joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016b60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x40], 0
call fcn.1800644c0
mov rsi, qword [rdi + 0x10]
cmp rsi, 0xffffffffffffffff
je 0x180016d14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180016c67
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rsi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180016c7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180016c14
cmp eax, 0x3e6
je 0x180016c14
test eax, eax
jle 0x180016c6e
movzx eax, ax
or eax, 0x80070000
jmp 0x180016c6c
mov edx, 0x200
mov rcx, rdi
call fcn.180003cc0
test eax, eax
js 0x180016d19
cmp eax, 1
je 0x180016c6c
mov rdx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180016c67
mov rdx, qword [rdi]
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.180063290
jmp 0x180016c7d
call fcn.1800030e0
test eax, eax
js 0x180016d19
cmp eax, 1
je 0x180016d19
mov eax, dword [rsp + 0x40]
cmp eax, 0x44574f43
jne 0x180016c92
mov eax, 0xe0033001
jmp 0x180016d19
cmp eax, 0x564d444b
je 0x180016ca0
mov eax, 0xe00e1001
jmp 0x180016d19
cmp dword [rsp + 0x89], 0xa0d200a
je 0x180016cb4
mov eax, 0xe003300c
jmp 0x180016d19
cmp word [rsp + 0x8d], 0
je 0x180016cc6
mov eax, 0xe0033003
jmp 0x180016d19
mov eax, dword [rdi + 0x4c]
cmp qword [rsp + 0x4c], rax
je 0x180016cd7
mov eax, 0xe003300b
jmp 0x180016d19
mov eax, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
mov dword [rdi + 0x50], eax
mov eax, dword [rsp + 0x78]
mov rcx, rdi
mov dword [rdi + 0x54], eax
mov eax, dword [rsp + 0x70]
mov dword [rdi + 0x58], eax
mov eax, dword [rsp + 0x5c]
shl eax, 9
mov dword [rdi + 0x5c], eax
mov eax, dword [rsp + 0x64]
shl eax, 9
mov dword [rdi + 0x60], eax
call fcn.180016d40
jmp 0x180016d19
mov eax, 0x80070057
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180062100
mov rsi, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x180017590
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x268
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [r9]
mov r12d, edx
mov rdi, rcx
cqo
mov rbp, r8
lea rcx, [rsp + 0x51]
and edx, 0x1ff
mov rsi, r9
mov byte [rsp + 0x50], 0
add rax, rdx
xor edx, edx
sar rax, 9
mov dword [r8], eax
mov r8d, 0x1ff
mov rbx, rax
call fcn.1800644c0
mov r11d, dword [rdi + 0x50]
lea ecx, [r11 + rbx - 1]
shl rcx, 9
mov qword [rsi], rcx
mov rbx, qword [rdi + 0x10]
cmp rbx, 0xffffffffffffffff
je 0x1800177bf
mov rax, rcx
xor r13d, r13d
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
je 0x180017650
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x50]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], 0x200
call fcn.180003e90
jmp 0x180017709
mov rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180017704
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x200
mov rcx, rbx
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001771a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x1800176b7
cmp eax, 0x3e6
je 0x1800176b7
test eax, eax
jle 0x18001770b
movzx eax, ax
or eax, 0x80070000
jmp 0x180017709
mov edx, 0x200
mov rcx, rdi
call fcn.180003cc0
test eax, eax
js 0x1800177c4
cmp eax, 1
je 0x180017709
mov rcx, qword [rdi]
lea rdx, [rsp + 0x50]
mov r8d, 0x200
call fcn.180063290
mov rdx, qword [rdi]
lea r9, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001771a
call fcn.1800030e0
test eax, eax
js 0x1800177c4
cmp eax, 1
je 0x1800177c4
mov eax, dword [rbp]
mov rcx, qword [rdi + 0x68]
mov edx, r12d
sub edx, dword [rdi + 0x70]
mov rbx, r12
mov qword [rsp + 0x30], r13
mov dword [rcx + rdx*4], eax
mov eax, dword [rdi + 0x54]
sub r12d, dword [rdi + 0x70]
shl rbx, 2
mov ebp, r12d
mov r9, rsi
shl rbp, 2
and ebx, 0xfffffe00
mov r8d, 1
