joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000031a4
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x8b0
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
mov ebp, 0x104
lea rdx, [r11 - 0x228]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [0x100001af0]
lea rcx, [rsp + 0x690]
mov rdx, rbp
call fcn.100002910
lea rdx, [rsp + 0x690]
lea rax, [rsp + 0x480]
sub rdx, rax
mov r11, rbp
lea rcx, [rsp + 0x480]
xor esi, esi
lea rax, [r11 + 0x7ffffefa]
cmp rax, rsi
je 0x10000323a
movzx eax, word [rdx + rcx]
cmp ax, si
je 0x10000323a
mov word [rcx], ax
add rcx, 2
sub r11, 1
jne 0x100003218
cmp r11, rsi
jne 0x100003243
sub rcx, 2
mov word [rcx], si
lea r8, [0x100001b10]
lea rcx, [rsp + 0x480]
mov rdx, rbp
call fcn.100002910
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x100003322
lea rbx, [rsp + 0x690]
lea rax, [rsp + 0x270]
sub rbx, rax
mov rdx, rbp
lea rcx, [rsp + 0x270]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x1000032bd
movzx eax, word [rbx + rcx]
cmp ax, si
je 0x1000032bd
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10000329b
cmp rdx, rsi
jne 0x1000032c6
sub rcx, 2
mov word [rcx], si
lea r8, [0x100001b18]
lea rcx, [rsp + 0x270]
mov rdx, rbp
call fcn.100002910
lea r8, [rsp + 0x4c]
lea rcx, [rsp + 0x270]
mov rdx, rbp
call fcn.100002910
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
jne 0x100003290
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.10000e1c0
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100003354
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov ecx, 0x410
mov rbx, rsi
call fcn.10000daf8
mov rdi, rax
cmp rax, rsi
je 0x10000345a
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rdi + 0x208]
lea r8, [0x100014af0]
mov r11d, 0x104
sub r8, rcx
mov rdx, r11
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x1000033c8
movzx eax, word [r8 + rcx]
cmp ax, si
je 0x1000033c8
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000033a5
cmp rdx, rsi
jne 0x1000033d1
sub rcx, 2
lea r8, [0x1000148e0]
mov word [rcx], si
mov rdx, rdi
sub r8, rdi
lea rax, [r11 + 0x7ffffefa]
cmp rax, rsi
je 0x100003404
movzx eax, word [r8 + rdx]
cmp ax, si
je 0x100003404
mov word [rdx], ax
add rdx, 2
sub r11, 1
jne 0x1000033e1
cmp r11, rsi
jne 0x10000340d
sub rdx, 2
lea rcx, [0x100014d50]
mov word [rdx], si
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x40]
lea r8, [fcn.100002fd4]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, rsi
jne 0x100003451
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x10000345a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x100003474
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x430
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
and dword [rsp + 0x40], 0
mov edi, 0x80004005
cmp rdx, 0xffffffffffffffff
jne 0x1000034fa
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000148e0]
call fcn.100005f04
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, 0xffffffffffffffff
je 0x1000036d5
mov dword [rsp + 0x40], 1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
mov dword [rsp + 0x44], eax
xor ecx, ecx
call fcn.10000c9ec
mov rdx, rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1000036d5
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1000036cc
mov r9d, 0xffff
mov r8d, r14d
mov rdx, rax
lea rcx, [0x1000125b0]
call fcn.100007238
lea rdx, [rsp + 0x60]
lea rcx, [0x1000125b0]
call fcn.100006fa4
test byte [rsi + 0x142], 1
je 0x1000035b8
xor eax, eax
mov rcx, qword [0x1000125c8]
test byte [rcx + 0x40], 1
jne 0x1000035b0
mov eax, dword [rcx + 0x28]
inc eax
mov dword [rsi + 0x146], eax
mov r8d, dword [rsi + 0x150]
mov rdx, rsi
lea rcx, [0x1000125b0]
call fcn.1000083b4
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x10000360c
cmp edi, 0x80028016
jne 0x1000036b7
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.10000477c
test eax, eax
je 0x1000036a8
mov r9d, 0xffff
mov r8d, dword [rsp + 0x44]
mov r12, qword [rsp + 0x38]
mov rdx, r12
lea rcx, [0x1000125b0]
call fcn.100007238
mov r8d, dword [rsi + 0x150]
mov rdx, rsi
lea rcx, [0x1000125b0]
call fcn.1000083b4
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x1000036a1
mov r13, qword [rsp + 0x48]
jmp 0x1000036b7
mov edi, 0x80004005
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x38]
lea rcx, [0x1000125b0]
call fcn.100007020
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0
je 0x1000036eb
cmp rbx, 0xffffffffffffffff
je 0x1000036eb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, edi
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.10000e1c0
