joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026080
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
push rsi
push rdi
sub rsp, 0x78
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor edi, edi
mov qword [rax + 0x18], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
mov r12, rcx
mov rsi, rdi
mov rbx, rdi
mov rbp, rdi
test rcx, rcx
je 0x1800261c7
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1800261c7
lea rcx, [0x18010bf88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.GDI32.dll_CreateDCA]
mov rsi, rax
test rax, rax
je 0x1800261c7
mov eax, dword [r12]
lea rcx, [rsp + 0x50]
lea edx, [rdi + 8]
mov dword [rcx], eax
mov eax, dword [r12 + 4]
mov dword [rcx + 4], eax
mov eax, dword [r12 + 8]
mov dword [rcx + 8], eax
mov eax, dword [r12 + 0xc]
mov dword [rcx + 0xc], eax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
lea edx, [rdi + 0xa]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r14d, dword [rsp + 0x50]
mov r15d, dword [rsp + 0x54]
mov r12d, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x5c]
test r14d, r14d
mov rcx, rsi
cmovs r14d, edi
test r15d, r15d
cmovs r15d, edi
cmp r12d, ebx
cmovg r12d, ebx
cmp r13d, eax
cmovg r13d, eax
sub r12d, r14d
sub r13d, r15d
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rbx, rax
test rax, rax
je 0x1800261c7
mov r8d, r13d
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdi, rax
test rax, rax
je 0x1800261c7
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbp, rax
test rax, rax
je 0x1800261c7
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r14d
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x1800261d0
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0xa0]
test rbp, rbp
je 0x1800261fb
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdi, rax
mov rbp, qword [rsp + 0x98]
test rbx, rbx
je 0x180026211
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rbx, qword [rsp + 0x90]
test rsi, rsi
je 0x180026227
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rax, rdi
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1800263b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov esi, r9d
movzx ebx, r8w
mov edi, edx
mov ebp, ecx
test r8w, r8w
jne 0x1800263dd
call fcn.180023670
mov bx, ax
mov edx, esi
movzx ecx, bx
call fcn.180023870
test eax, eax
jne 0x1800263f2
xor eax, eax
jmp 0x180026513
mov r9d, esi
mov r8d, edi
mov edx, ebp
call fcn.180023c50
xor ecx, ecx
mov dword [rsp + 0x20], 0x28
mov dword [rsp + 0x2c], ecx
mov dword [rsp + 0x24], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], ecx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], ecx
mov ecx, 1
mov dword [rsp + 0x24], ebp
mov dword [rsp + 0x28], edi
mov word [rsp + 0x2c], cx
mov ecx, eax
mov word [rsp + 0x2e], bx
mov dword [rsp + 0x30], esi
mov ebp, eax
call fcn.18006b890
mov rdi, rax
test rax, rax
je 0x1800263eb
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.18006a0a0
lea rcx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rdi], rax
mov rax, qword [rcx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rdi + 0x18], rax
mov rax, qword [rcx + 0x20]
mov qword [rdi + 0x20], rax
cmp bx, 8
ja 0x1800264f8
mov r9, qword [rsp + 0x80]
test r9, r9
je 0x1800264da
mov r8d, dword [rsp + 0x88]
test r8d, r8d
je 0x1800264da
mov edx, esi
movzx ecx, bx
call fcn.180023a30
mov rcx, rdi
cmp r8d, eax
cmovbe eax, r8d
mov r8d, eax
call fcn.180023d20
mov rdx, r9
mov rcx, rax
call fcn.18006b1c0
jmp 0x180026510
mov edx, esi
movzx ecx, bx
call fcn.180023a30
mov rcx, rdi
mov edx, eax
call fcn.180023d20
mov rcx, rax
call fcn.1800238b0
jmp 0x180026510
cmp esi, 3
jne 0x180026510