add eax, ebx
and ebp, 0xfffffe00
mov qword [rsi], rax
mov rcx, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x10]
add rcx, rbp
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov dword [rsp + 0x20], 0x200
call fcn.180003b50
test eax, eax
js 0x1800177c4
cmp eax, 1
je 0x1800177c4
mov eax, dword [rdi + 0x58]
mov qword [rsp + 0x30], r13
mov r9, rsi
add eax, ebx
mov r8d, 1
mov rcx, rdi
mov qword [rsi], rax
mov r10, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x10]
add r10, rbp
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], 0x200
call fcn.180003b50
jmp 0x1800177c4
mov eax, 0x80070057
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180062100
add rsp, 0x268
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180019a60
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x220]
test rcx, rcx
je 0x180019a85
call fcn.1800626bc
mov qword [rbx + 0x220], 0
mov rcx, qword [rbx + 0x218]
cmp rcx, 0xffffffffffffffff
je 0x180019aad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x10]
mov qword [rbx + 0x218], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
test rcx, rcx
je 0x180019ac1
call fcn.1800626bc
mov qword [rbx], 0
mov rcx, rbx
mov dword [rbx + 8], 0
call fcn.1800620e0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x180019dd0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
cmp r8d, 0xa00000
jbe 0x180019e01
mov eax, 0x80004005
jmp 0x180019f4d
mov dword [rcx + 0x228], edx
mov dword [rcx + 0x22c], r8d
mov ecx, r8d
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
lea rdx, [0x1800fee28]
cmovo rax, rcx
mov rcx, rax
call fcn.1800626b4
mov qword [rbx + 0x220], rax
test rax, rax
jne 0x180019e49
mov eax, 0x8007000e
jmp 0x180019f4d
mov r8d, dword [rbx + 0x22c]
mov edx, 0xff
mov rcx, rax
shl r8, 2
mov qword [rsp + 0x278], rsi
call fcn.1800644c0
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], si
call fcn.1800644c0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x180019f6a
cmp eax, 0x104
ja 0x180019f6a
lea rdx, str.WMCache_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180019edc
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180019f6a
lea r9, [rbx + 0x10]
lea rdx, [0x1800daca0]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x280], rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x180019f38
mov qword [rsp + 0x30], rsi
lea rcx, [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x20000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x218], rax
cmp rax, 0xffffffffffffffff
jne 0x180019f66
call fcn.1800030e0
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180062100
add rsp, 0x260
pop rbx
ret
xor eax, eax
jmp 0x180019f3d
call fcn.1800030e0
jmp 0x180019f45
Function at 0x180019f80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x250
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r12, r8
mov ebp, edx
mov rbx, rcx
cmp edx, dword [rcx + 0x22c]
jb 0x180019fb8
mov eax, 0x80070057
jmp 0x18001a14e
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x40], 0
call fcn.1800644c0
mov ecx, dword [rbx + 0x228]
mov rax, qword [rbx + 0x230]
mov rdi, qword [rbx + 0x218]
lea r10, [rcx + rax - 0x200]
mov qword [rsp + 0x38], r10
cmp rdi, 0xffffffffffffffff
je 0x18001a141
mov rax, r10
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
je 0x18001a045
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x200
call fcn.180003e90
jmp 0x18001a107
xor r9d, r9d
xor r8d, r8d
mov rdx, r10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18001a065
call fcn.1800030e0
jmp 0x18001a107
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rdi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001a110
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x18001a0b5