mov rbx, qword [rsp + 0x470]
add rsp, 0x430
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100003724
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x440
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rbx
and dword [rsp + 0x38], 0
mov edi, 0x80004005
cmp r8, 0xffffffffffffffff
jne 0x1000037b1
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000148e0]
call fcn.100005f04
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, 0xffffffffffffffff
je 0x1000039b6
mov dword [rsp + 0x38], 1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
mov dword [rsp + 0x34], eax
xor ecx, ecx
call fcn.10000c9ec
mov rdx, rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1000039b6
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1000039ad
mov r9d, 0xffff
mov r8d, r15d
mov rdx, rax
lea rcx, [0x1000125b0]
call fcn.100007238
lea rdx, [rsp + 0x70]
lea rcx, [0x1000125b0]
call fcn.100006fa4
test byte [rsi + 0x142], 1
je 0x10000386f
xor eax, eax
mov rcx, qword [0x1000125c8]
test byte [rcx + 0x40], 1
jne 0x100003867
mov eax, dword [rcx + 0x28]
inc eax
mov dword [rsi + 0x146], eax
mov eax, dword [rsi + 0x150]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsi + 0x154]
mov r8, r14
mov rdx, rsi
lea rcx, [0x1000125b0]
call fcn.100008944
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x1000038d5
cmp edi, 0x80028016
jne 0x100003998
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.10000477c
test eax, eax
je 0x100003989
mov r9d, 0xffff
mov r8d, dword [rsp + 0x34]
mov r12, qword [rsp + 0x40]
mov rdx, r12
lea rcx, [0x1000125b0]
call fcn.100007238
mov r11d, dword [rsi + 0x150]
mov dword [rsp + 0x20], r11d
mov r9d, dword [rsi + 0x154]
mov r8, r14
mov rdx, rsi
lea rcx, [0x1000125b0]
call fcn.100008944
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x100003982
mov r13, qword [rsp + 0x48]
jmp 0x100003998
mov edi, 0x80004005
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
lea rcx, [0x1000125b0]
call fcn.100007020
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x38], 0
je 0x1000039cc
cmp rbx, 0xffffffffffffffff
je 0x1000039cc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r14
call sub.msvcrt.dll_free
mov eax, edi
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.10000e1c0
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x100003a08
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x430
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
and dword [rsp + 0x40], 0
mov ebx, 0x80004005
cmp rdx, 0xffffffffffffffff
jne 0x100003a8e
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000148e0]
call fcn.100005f04
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, 0xffffffffffffffff
je 0x100003c57
mov dword [rsp + 0x40], 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
mov dword [rsp + 0x44], eax
xor ecx, ecx
call fcn.10000c9ec
mov rdx, rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x100003c57
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100003c4e
mov r9d, 0xffff
mov r8d, r14d
mov rdx, rax
lea r14, [0x1000125b0]
mov rcx, r14
call fcn.100007238
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.100006fa4
nop
cmp dword [rsi + 4], 0
je 0x100003b45
lea r8, [rsi + 8]
mov edx, dword [rsi]
mov rcx, r14
call fcn.1000092bc
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x100003b58
xor r8d, r8d
mov edx, dword [rsi]
mov rcx, r14
call fcn.1000092bc
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x100003b97
cmp ebx, 0x80028016
jne 0x100003c3d
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.10000477c
test eax, eax
je 0x100003c2e
mov r9d, 0xffff
mov r8d, dword [rsp + 0x44]
mov r12, qword [rsp + 0x38]
mov rdx, r12
mov rcx, r14
call fcn.100007238
lea r8, [rsi + 8]
mov edx, dword [rsi]
mov rcx, r14
call fcn.1000092bc
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x100003c27
mov r13, qword [rsp + 0x48]
jmp 0x100003c3d
mov ebx, 0x80004005
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x38]
mov rcx, r14
call fcn.100007020
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0
je 0x100003c6d
cmp rdi, 0xffffffffffffffff
je 0x100003c6d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, ebx
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.10000e1c0
mov rbx, qword [rsp + 0x470]
add rsp, 0x430
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100003ca8
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x430
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
and dword [rsp + 0x40], 0
mov edi, 0x80004005
cmp rdx, 0xffffffffffffffff
jne 0x100003d2e