mov rcx, rdi
call fcn.180023d20
movzx edx, bx
mov rcx, rax
call fcn.180023810
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180026530
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
xor ebp, ebp
xor eax, eax
lea r9, [r11 + 0x10]
lea rdx, [rsp + 0x30]
lea r8d, [rbp + 0xe]
mov rdi, rcx
mov qword [r11 + 0x18], rbp
mov dword [r11 + 0x10], ebp
mov word [rsp + 0x30], bp
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002671c
cmp dword [rsp + 0xc8], 0xe
jne 0x18002671c
mov eax, 0x4d42
cmp word [rsp + 0x30], ax
jne 0x18002671c
xor eax, eax
lea r9, [rsp + 0xc8]
lea r8d, [rbp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [rsp + 0xc8], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002671c
cmp dword [rsp + 0xc8], 0x28
jne 0x18002671c
cmp dword [rsp + 0x40], 0x28
jne 0x18002671c
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rdx + 0x18], rax
mov rax, qword [rcx + 0x20]
lea rcx, [rsp + 0x70]
mov qword [rdx + 0x20], rax
call fcn.180023c80
mov ecx, eax
mov esi, eax
call fcn.18006b890
mov rbx, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x18002671c
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.18006a0a0
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18006b1c0
mov rcx, rbx
mov dword [rsp + 0xc8], ebp
call fcn.180023af0
test eax, eax
je 0x1800266c6
mov rcx, rbx
call fcn.180023af0
mov rcx, rbx
mov r8d, eax
call fcn.180023d20
lea r9, [rsp + 0xc8]
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002671c
mov edx, dword [rsp + 0x3a]
test edx, edx
je 0x18002671c
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rbx
mov dword [rsp + 0xc8], ebp
call fcn.180023bb0
mov rcx, rbx
mov r10d, eax
call fcn.180023d60
lea r9, [rsp + 0xc8]
mov r8d, r10d
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002671c
mov rax, rbx
jmp 0x180026731
lea rcx, [rsp + 0xd0]
call fcn.180023980
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180026840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rax, rdx
mov rsi, rcx
test rcx, rcx
je 0x18002695f
test rdx, rdx
je 0x18002695f
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002694d
mov rcx, rsi
mov qword [rsp + 0x68], rbp
call fcn.180023ce0
mov rcx, rsi
mov ebp, eax
xor eax, eax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov eax, 0x4d42
mov word [rsp + 0x40], ax
lea eax, [rbp + 0xe]
mov dword [rsp + 0x42], eax
call fcn.180023af0
lea r9, [rsp + 0x60]
add eax, 0x36
lea r8d, [rbx + 0xe]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x4a], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002692d
cmp dword [rsp + 0x60], 0xe
jne 0x18002692d
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002692d
cmp dword [rsp + 0x60], ebp
mov eax, 1
cmove ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
mov eax, ebx
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x18002a180
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rbx, r9
mov rsi, rdx
repne scasb al, byte [rdi]
mov eax, 0x1f3
not rcx
dec rcx
sub eax, ecx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov rcx, rbp
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x18002a1ea
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov edx, 1
movsxd rdi, edi
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
test byte [rsi], 0x10
je 0x18002a32a
cmp byte [rsi + 0x2c], 0x2e
jne 0x18002a229
movzx eax, byte [rsi + 0x2d]
cmp al, 0x2e
jne 0x18002a221
cmp byte [rsi + 0x2e], 0
je 0x18002a362
test al, al
je 0x18002a362
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsi + 0x2c]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov qword [rsp + 0x38], rcx
lea eax, [rcx + 1]
cmp dword [rsp + 0x24], eax