cmp eax, 0x3e6
je 0x18001a0b5
test eax, eax
jle 0x18001a107
movzx eax, ax
or eax, 0x80070000
jmp 0x18001a107
mov edx, 0x200
mov rcx, rbx
call fcn.180003cc0
test eax, eax
js 0x18001a107
cmp eax, 1
je 0x18001a107
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
call fcn.180063290
mov rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001a110
call fcn.1800030e0
test eax, eax
js 0x18001a146
cmp eax, 1
je 0x18001a146
mov ecx, dword [rbx + 0x228]
mov rax, qword [rbx + 0x230]
xor edx, edx
div rcx
mov dword [r12], eax
mov rcx, qword [rbx + 0x220]
mov dword [rcx + rbp*4], eax
mov eax, dword [rbx + 0x228]
add qword [rbx + 0x230], rax
xor eax, eax
jmp 0x18001a146
mov eax, 0x80070057
mov rdi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180062100
add rsp, 0x250
pop r12
pop rbp
pop rbx
ret
Function at 0x18001f5f0
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, qword [rsp + 0xd0]
xor r14d, r14d
mov rdi, r8
mov dword [r8], r14d
mov rbp, r9
mov rsi, rdx
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r14d
mov r13, rcx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001f65f
call fcn.1800030e0
jmp 0x18001f7ea
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsi], eax
cmp eax, 0xffffffff
jne 0x18001f688
call fcn.1800030e0
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18001f7ea
xor eax, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9, rbp
mov rcx, rbx
mov byte [rsp + 0x40], r14b
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
call fcn.18001f950
mov esi, eax
test eax, eax
js 0x18001f7df
cmp eax, 1
je 0x18001f7df
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
mov r8, r12
mov edx, 0x10
call fcn.18001f500
mov dword [rdi], eax
test eax, eax
jne 0x18001f739
lea rax, [rsp + 0x40]
lea r8, [0x180000000]
mov dx, word [rax]
cmp dx, word [r8 + 0xdaeb0]
jne 0x18001f72a
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0xdaeb2]
jne 0x18001f72a
mov eax, r14d
jmp 0x18001f72f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18001f740
mov dword [rdi], 5
xor eax, eax
jmp 0x18001f7ea
lea rax, [rsp + 0x40]
mov edx, dword [rax]
cmp edx, dword [r8 + 0xdaeb8]
jne 0x18001f763
mov dx, word [rax + 4]
cmp dx, word [r8 + 0xdaebc]
jne 0x18001f763
mov eax, r14d
jmp 0x18001f768
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18001f774
mov dword [rdi], 4
jmp 0x18001f7ea
lea rax, [rsp + 0x40]
mov rdx, qword [rax]
cmp rdx, qword [r8 + 0xdaec0]
jne 0x18001f797
mov rdx, qword [rax + 8]
cmp rdx, qword [r8 + 0xdaec8]
jne 0x18001f797
mov eax, r14d
jmp 0x18001f79c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18001f7a8
mov dword [rdi], 6
jmp 0x18001f7ea
mov eax, dword [rsp + 0x50]
cmp eax, dword [0x1800daeb4]
jne 0x18001f7be
mov dword [rdi], 2
xor eax, eax
jmp 0x18001f7ea
cmp dword [rsp + 0xd8], r14d
je 0x18001f7d8
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.18001f810
jmp 0x18001f7ea
mov dword [rdi], r14d
xor eax, eax
jmp 0x18001f7ea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180062100
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001f810
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor r12d, r12d
mov rbp, r8
mov rsi, rdx
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18001f867
call fcn.1800030e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
lea rdx, [0x1800fee28]
mov ecx, 0x80000
mov qword [rsp + 0x60], rbx
call fcn.1800626b4
mov rbx, rax
test rax, rax
jne 0x18001f898
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x18001f930
xor edx, edx
mov r8d, 0x80000
mov rcx, rax
call fcn.1800644c0
lea r9, [rsp + 0x78]
mov r8d, 0x80000
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001f8e9
