30]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bef00
test eax, eax
je 0x1800bfeff
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.180134bb0
mov edx, 0x200
lea rcx, str.CTSandboxInstance::GetInstancePolicyLib
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180134c00
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x1800bfeb7
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x84], eax
lea rcx, [rsp + 0x30]
call fcn.180134be0
mov dword [rsp + 0x8c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov r9d, 0x212
lea r8, str.CTSandboxInstance::GetInstancePolicyLib
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x8c]
call fcn.1800beb30
lea rcx, [rsp + 0x30]
call fcn.180134ba0
cmp dword [rsp + 0x80], 0
jbe 0x1800c004b
cmp qword [rsp + 0xf8], 0
je 0x1800c004b
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x100], eax
jb 0x1800c004b
mov eax, dword [rsp + 0x84]
and eax, 2
mov dword [rsp + 0xa8], eax
mov r8d, dword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xf0]
call fcn.1800bf870
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov r8, qword [rsp + 0xc0]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x1800c003e
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x1800c0024
mov eax, dword [rsp + 0x100]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0xf8]
call fcn.1800f8b90
mov eax, dword [rsp + 0x80]
mov r8d, eax
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
call fcn.1800fa600
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0xb0], 0
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x98], 0
lea rcx, [rsp + 0xa0]
call fcn.1800e5c00
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x30]
call fcn.180134d40
mov eax, dword [rsp + 0xb8]
add rsp, 0xe8
ret
Function at 0x1800c0080
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x94], 0
lea rcx, [rsp + 0x40]
call fcn.180134c30
nop
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x100]
call fcn.1800bef00
test eax, eax
je 0x1800c01a3
mov edx, 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.180134bb0
mov edx, 0x23d
lea rcx, str.CTSandboxInstance::GetInstancePolicyLib2
call fcn.1800bea70
nop
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180134c00
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x1800c015b
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x94], eax
lea rcx, [rsp + 0x40]
call fcn.180134be0
mov dword [rsp + 0x9c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x98], eax
mov r9d, 0x24f
lea r8, str.CTSandboxInstance::GetInstancePolicyLib2
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x9c]
call fcn.1800beb30
lea rcx, [rsp + 0x40]
call fcn.180134ba0
cmp dword [rsp + 0x90], 0
jbe 0x1800c02f2
mov eax, dword [rsp + 0x94]
and eax, 2
mov dword [rsp + 0xb8], eax
mov r8d, dword [rsp + 0xb8]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x100]
call fcn.1800bf870
nop
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd8], rax
mov r8, qword [rsp + 0xd8]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x1800c02e5
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x1800c02cb
mov eax, dword [rsp + 0x90]
mov ecx, eax
call fcn.1800f8d24
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800c02b1
mov eax, dword [rsp + 0x90]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1800f8b90
mov eax, dword [rsp + 0x90]
mov r8d, eax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
call fcn.1800fa600
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0xc0], 0
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0xb0]
call fcn.1800e5c00
cmp qword [rsp + 0x108], 0
je 0x1800c030e
mov rax, qword [rsp + 0x108]
mov ecx, dword [rsp + 0x90]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x40]
call fcn.180134d40
mov rax, qword [rsp + 0xd0]
add rsp, 0xf8
ret