jb 0x18002a358
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
lea rdx, [rsi + 0x2c]
mov r8d, 0x10002
mov rcx, rbp
mov byte [rax + rbp - 1], 0
call qword [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rsi + rcx + 0x2c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18002a280
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov rdx, rsi
repne scasb al, byte [rdi]
movzx eax, word [0x18010c324]
mov rcx, rbp
mov word [rdi - 1], ax
movzx eax, byte [0x18010c326]
mov byte [rdi + 1], al
call fcn.18002a180
lea rcx, [rsi + 0x2c]
xor edx, edx
mov r8d, 0x104
call fcn.18006a0a0
mov eax, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x38]
lea rdx, [rax + rbp - 1]
lea rcx, [rsi + 0x2c]
call fcn.18006c190
mov rdi, qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
lea rdx, [rsi + 0x2c]
mov r8d, 0x20002
mov rcx, rbp
mov byte [rdi + rbp - 1], 0
call qword [rsp + 0x80]
mov byte [rdi + rbp - 1], 0x2a
mov edx, eax
mov dword [rsp + 0x20], eax
mov byte [rdi + rbp], 0
jmp 0x18002a35d
lea rdx, [rsi + 0x2c]
mov r9, rbx
mov r8d, 1
mov rcx, rbp
mov byte [rdi + rbp - 1], 0
call qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
mov byte [rdi + rbp - 1], 0x2a
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x18002a36a
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
test edx, edx
je 0x18002a388
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
test eax, eax
jne 0x18002a200
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180036820
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 8]
xor r8b, r8b
test rdx, rdx
je 0x180036857
nop dword [rax]
cmp dword [rdx], 4
je 0x18003684e
mov eax, dword [rdx + 4]
sub eax, 1
movsxd rcx, eax
js 0x18003684e
mov rax, qword [rdx + 8]
xor r8b, byte [rax + rcx]
sub rcx, 1
jns 0x180036844
mov rdx, qword [rdx + 0x18]
test rdx, rdx
jne 0x180036830
mov al, r8b
ret

Function at 0x1800379c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 8]
xor r10b, r10b
mov r11, rcx
test r9, r9
je 0x1800379e7
mov rcx, qword [r9]
call fcn.180036820
mov r9, qword [r9 + 8]
xor r10b, al
test r9, r9
jne 0x1800379d3
movzx edx, r10b
mov rcx, r11
call fcn.180037900
mov al, r10b
add rsp, 0x28
ret

Function at 0x1800390a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
mov r8, qword [rsp + 0x28]
mov dword [rcx], edx
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], r9d
mov qword [rcx + 0x18], r8
mov rcx, qword [rsp + 0x30]
mov rdx, rax
jmp 0x1800390a0
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
sub rsp, 0x20
mov rdi, r8
movsxd r8, dword [rcx + 0x20]
mov r13, rdx
mov rbx, rcx
xor edx, edx
mov rcx, rdi
call fcn.18006a0a0
mov r8d, dword [rbx + 4]
mov r9d, dword [rbx + 0x20]
mov eax, r8d
xor r12d, r12d
sub eax, r9d
sub eax, dword [rbx + 0x30]
test eax, eax
jle 0x1800391cd
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r14
movzx eax, byte [r13]
movzx ecx, byte [rdi]
xor rcx, rax
mov rax, qword [rbx + 0x10]
movzx esi, byte [rcx + rax]
cmp esi, r8d
je 0x180039156
mov ebp, 1
cmp r9d, ebp
mov r11, rbp
jle 0x180039156
nop word [rax + rax]
mov rax, qword [rbx + 0x18]
movsxd rcx, r9d
sub rcx, r11
movzx edx, byte [rcx + rax]
mov rcx, rbx
add edx, esi
call fcn.180038cd0
inc ebp
inc r11
movsxd rcx, eax
mov rax, qword [rbx + 8]
movzx ecx, byte [rcx + rax]
xor byte [r11 + rdi - 1], cl
mov r9d, dword [rbx + 0x20]
cmp ebp, r9d
jl 0x180039120
mov eax, dword [rbx + 0x20]
lea rdx, [rdi + 1]
mov rcx, rdi
dec eax
movsxd r8, eax
call fcn.18006b1c0
cmp esi, dword [rbx + 4]
je 0x180039195
mov rax, qword [rbx + 0x18]
mov rcx, rbx
movzx edx, byte [rax]
add edx, esi
call fcn.180038cd0
movsxd rcx, dword [rbx + 0x20]