call fcn.1800030e0
mov rcx, rbx
mov esi, eax
call fcn.1800626bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x18001f930
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
mov rdi, rbx
test eax, eax
je 0x18001f923
nop dword [rax]
mov r8, rbp
mov edx, eax
mov rcx, rdi
call fcn.18001f500
mov dword [rsi], eax
test eax, eax
jne 0x18001f926
mov eax, dword [rsp + 0x78]
inc rdi
add eax, 0xffffffff
mov dword [rsp + 0x78], eax
jne 0x18001f900
mov dword [rsi], r12d
mov rcx, rbx
call fcn.1800626bc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x18002d520
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
xor al, al
xor ebx, ebx
mov rbp, r8
cmp byte [rcx + 0x1e], bl
movzx eax, al
mov esi, 1
cmovne eax, esi
mov rdi, rcx
mov dword [rcx + 0xc20], ebx
test al, al
mov r8d, esi
mov ecx, 3
cmovne r8d, ecx
cmp byte [rdi + 0x1d], bl
mov eax, 0x8000000
cmovne eax, ebx
test rbp, rbp
je 0x18002d59c
cmp word [rbp], bx
je 0x18002d59c
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rbp
xor r9d, r9d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x18002d5b9
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor r9d, r9d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x18002d5d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18002d5d3
mov dword [rdi + 0xc20], esi
cmp r12, 0xffffffffffffffff
mov byte [rdi + 0x1a], bl
mov dword [rdi + 0x14], ebx
setne sil
mov byte [rdi + 0x18], bl
test sil, sil
je 0x18002d68d
mov qword [rdi + 8], r12
test rbp, rbp
je 0x18002d627
lea rdx, [rdi + 0x420]
mov rcx, rbp
sub rdx, rbp
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x18002d610
jmp 0x18002d630
mov word [rdi + 0x420], bx
nop
mov qword [rsp + 0x38], rbx
lea rax, [rdi + 0x1f]
mov qword [rsp + 0x30], rbx
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x1000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x18002d68d
lea rdx, [0x1800ffe10]
mov rcx, rdx
nop dword [rax]
cmp qword [rcx], 0
je 0x18002d686
inc ebx
add rcx, 8
cmp ebx, 0x100
jb 0x18002d670
jmp 0x18002d68d
movsxd rax, ebx
mov qword [rdx + rax*8], rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov al, sil
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r12
ret
Function at 0x18002d8d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov ebp, 0x4e20
jne 0x18002d90d
cmp r8d, ebp
mov ecx, 0xfffffff6
cmovg edi, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18002d977
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18002d95d
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x18002d949
cmp eax, 3
jne 0x18002d95d
cmp edi, ebp
jle 0x18002d95d
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call fcn.18002d8d0
jmp 0x18002d97b
cmp dword [rbx + 0x14], 1
jne 0x18002d972
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x18002d972
xor eax, eax
jmp 0x18002d97b
or eax, 0xffffffff
jmp 0x18002d97b
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18002f9e0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r13, rdx
mov rbp, rcx
xor r15d, r15d
mov dword [rdx + 8], r15d
mov rax, qword [rdx]
mov word [rax], r15w
mov ebx, r15d
movzx edi, word [rcx]
test di, di
je 0x18002fa3c
mov rax, rcx
nop word [rax + rax]
inc ebx
add rax, 2
cmp word [rax], r15w
jne 0x18002fa30
cmp ebx, 1
jl 0x18002fc52
cmp di, 0x5c
je 0x18002fc52
cmp di, 0x2e
jne 0x18002fa6d
cmp ebx, 1
je 0x18002fc52
cmp ebx, 2
jne 0x18002fa6d
cmp word [rcx + 2], di
je 0x18002fc52
mov dword [rsp + 0x30], r15d
mov esi, 4
mov eax, 2
mul rsi
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.1800630a0
mov r14, rax
mov qword [rsp + 0x28], rax
mov word [rax], r15w
mov dword [rsp + 0x34], esi
cmp ebx, 3
jle 0x18002fad3
cmp word [rbp + 2], 0x3a
jne 0x18002fad3
