joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011a40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor ebx, ebx
cmp qword [rcx + 0x18], 8
mov rdi, rcx
mov qword [rcx + 0x10], rbx
jb 0x180011a74
mov rax, qword [rcx]
jmp 0x180011a77
mov rax, rcx
mov word [rax], bx
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x410
mov word [rsp + 0x20], bx
call fcn.18008c480
lea rdx, [rsp + 0x20]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x180011aa9
xor al, al
jmp 0x180011aec
cmp eax, 0x208
jae 0x180011aa5
mov word [rsp + 0x430], bx
cmp word [rsp + 0x20], bx
je 0x180011ada
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180011ad0
lea rdx, [rsp + 0x20]
mov r8, rbx
mov rcx, rdi
call fcn.180003940
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180087ea0
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret

Function at 0x180013b60
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x78], 0
je 0x180013cbf
add rbx, 0x28
mov qword [r11 - 0x68], rbx
xor dil, dil
mov byte [rsp + 0x48], dil
test rbx, rbx
je 0x180013be2
mov rcx, qword [rbx]
test rcx, rcx
je 0x180013bdd
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x180013bd6
xor dil, dil
jmp 0x180013bdd
mov byte [rbx + 8], 1
mov dil, 1
mov byte [rsp + 0x48], dil
mov rcx, qword [rsi + 8]
cmp qword [rcx + 0x18], 8
jb 0x180013bf0
mov rcx, qword [rcx]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180013c9e
xor r8d, r8d
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.18001c740
nop
lea r9d, [r14 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x78], 0x10
jb 0x180013c8b
mov rcx, qword [rsp + 0x60]
call fcn.18008861c
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r14
mov byte [rsp + 0x60], 0
test rbx, rbx
je 0x180013cba
test dil, dil
je 0x180013cba
mov rcx, qword [rbx]
test rcx, rcx
je 0x180013cb6
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180087ea0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18001b330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov esi, edx
movsxd rdi, r9d
movsx eax, sil
mov rbx, r8
mov rdx, rcx
movd xmm6, eax
punpcklbw xmm6, xmm6
punpcklwd xmm6, xmm6
pshufd xmm6, xmm6, 0
test rcx, rcx
je 0x18001b46d
test rbx, rbx
je 0x18001b46d
test r9d, r9d
jle 0x18001b46d
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x18001b46d
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x18001b46d
cmp qword [r14], 0
jne 0x18001b46d
mov ecx, edi
call qword [rdx + 0x10]
mov r8, rax
test rax, rax
je 0x18001b46d
xor edx, edx
cmp edi, 0x20
jb 0x18001b42f
lea eax, [rdi - 1]
movsxd rcx, eax
lea rax, [rcx + rbx]
lea r9, [rcx + r8]
cmp r8, rax
ja 0x18001b3e0
cmp r9, rbx
jae 0x18001b42f
mov eax, edi
and eax, 0x8000001f
jge 0x18001b3f0
dec eax
or eax, 0xffffffe0
inc eax
mov r9d, edi
sub r9d, eax
nop word [rax + rax]
movsxd rax, edx
movdqu xmm0, xmmword [rax + rbx]
pxor xmm0, xmm6
movdqu xmmword [rax + r8], xmm0
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbx]
pxor xmm0, xmm6
movdqu xmmword [rcx + r8], xmm0
cmp edx, r9d
jl 0x18001b400
movsxd rcx, edx
mov rdx, rdi
cmp rcx, rdi
jge 0x18001b463
sub rbx, r8
lea rax, [rcx + r8]
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
lea rax, [rax + 1]
xor cl, sil
mov byte [rax - 1], cl
dec rdx
jne 0x18001b450
mov qword [r14], r8
mov dword [r15], edi
xor eax, eax
jmp 0x18001b470
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x20]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x18001cdd0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x18001ce0e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.1800282f0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x18001ce36
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x18001ce49
cmp qword [rsi + 0x18], 8
jb 0x18001ce4c
mov rsi, qword [rsi]
jmp 0x18001ce4c
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x18001ce70
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18001ce70
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x18001ce97
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18001ceaa
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.18008861c
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180087ea0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x180027610
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
xor ebx, ebx
mov qword [rdx + 0x10], rbx
cmp qword [rdx + 0x18], 8
jb 0x180027653
mov rax, qword [rdx]
jmp 0x180027656
mov rax, rdx
mov word [rax], bx
call fcn.180027740
movzx esi, al
mov byte [rsp + 0x20], al
jmp 0x18002767b
test sil, sil
jne 0x18002770f
cmp r14d, 0x1a
jne 0x18002770f
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x18002769e
mov rax, qword [rdi]
jmp 0x1800276a1
mov rax, rdi
mov word [rax], bx
mov word [rsp + 0x40], bx
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x42]
call fcn.18008c480
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [rsp + 0x40], 0
je 0x1800276ee
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1800276e4
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180003940
movzx esi, sil
mov eax, 1
cmp qword [rdi + 0x10], 0
cmovne esi, eax
movzx eax, sil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180087ea0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret
Function at 0x180028c50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x60
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rbx
xor esi, esi
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], r15
mov ebp, esi
mov r15, rcx
mov r14, r9
mov ebx, r8d
mov rdi, rdx
jne 0x180028c92
xor al, al
jmp 0x180028cec
mov qword [rsp + 0x48], r12
mov r12d, 0x100000
nop dword [rax]
mov rcx, qword [r15 + 0x20]
mov r8d, ebx
cmp ebx, r12d
lea r9, [rsp + 0x30]
mov rdx, rdi
cmova r8d, r12d
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
test eax, eax
setne al
add ebp, ecx
test al, al
je 0x180028ce5
test ecx, ecx
je 0x180028ce1
add rdi, rcx
mov eax, ecx
sub ebx, ecx
jne 0x180028ca0
mov al, 1
jmp 0x180028ce7
xor al, al
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test r14, r14
je 0x180028d03
mov dword [r14], ebp
test al, al
sete sil
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180087ea0
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret

Function at 0x18002d470
Capabilities:
Hash data with md5

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp fcn.1800a68b0
Function at 0x18002f1e0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x18], rdx
lea rdx, [r11 - 0x38]
call fcn.18002f0b0
nop
xor edi, edi
cmp qword [rsp + 0x60], rdi
je 0x18002f29c
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18002f29c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
lea r8d, [rdi + 8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x68], 8
jb 0x18002f2ae
mov rcx, qword [rsp + 0x50]
call fcn.18008861c
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180087ea0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x18002f2e0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor edi, edi
mov qword [r11 - 0x40], rdi
lea rdx, [r11 - 0x30]
call fcn.18002f0b0
nop
cmp qword [rsp + 0x68], rdi
je 0x18002f3af
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18002f3af
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8d, [rdi + 8]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x48]
test eax, eax
cmove rcx, rdi
mov qword [rsp + 0x48], rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
cmp qword [rsp + 0x70], 8
jb 0x18002f3c6
mov rcx, qword [rsp + 0x58]
call fcn.18008861c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180087ea0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x18002fcb0
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
jne 0x18002fce6
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180087ea0
add rsp, 0x30
pop rdi
ret
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18002fd13
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18002fd13
xor al, al
jmp 0x18002fd26
mov ecx, dword [rsp + 0x20]
mov rax, rbx
mov al, 1
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180087ea0
add rsp, 0x30
pop rdi
ret
Function at 0x18003b560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18003b6ba
mov dword [rbp - 0x30], 0x2d2d4352
mov dword [rbp - 0x2c], 0xf7babac9
mov dword [rbp - 0x28], 0x61726f43
mov dword [rbp - 0x24], 0x776f7242
mov dword [rbp - 0x20], 0x2d756e45
mov dword [rbp - 0x1c], 0x61746144
mov dword [rbp - 0x18], 0x37313630
mov dword [rbp - 0x14], 0x30313032
mov eax, 1
movd xmm2, eax
movdqu xmm1, xmmword [rbp - 0x30]
pslld xmm1, xmm2
xorps xmm0, xmm0
paddd xmm0, xmmword [0x1800cb680]
paddd xmm0, xmm1
movdqu xmmword [rbp - 0x30], xmm0
movdqu xmm1, xmmword [rbp - 0x20]
pslld xmm1, xmm2
movdqa xmm0, xmmword [0x1800cb690]
paddd xmm0, xmmword [0x1800cb680]
paddd xmm0, xmm1
movdqu xmmword [rbp - 0x20], xmm0
mov rax, qword [rdx]
mov qword [rdx + 8], rax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
test rdx, rdx
je 0x18003b699
lea r9, [rbp - 0x48]
mov r8d, eax
lea rcx, [rbp - 0x30]
call fcn.18004a950
test al, al
je 0x18003b699
mov rbx, qword [rbp - 0x48]
cmp rbx, qword [rbp - 0x40]
je 0x18003b69d
mov rdx, rdi
mov ecx, 0xa
call fcn.180049930
mov ecx, dword [rbp - 0x40]
sub ecx, ebx
mov rdx, rdi
call fcn.180049930
mov r9, qword [rbp - 0x40]
mov r8, rbx
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.18003b910
jmp 0x18003b69d
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x18003b6ba
mov rcx, rbx
call fcn.18008861c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], 0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180087ea0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18003b6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
sub rsp, 0x58
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov r10, rcx
mov rcx, qword [rcx + 8]
mov rsi, r8
mov rbx, rdx
cmp rax, rcx
je 0x18003b8fa
mov rdx, qword [rdx]
sub rcx, rax
cmp rdx, rcx
jae 0x18003b8fa
lea rax, [rdx + 5]
cmp rax, rcx
ja 0x18003b8fa
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
cmp byte [rdx + rax], 2
jne 0x18003b8fa
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rax, qword [r10]
movzx r9d, byte [rax + r8]
lea rdx, [rcx + 1]
mov qword [rbx], rdx
mov rax, qword [r10]
shl r9d, 0x18
movzx ecx, byte [rax + rcx]
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
shl ecx, 0x10
or r9d, ecx
movzx ecx, byte [rax + rdx]
lea rdx, [r8 + 1]
mov qword [rbx], rdx
mov r11, qword [r10]
shl ecx, 8
movzx eax, byte [r11 + r8]
or r9d, ecx
or r9d, eax
cmp r9d, 0xa
jne 0x18003b8fa
mov rcx, qword [r10 + 8]
lea rax, [rdx + 5]
sub rcx, r11
cmp rax, rcx
ja 0x18003b8fa
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
cmp byte [rdx + rax], 2
jne 0x18003b8fa
lea rcx, [r8 + 1]
mov qword [rsp + 0x50], rdi
mov qword [rbx], rcx
mov rax, qword [r10]
lea rdx, [rcx + 1]
movzx r11d, byte [rax + r8]
mov qword [rbx], rdx
mov rax, qword [r10]
movzx ecx, byte [rax + rcx]
lea r8, [rdx + 1]
shl r11d, 0x18
mov qword [rbx], r8
mov rax, qword [r10]
shl ecx, 0x10
or r11d, ecx
movzx ecx, byte [rax + rdx]
shl ecx, 8
or r11d, ecx
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rdx, qword [r10]
movzx eax, byte [rdx + r8]
or r11d, eax
mov rax, qword [r10 + 8]
sub rax, rcx
mov edi, r11d
sub rax, rdx
cmp rdi, rax
jbe 0x18003b83d
xor al, al
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180087ea0
add rsp, 0x58
pop rsi
pop rbx
ret
xorps xmm0, xmm0
mov eax, 1
mov dword [rsp + 0x20], 0x2d2d4352
mov dword [rsp + 0x24], 0xf7babac9
mov dword [rsp + 0x28], 0x61726f43
mov dword [rsp + 0x2c], 0x776f7242
movd xmm2, eax
paddd xmm0, xmmword [0x1800cb680]
movdqu xmm1, xmmword [rsp + 0x20]
mov rax, qword [rsi]
mov dword [rsp + 0x30], 0x2d756e45
mov dword [rsp + 0x34], 0x61746144
pslld xmm1, xmm2
paddd xmm0, xmm1
mov dword [rsp + 0x38], 0x37313630
mov dword [rsp + 0x3c], 0x30313032
mov qword [rsi + 8], rax
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x1800cb690]
paddd xmm0, xmmword [0x1800cb680]
movdqu xmm1, xmmword [rsp + 0x30]
mov rdx, qword [rbx]
pslld xmm1, xmm2
paddd xmm0, xmm1
movdqu xmmword [rsp + 0x30], xmm0
add rdx, qword [r10]
jne 0x18003b8e2
xor al, al
add qword [rbx], rdi
jmp 0x18003b824
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, r11d
call fcn.18004ab70
add qword [rbx], rdi
jmp 0x18003b824
xor al, al
jmp 0x18003b829
Function at 0x180041220
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x18004125b
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x18004125b
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x20]
call fcn.18002fcb0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180042fe0
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
jne 0x180043016
xor al, al
jmp 0x1800430f3
add rdi, 0x38
mov qword [rsp + 0x38], rdi
je 0x180043030
mov rcx, qword [rdi]
test rcx, rcx
je 0x180043030
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x1800430d2
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x180042c10]
xor edx, edx
xor ecx, ecx
call fcn.1800a1ff0
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x1800430a4
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180043099
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbx + 0x10]
call fcn.180042da0
jmp 0x1800430d2
mov byte [rax + 0x10], 1
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x1800430bb
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x180043084
mov bl, 1
jmp 0x1800430d4
xor bl, bl
test rdi, rdi
je 0x1800430f0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800430e7
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x38], 0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180087ea0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18004bec0
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, r9
mov r12d, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor edi, edi
test rax, rax
je 0x18004bf0e
mov dword [rax], edi
mov dword [r9], edi
cmp qword [rcx], 0xffffffffffffffff
je 0x18004c077
mov eax, 0x100000
mov ebp, r12d
cmp r12d, eax
cmova ebp, eax
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
mov r8d, ebp
mov rdx, r15
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
cmp qword [rsi + 0x28], 0
je 0x18004c044
test edx, edx
je 0x18004c044
mov ecx, dword [rsp + 0x68]
cmp ecx, ebp
jae 0x18004c048
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x18004bfb2
mov dword [rsp + 0x6c], edi
lea rdx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18004bfa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18004bfb0
mov ebx, dword [rsp + 0x6c]
shl rbx, 0x20
add rbx, rdi
xor edi, edi
jmp 0x18004bfb5
xor edi, edi
mov rbx, rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
lea rdx, [rsi + 8]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.1800032a0
nop
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx]
mov r9, r14
mov r8, rbx
lea rdx, [rsp + 0x38]
call qword [rax + 0x30]
mov edx, eax
test eax, eax
jne 0x18004c044
mov dword [rsp + 0x70], edi
mov edx, dword [rsp + 0x68]
add rdx, r15
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
mov r8d, ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
mov ecx, dword [rsp + 0x68]
add ecx, dword [rsp + 0x70]
mov dword [rsp + 0x68], ecx
test edx, edx
jne 0x18004bf67
jmp 0x18004c048
mov ecx, dword [rsp + 0x68]
add dword [r13], ecx
test edx, edx
jne 0x18004c06b
test ecx, ecx
je 0x18004c067
mov eax, ecx
add r15, rax
sub r12d, ecx
mov eax, 0x100000
jne 0x18004bf20
mov al, 1
jmp 0x18004c079
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18004c077
mov dword [rax], edx
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180087ea0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800734b0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1800fb008]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
mov dword [rsp + 0x20], 0x114
call fcn.18008c480
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180073513
cmp dword [rsp + 0x24], 6
jb 0x180073513
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180087ea0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180087ea0
add rsp, 0x158
ret