movsxd rdx, eax
mov rax, qword [rbx + 8]
movzx eax, byte [rdx + rax]
mov byte [rcx + rdi - 1], al
jmp 0x18003919e
movsxd rax, dword [rbx + 0x20]
mov byte [rax + rdi - 1], 0
mov r8d, dword [rbx + 4]
mov r9d, dword [rbx + 0x20]
inc r12d
mov eax, r8d
inc r13
sub eax, r9d
sub eax, dword [rbx + 0x30]
cmp r12d, eax
jl 0x1800390f0
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18003d520
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x40
cmp dword [0x1801730a0], 0
mov qword [rsp + 0x50], rbx
mov rbx, rcx
je 0x18003d563
mov eax, dword [0x180170820]
mov qword [rsp + 0x28], rcx
lea r9, str.CTDMOfficeXmlFrame::IsUseOpenXml_________Enable__d__File__p_
lea r8, [0x180103320]
lea rcx, [0x1801727b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.18009ee20
xor edi, edi
cmp dword [0x180170820], edi
je 0x18003d666
test rbx, rbx
je 0x18003d666
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18003d661
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 2
jb 0x18003d658
xor eax, eax
mov ebx, edi
mov word [rsp + 0x58], ax
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
mov dword [rsp + 0x60], edi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
mov r8d, 2
lea r9, [rsp + 0x60]
lea rdx, [rsp + rax + 0x58]
mov rcx, rsi
sub r8d, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003d625
add ebx, dword [rsp + 0x60]
cmp ebx, 2
jb 0x18003d5e0
movzx ebx, word [rsp + 0x58]
call fcn.18003ca60
test eax, eax
je 0x18003d649
mov eax, 0x4b50
cmp bx, ax
je 0x18003d653
mov eax, 0xcfd0
cmp bx, ax
jne 0x18003d658
jmp 0x18003d653
mov eax, 0x4b50
cmp bx, ax
jne 0x18003d658
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
cmp dword [0x1801730a0], 0
mov rbx, qword [rsp + 0x50]
je 0x18003d695
lea r9, str.CTDMOfficeXmlFrame::IsUseOpenXml_____d_
lea r8, [0x180103320]
lea rcx, [0x1801727b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], edi
call fcn.18009ee20
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x180044150
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rsi, r8
mov ebp, edx
mov r13, rcx
xor ebx, ebx
cmp edx, 1
cmova ebp, ebx
cmp ebp, 1
jne 0x18004432d
test r8, r8
je 0x180044338
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x180044338
mov qword [r11 - 0x68], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp dword [0x1801730a0], ebx
je 0x180044205
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, str.CTDocMarkFrame::GenerateDocID_1___s___08x_
lea r8, str.DocMarkFrame
or edx, 0xffffffff
lea rcx, [0x1801727b8]
call fcn.18009ee20
cmp rdi, 0xffffffffffffffff
je 0x180044338
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x180044322
mov rcx, rsi
call fcn.18006b0e8
mov r12, rax
test rax, rax
je 0x180044322
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.18006a0a0
mov dword [rsp + 0xa8], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xa8]
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, dword [rsp + 0xa8]
jne 0x18004431a
lea rcx, [rsp + 0x48]
call fcn.1800be6d0
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x48]
call fcn.1800bee50
lea rcx, [rsp + 0xb8]
call fcn.180069230
nop
lea r9, [rsp + 0xb8]
mov r8d, esi
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.1800be720
lea rcx, [rsp + 0xb8]
call fcn.180069140
test rax, rax
je 0x180044302
lea rcx, [rsp + 0xb8]
call fcn.180068ca0
cmp eax, 0x10
jne 0x180044302
lea rcx, [rsp + 0xb8]
call fcn.180069140
mov rdx, rax
mov rax, qword [rax]
mov qword [r13], rax
mov rax, qword [rdx + 8]
mov qword [r13 + 8], rax
mov ebx, 1
lea rcx, [rsp + 0xb8]
call fcn.180069330
nop
lea rcx, [rsp + 0x48]
call fcn.1800be700
mov rcx, r12
call fcn.18006aac0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180044338
test ebp, ebp
jne 0x180044338
call fcn.18002a110
mov ebx, eax
cmp dword [0x1801730a0], 0
je 0x180044391
mov rdx, r13
lea rcx, [rsp + 0xb8]
call fcn.18006a000
nop
mov dword [rsp + 0x30], ebp
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.CTDocMarkFrame::GenerateDocID___ret_d____s___d_
lea r8, str.DocMarkFrame
or edx, 0xffffffff
lea rcx, [0x1801727b8]
call fcn.18009ee20
nop
lea rcx, [rsp + 0xb8]
call fcn.180057b10
mov eax, ebx
jmp 0x180044393
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18004c430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x18004c430
mov r11, rsp
push rbp
push rsi
sub rsp, 0xf8
mov eax, r8d
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x18004c6e4
test rdx, rdx
je 0x18004c6e4
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x28], r14
xor r14d, r14d
lea r8, [r11 + 8]
lea rdx, [r11 + 0x20]
mov ecx, eax
mov qword [r11 + 0x20], r14
mov dword [r11 + 8], r14d
call fcn.18003c0c0
cmp qword [rsp + 0x128], r14
je 0x18004c6dd
mov ebx, dword [rsp + 0x110]
test ebx, ebx
je 0x18004c6dd
mov qword [rsp + 0x120], rdi
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0xbc
mov qword [rsp + 0xf0], r12
mov edi, 0xe8080000
mov qword [rsp + 0xe8], r13
call fcn.18006a0a0
mov r11d, dword [rsp + 0xc8]
mov eax, dword [0x18017139c]
lea r12d, [r11 + rax*2 + 0xc2]
add r12d, dword [rsp + 0xcc]
add r12d, dword [rsp + 0xd0]
add r12d, dword [rsp + 0xd4]
add r12d, dword [rsp + 0xd8]
add r12d, ebx
mov ecx, r12d
mov r13d, r12d
call fcn.18006b890
mov rbx, rax
test rax, rax
jne 0x18004c51b
mov edi, 0xe8082017
jmp 0x18004c68a
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.18006a0a0
mov dword [rbx], 0xe8081234
mov eax, dword [rsp + 0x110]
mov dword [rbx + 0xa0], eax
mov r8d, dword [rsp + 0x110]
mov rdx, qword [rsp + 0x128]
lea rcx, [rbx + 0xc0]
call fcn.18006b1c0
mov eax, dword [rbx + 0xa0]
mov r11d, dword [0x18017139c]
lea rdx, [rax + rbx + 0xc0]
mov dword [rbx + 0xa4], r11d
lea rcx, str.___:__
nop word [rax + rax]
movzx eax, word [rcx]
add rdx, 2
add rcx, 2
mov word [rdx - 2], ax
test ax, ax
jne 0x18004c580
movabs rax, 0x4000000000000000
movabs rcx, 0x4059000000000000
mov dword [rbx + 0x3c], 1
mov qword [rbx + 0x78], rax
mov dword [rbx + 0x40], r14d
mov dword [rbx + 0x44], 0xffffff
mov dword [rbx + 0x48], r14d
mov qword [rbx + 0x70], rcx
mov dword [rbx + 0x54], 0x2710
mov dword [rbx + 0x58], 0xffffd8f0
mov dword [rbx + 0x2c], 0x104
mov dword [rbx + 0x30], 1
mov dword [rbx + 0x24], 0x1e
mov dword [rbx + 0x28], 1
mov dword [rbx + 0x34], 0xffffffff
mov dword [rbx + 0x38], 1
mov dword [rbx + 0xc], 0xfe
mov dword [rbx + 0x10], 1
mov dword [rbx + 0x1c], 0xffffffff
mov dword [rbx + 0x20], 1
mov qword [rbx + 0x98], r14
mov qword [rbx + 0x80], rcx
mov qword [rbx + 0x88], r14
mov dword [rbx + 0x4c], 0x2710
mov dword [rbx + 0x50], r14d
mov dword [rbx + 4], 6
mov dword [rbx + 8], 1
mov dword [rbx + 0x14], 0x208
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x5c], 0x7fffffff
mov dword [rbx + 0x60], 0x80000000
mov dword [rbx + 0x64], 0x7fffffff
mov dword [rbx + 0x68], 0x80000000
movabs rax, 0x4056800000000000
mov qword [rbx + 0x90], rax
mov qword [rbp], rbx
mov dword [rsi], r12d
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
cmp qword [rsp + 0x128], r14
je 0x18004c6b9
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x128]
call fcn.18003c120
mov eax, edi
mov rdi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x118]
mov r14, qword [rsp + 0xe0]
add rsp, 0xf8
pop rsi
pop rbp
ret
mov eax, 0xe808000e
jmp 0x18004c6c3
mov eax, 0xe8080003
add rsp, 0xf8
pop rsi
pop rbp
ret