cmp word [rbp + 4], 0x5c
jne 0x18002fad3
cmp di, 0x61
jb 0x18002fac5
cmp di, 0x7a
jbe 0x18002fb6b
sub di, 0x41
cmp di, 0x19
jbe 0x18002fb6b
mov edi, 0x106
mov eax, 2
mul rdi
cmovo rax, r12
mov rcx, rax
call fcn.1800630a0
mov rbx, rax
mov rcx, r14
call fcn.1800626bc
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov word [rbx], r15w
mov dword [rsp + 0x34], edi
mov rdx, rbx
lea ecx, [rdi - 1]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r11d, eax
mov edx, r15d
cmp word [rbx], dx
je 0x18002fb2d
mov rcx, rbx
inc edx
add rcx, 2
cmp word [rcx], 0
jne 0x18002fb21
movsxd rax, edx
mov word [rbx + rax*2], r15w
mov dword [rsp + 0x30], edx
test r11d, r11d
je 0x18002fc46
cmp r11d, 0x104
ja 0x18002fc46
cmp word [rbx + rax*2 - 2], 0x5c
je 0x18002fb6b
mov edx, 0x5c
lea rcx, [rsp + 0x28]
call fcn.180022500
mov r14, qword [rsp + 0x28]
mov rsi, r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x44], r15d
mov ebx, r15d
lea rdi, [0x1800dbcd8]
mov rcx, rdi
inc ebx
add rcx, 2
cmp word [rcx], si
jne 0x18002fb85
lea r12d, [rbx + 1]
test r12d, r12d
je 0x18002fbc8
movsxd rcx, r12d
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800630a0
mov rsi, rax
mov qword [rsp + 0x38], rax
mov word [rax], r15w
mov dword [rsp + 0x44], r12d
mov rcx, rsi
sub rdi, rsi
nop
movzx eax, word [rdi + rcx]
mov word [rcx], ax
add rcx, 2
test ax, ax
jne 0x18002fbd0
mov dword [rsp + 0x40], ebx
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180025cb0
nop
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180025c10
nop
cmp rax, r13
je 0x18002fc1b
mov rdx, rax
mov rcx, r13
call fcn.180025380
nop
mov rcx, qword [rsp + 0x48]
call fcn.1800626bc
nop
mov rcx, qword [rsp + 0x58]
call fcn.1800626bc
nop
mov rcx, rsi
call fcn.1800626bc
nop
mov rcx, r14
call fcn.1800626bc
mov al, 1
jmp 0x18002fc54
mov rcx, rbx
call fcn.1800626bc
xor al, al
jmp 0x18002fc54
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18002fdb0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x18]
mov eax, 0x400000
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne dl
test rbx, rbx
je 0x18002fdf5
mov ecx, dword [rsp + 0x50]
mov dword [rbx], ecx
test dl, dl
je 0x18002fe01
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18002fe16
mov eax, 0x80004005
add rsp, 0x30
pop rbx
ret
jle 0x18002fe20
movzx eax, ax
or eax, 0x80070000
add rsp, 0x30
pop rbx
ret

Function at 0x18002fec0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18002ff1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18002ff1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18002ff07
mov eax, 0x80004005
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jle 0x18002ff2c
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rbx
xor eax, eax
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180030f20
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov r12, rcx
mov rcx, qword [rcx + 0x18]
mov rsi, r8
mov rdi, r9
mov rbp, rdx
lea r8, [rsp + 0x40]
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180030f6c
call fcn.1800030e0
jmp 0x180030fa3
mov rcx, qword [r12 + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180030f65
mov rax, qword [rsp + 0x40]
mov qword [rbp], 0
mov qword [rsi], rax
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180030ff0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x28]
mov eax, r8d
mov rbx, r9
xor r9d, r9d
mov r8d, 0x400000
mov dword [rsp + 0x50], r9d
cmp eax, r8d
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x50]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180031034
call fcn.1800030e0
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x18003103f
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret