joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003b0f0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
mov rdi, rcx
call fcn.18003a250
xor esi, esi
mov ebx, eax
cmp eax, 1
je 0x18003b137
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18003b1aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18003b257
test ebx, ebx
je 0x18003b257
mov ecx, 8
call fcn.180077f70
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x2c], 3
mov word [rax], si
mov qword [rsp + 0x20], rax
call fcn.18003a340
test al, al
je 0x18003b24d
cmp dword [rsp + 0x28], esi
jne 0x18003b18e
cmp ebx, 1
jne 0x18003b24d
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.18002d960
mov rdi, qword [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18003b1b1
mov rcx, rdi
call fcn.18007702c
mov al, 1
jmp 0x18003b2fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18003b227
mov ecx, 8
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x50], esi
mov byte [rsp + 0x54], sil
mov byte [rsp + 0x55], sil
mov qword [rsp + 0x58], rsi
call fcn.180077f70
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], 3
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov word [rax], si
call fcn.18002e4a0
mov rcx, qword [rsp + 0x58]
test al, al
jne 0x18003b236
call fcn.18007702c
mov rcx, rdi
call fcn.18007702c
xor al, al
jmp 0x18003b2fe
mov ebx, dword [rsp + 0x50]
shr ebx, 4
and bl, 1
call fcn.18007702c
mov rcx, rdi
jmp 0x18003b2f7
mov rcx, qword [rsp + 0x20]
call fcn.18007702c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18003b22f
mov ecx, 8
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x74], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x7c], esi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x84], esi
mov dword [rsp + 0x80], esi
mov dword [rsp + 0x88], esi
mov byte [rsp + 0x8c], sil
mov byte [rsp + 0x8d], sil
mov qword [rsp + 0x90], rsi
call fcn.180077f70
mov dword [rsp + 0x98], esi
mov dword [rsp + 0x9c], 3
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x68]
mov rdx, rdi
mov word [rax], si
call fcn.18002e4a0
mov rcx, qword [rsp + 0x90]
test al, al
je 0x18003b22a
mov ebx, dword [rsp + 0x88]
shr ebx, 4
and bl, 1
call fcn.18007702c
mov al, bl
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003b620
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.18002e3e0
cmp eax, 0xffffffff
je 0x18003b652
test al, 0x10
jne 0x18003b652
test al, 1
je 0x18003b652
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call fcn.18003af30
test al, al
jne 0x18003b652
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.18003a250
mov edi, eax
cmp eax, 1
je 0x18003b680
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18003b680
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
test edi, edi
je 0x18003b700
mov ecx, 8
call fcn.180077f70
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], ecx
mov word [rax], cx
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x2c], 3
call fcn.18003a340
test al, al
je 0x18003b6f6
cmp dword [rsp + 0x28], 0
jne 0x18003b6ce
cmp edi, 1
jne 0x18003b6f6
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18002d960
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdi
mov ebx, eax
call fcn.18007702c
mov rdi, qword [rsp + 0x40]
test ebx, ebx
setne al
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x20]
call fcn.18007702c
xor al, al
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x18003b900
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, 0x400000
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
cmp r8d, eax
mov rdi, r9
lea r9, [rsp + 0x50]
cmova r8d, eax
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne cl
test rdi, rdi
je 0x18003b946
mov eax, dword [rsp + 0x50]
mov dword [rdi], eax
test cl, cl
je 0x18003b957
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x38], 0
je 0x18003b97f
mov rcx, qword [rbx + 0x38]
mov rdx, qword [rbx + 0x40]
mov r8d, eax
mov r9, qword [rcx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [r9]
test eax, eax
jne 0x18003b993
mov eax, 0x80004005
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
jle 0x18003b99d
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18003b9b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov ebx, 0x100000
mov ecx, 0xfffffff6
mov rbp, r9
cmp r8d, ebx
mov rdi, rdx
cmovb ebx, r8d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
xor esi, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, eax
test rbp, rbp
je 0x18003ba0b
mov eax, dword [rsp + 0x50]
mov dword [rbp], eax
test r11d, r11d
jne 0x18003ba3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x18003ba1f
xor eax, eax
jmp 0x18003ba3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test eax, eax
jne 0x18003ba32
mov esi, 0x80004005
jmp 0x18003ba3d
jle 0x18003ba3d
movzx esi, ax
or esi, 0x80070000
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x18003bb10
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 0x20]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18003bb6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18003bb6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18003bb57
mov eax, 0x80004005
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jle 0x18003bb7c
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rbx
xor eax, eax
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18003bcf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor r13d, r13d
mov r12, r9
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
mov r14d, 0x400000
mov esi, r13d
nop
mov rcx, qword [rbp + 0x10]
mov r8d, ebx
cmp ebx, r14d
lea r9, [rsp + 0x70]
mov rdx, rdi
cmova r8d, r14d
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x70]
add esi, ecx
test eax, eax
je 0x18003bd62
test ecx, ecx
je 0x18003bd5e
add rdi, rcx
sub ebx, ecx
mov rax, rcx
jne 0x18003bd20
mov al, 1
jmp 0x18003bd64
xor al, al
mov ecx, esi
add qword [rbp + 0x18], rcx
test r12, r12
je 0x18003bd73
mov dword [r12], esi
test al, al
je 0x18003bd7c
mov eax, r13d
jmp 0x18003bd97
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18003bd8d
mov eax, 0x80004005
jmp 0x18003bd97
jle 0x18003bd97
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18003d110
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
sub rsp, 0x80
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp dword [rcx + 0x20], 0
mov rbp, rcx
ja 0x18003d13b
mov eax, 1
jmp 0x18003d30c
mov ecx, dword [rcx + 0x20]
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x98], rbx
dec ecx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r12
mov r12, qword [rax + rcx*8]
lea rdx, str.CreateDecoder
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r12]
lea rdx, str.CreateEncoder
mov qword [r12 + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r12]
lea rdx, str.GetMethodProperty
mov qword [r12 + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov qword [r12 + 0x20], rax
test rax, rax
je 0x18003d282
mov rcx, qword [r12]
lea rdx, str.GetNumberOfMethods
mov dword [rsp + 0x30], 1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003d1dc
lea rcx, [rsp + 0x30]
call rax
test eax, eax
jne 0x18003d2f2
mov esi, edi
cmp dword [rsp + 0x30], edi
jbe 0x18003d282
nop dword [rax + rax]
mov eax, dword [rbp + 0x20]
mov rcx, qword [r12 + 0x20]
lea r9, [rsp + 0x44]
dec eax
mov r8d, 3
mov edx, esi
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x3c], esi
mov qword [rsp + 0x20], rax
call fcn.18003ce40
test eax, eax
jne 0x18003d2f2
mov rcx, qword [r12 + 0x20]
lea rax, [rsp + 0x41]
lea r9, [rsp + 0x54]
mov r8d, 2
mov edx, esi
mov qword [rsp + 0x20], rax
call fcn.18003ce40
test eax, eax
jne 0x18003d2f2
lea rcx, [rbp + 0x50]
call fcn.18003fd10
mov ecx, dword [rbp + 0x58]
lea rdx, [rsp + 0x38]
imul rcx, rcx, 0x2c
add rcx, qword [rbp + 0x50]
mov r8d, 0x2c
call fcn.1800785c0
inc dword [rbp + 0x58]
inc esi
cmp esi, dword [rsp + 0x30]
jb 0x18003d1f0
mov rcx, qword [r12]
lea rdx, str.GetHashers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003d2f0
lea rcx, [r12 + 0x40]
call rax
test eax, eax
jne 0x18003d2f2
mov rcx, qword [r12 + 0x40]
test rcx, rcx
je 0x18003d2f0
mov rax, qword [rcx]
call qword [rax + 0x18]
mov esi, eax
test eax, eax
je 0x18003d2f0
nop dword [rax]
mov ecx, dword [rbp + 0x20]
mov dword [rsp + 0x34], edi
dec ecx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp + 0x60]
call fcn.180045ee0
mov r11d, dword [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
mov rax, qword [rsp + 0x30]
inc edi
mov qword [rcx + r11*8], rax
inc dword [rbp + 0x68]
cmp edi, esi
jb 0x18003d2c0
xor eax, eax
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
mov r12, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180076a70
add rsp, 0x80
pop rbp
ret
Function at 0x1800400a0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov r12, rcx
mov rcx, qword [rcx + 0x18]
mov rsi, r8
mov rdi, r9
mov rbp, rdx
lea r8, [rsp + 0x40]
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1800400ec
call fcn.180003220
jmp 0x180040123
mov rcx, qword [r12 + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800400e5
mov rax, qword [rsp + 0x40]
mov qword [rbp], 0
mov qword [rsi], rax
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180040170
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x28]
mov eax, r8d
mov rbx, r9
xor r9d, r9d
mov r8d, 0x400000
mov dword [rsp + 0x50], r9d
cmp eax, r8d
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x50]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800401b4
call fcn.180003220
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x1800401bf
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180040220
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
jne 0x180040239
mov eax, 0x80070057
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180040260
call fcn.180003220
add rsp, 0x20
pop rbx
ret
mov rax, qword [rsp + 0x38]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180040270
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov rdi, rdx
lea r8, [rsp + 0x30]
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1800402b4
call fcn.180003220
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800402a4
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1800402a4
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800402a4
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180040300
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x20]
mov eax, r8d
mov rbx, r9
xor r9d, r9d
mov r8d, 0x400000
mov dword [rsp + 0x50], r9d
cmp eax, r8d
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x50]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180040344
call fcn.180003220
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x18004034f
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180042370
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov ebp, 0x4e20
jne 0x1800423ad
cmp r8d, ebp
mov ecx, 0xfffffff6
cmovg edi, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180042417
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1800423fd
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x1800423e9
cmp eax, 3
jne 0x1800423fd
cmp edi, ebp
jle 0x1800423fd
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call fcn.180042370
jmp 0x18004241b
cmp dword [rbx + 0x14], 1
jne 0x180042412
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x180042412
xor eax, eax
jmp 0x18004241b
or eax, 0xffffffff
jmp 0x18004241b
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1800462e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
lea rax, [rcx + 0x18]
xor r12d, r12d
mov rdi, rcx
mov qword [r8], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov rbp, r9
mov rsi, r8
lea rbx, [rdx + rax]
lea r9d, [r12 + 1]
lea r8, [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x50]
cmp rax, rbx
je 0x180046354
mov rcx, qword [rdi + 8]
sub rbx, rax
lea r9d, [r12 + 1]
lea r8, [rsp + 0x5c]
mov edx, ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [rsi]
mov rcx, qword [rdi + 8]
mov r9, rbp
mov r8d, 0x20000
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
test eax, eax
mov ecx, 0x1e
cmovne ecx, r12d
mov eax, ecx
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x180046390
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rbp, r8
mov rsi, r9
lea rbx, [rdx + rax]
lea r8, [rsp + 0x54]
xor edx, edx
mov r9d, 1
mov qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x50]
cmp rax, rbx
je 0x1800463fa
mov rcx, qword [rdi + 8]
sub rbx, rax
lea r8, [rsp + 0x5c]
mov edx, ebx
mov r9d, 1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsi]
mov eax, 0x20000
lea rdx, [rdi + 0x18]
mov qword [rbp], rdx
mov rcx, qword [rdi + 8]
cmp r8d, eax
cmova r8d, eax
mov r9, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180046440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x20020]
jmp 0x180051040
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x18011c518]
xor r15d, r15d
mov r13, r9
mov r14, r8
mov r12d, r15d
call fcn.180054730
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x20], rbp
jbe 0x1800510c3
cmp dword [rbx + 0x3c], 1
je 0x1800510a5
mov rdx, qword [rbx + 0x50]
lea rcx, [0x18011c518]
xor r9d, r9d
xor r8d, r8d
call fcn.180054a20
mov rdx, qword [rbx + 0x50]
lea rcx, [0x18011c518]
xor r9d, r9d
xor r8d, r8d
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
call fcn.180054a20
mov eax, dword [rbx + 0x3c]
cmp eax, 2
jne 0x18005113f
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x38]
mov qword [rbx + 0x28], rdx
mov rax, qword [rcx]
lea r8, [rbx + 0x30]
call qword [rax]
mov r12d, eax
mov ecx, dword [0x180113f64]
mov rdi, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x180051100
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1800510c3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
jmp 0x1800510c3
cmp eax, 3
jne 0x18005115b
movsxd rdx, dword [rbx + 0x48]
add rdx, qword [rbx + 0x20]
cmp rdx, rbp
ja 0x18005115b
mov qword [rbx + 0x20], rdx
mov dword [rbx + 0x48], r15d
jmp 0x1800510e7
mov edi, r15d
mov rsi, r15
test r12d, r12d
jne 0x180051189
cmp eax, 1
jne 0x180051171
lea r12d, [rax + 0xa]
jmp 0x180051189
movsxd rax, dword [rbx + 0x20]
mov edi, dword [rbx + 0x48]
mov rsi, qword [rbx + 0x40]
sub edi, ebp
sub rsi, rax
add edi, eax
movsxd rax, ebp
add rsi, rax
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x1800511bb
mov ecx, dword [0x180113f64]
xor edx, edx
mov dword [rax], r15d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x18011c128]
test r11, r11
je 0x1800511bb
call r11
lea r11, [rsp + 0x50]
mov qword [rbx + 0x58], r15
mov qword [r14], rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r13], edi
mov eax, r12d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18004f990
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
lea r8, [0x180118ad0]
nop dword [rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x18004f9b4
shr eax, 1
xor eax, 0xedb88320
jmp 0x18004f9b6
shr eax, 1
sub rcx, 1
jne 0x18004f9a7
inc edx
mov dword [r8], eax
add r8, 4
cmp edx, 0x100
jl 0x18004f9a0
repz ret
Function at 0x18004f9d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
xor r11d, r11d
mov qword [rsp + 0x10], rbx
mov r10, rdx
mov r9d, ecx
lea rdi, [0x180118ad0]
cmp dword [0x180118ad4], r11d
jne 0x18004fa2c
mov edx, r11d
mov rbx, rdi
nop word [rax + rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x18004fa14
shr eax, 1
xor eax, 0xedb88320
jmp 0x18004fa16
shr eax, 1
sub rcx, 1
jne 0x18004fa07
inc edx
mov dword [rbx], eax
add rbx, 4
cmp edx, 0x100
jl 0x18004fa00
test r8, r8
je 0x18004fa58
test r10b, 7
je 0x18004fa58
movzx ecx, byte [r10]
movzx eax, r9b
inc r10
xor rcx, rax
mov eax, r9d
mov r9d, dword [rdi + rcx*4]
shr eax, 8
xor r9d, eax
sub r8, 1
jne 0x18004fa31
cmp r8, 8
jb 0x18004faee
mov rbx, r8
shr rbx, 3
mov rax, rbx
imul rax, rax, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
xor r9d, dword [r10]
add r10, 8
movzx eax, r9b
shr r9d, 8
mov ecx, dword [rdi + rax*4]
xor ecx, r9d
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, dword [r10 - 4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov r9d, dword [rdi + rax*4]
xor r9d, ecx
sub rbx, 1
jne 0x18004fa80
mov rbx, qword [rsp + 0x10]
test r8, r8
je 0x18004fb21
nop dword [rax + rax]
movzx ecx, byte [r11 + r10]
movzx eax, r9b
inc r11
xor rcx, rax
mov eax, r9d
mov r9d, dword [rdi + rcx*4]
shr eax, 8
xor r9d, eax
cmp r11, r8
jb 0x18004fb00
mov eax, r9d
pop rdi
ret
Function at 0x18004ff80
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800500c7
test r8d, r8d
jle 0x1800500c7
mov rax, qword [rbx + 4]
lea rcx, [r11 - 0x60]
mov qword [r11 + 0x18], rdi
mov qword [rcx], rax
mov rax, qword [rbx + 0xc]
mov qword [r11 - 0x20], r12
mov qword [rcx + 8], rax
mov eax, r8d
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov edi, eax
mov dword [rsp + 0x20], eax
mov r12d, eax
test eax, eax
jle 0x18005009f
mov edi, dword [rsp + 0x28]
mov qword [r11 - 0x28], r13
mov r13d, dword [r11 - 0x54]
mov qword [r11 - 0x30], r14
mov r14d, dword [r11 - 0x58]
mov qword [r11 - 0x38], r15
mov r15d, dword [r11 - 0x5c]
nop dword [rax + rax]
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rbx
call fcn.180050470
mov r11d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
xor r11d, edi
mov edi, dword [rsi]
xor edx, r15d
mov r15d, dword [rsi + 4]
xor ecx, r14d
mov r14d, dword [rsi + 8]
xor eax, r13d
mov r13d, dword [rsi + 0xc]
dec r12d
mov dword [rbp], r11d
mov dword [rbp + 4], edx
mov dword [rbp + 8], ecx
mov dword [rbp + 0xc], eax
add rbp, 0x10
add rsi, 0x10
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], eax
test r12d, r12d
jg 0x180050010
mov dword [rsp + 0x34], r13d
mov r13, qword [rsp + 0x60]
mov dword [rsp + 0x30], r14d
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x2c], r15d
mov r15, qword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov edi, dword [rsp + 0x20]
mov r12, qword [rsp + 0x68]
lea rcx, [rsp + 0x28]
shl edi, 4
mov rax, qword [rcx]
mov qword [rbx + 4], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0xc], rax
mov eax, edi
mov rdi, qword [rsp + 0xa0]
jmp 0x1800500c9
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180076a70
add rsp, 0x70
pop rsi
pop rbp
pop rbx
ret