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000148e0]
call fcn.100005f04
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, 0xffffffffffffffff
je 0x100003f18
mov dword [rsp + 0x40], 1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
mov dword [rsp + 0x44], eax
xor ecx, ecx
call fcn.10000c9ec
mov rdx, rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x100003f18
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100003f0f
mov r9d, 0xffff
mov r8d, r14d
mov rdx, rax
lea rcx, [0x1000125b0]
call fcn.100007238
lea rdx, [rsp + 0x60]
lea rcx, [0x1000125b0]
call fcn.100006fa4
nop
mov eax, dword [r12 + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [r12 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r12 + 8]
mov r8d, dword [r12 + 4]
mov edx, dword [r12]
lea rcx, [0x1000125b0]
call fcn.100008ee0
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x100003e34
cmp edi, 0x80028016
jne 0x100003efa
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.10000477c
test eax, eax
je 0x100003eeb
mov r9d, 0xffff
mov r8d, dword [rsp + 0x44]
mov rsi, qword [rsp + 0x38]
mov rdx, rsi
lea rcx, [0x1000125b0]
call fcn.100007238
mov r11d, dword [r12 + 0x10]
mov dword [rsp + 0x28], r11d
mov eax, dword [r12 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r12 + 8]
mov r8d, dword [r12 + 4]
mov edx, dword [r12]
lea rcx, [0x1000125b0]
call fcn.100008ee0
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x100003ee4
mov r13, qword [rsp + 0x48]
jmp 0x100003efa
mov edi, 0x80004005
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
lea rcx, [0x1000125b0]
call fcn.100007020
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0
je 0x100003f2e
cmp rbx, 0xffffffffffffffff
je 0x100003f2e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call sub.msvcrt.dll_free
mov eax, edi
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.10000e1c0
mov rbx, qword [rsp + 0x470]
add rsp, 0x430
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100004260
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x420
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov r13d, ecx
mov ebx, 0x80004005
mov dword [rsp + 0x30], ebx
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000148e0]
call fcn.100005f04
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, 0xffffffffffffffff
je 0x1000043b7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
xor ecx, ecx
call fcn.10000c9ec
mov rdx, rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r12, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1000043b7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1000043ae
mov r9d, 0xffff
mov r8d, r14d
mov rdx, rax
lea rcx, [0x1000125b0]
call fcn.100007238
lea rdx, [rsp + 0x50]
lea rcx, [0x1000125b0]
call fcn.100006fa4
nop
mov rcx, qword [0x1000125c8]
mov eax, dword [rcx + 0x40]
xor eax, r13d
and eax, 1
xor dword [rcx + 0x40], eax
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100004399
lea rcx, [0x1000125b0]
call fcn.100007020
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000043d7
mov eax, ebx
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.10000e1c0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x100004410
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x430
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov ebx, 0x80004005
mov dword [rsp + 0x30], ebx
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000148e0]
call fcn.100005f04
mov rsi, rax
mov qword [rsp + 0x50], rax
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rsi, 0xffffffffffffffff
je 0x10000456d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
xor ecx, ecx
call fcn.10000c9ec
mov rdx, rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x10000456d
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x100004564
mov r9d, 0xffff
mov r8d, r14d
mov rdx, rax
lea rcx, [0x1000125b0]
call fcn.100007238
lea rdx, [rsp + 0x60]
lea rcx, [0x1000125b0]
call fcn.100006fa4
nop
mov rdx, rdi
lea rcx, [0x1000125b0]
call fcn.100008344
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x10000454f
lea rcx, [0x1000125b0]
call fcn.100007020
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x100004595
mov eax, ebx
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.10000e1c0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1000045cc
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x420
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov r13d, ecx
mov ebx, 0x80004005
mov dword [rsp + 0x30], ebx
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000148e0]
call fcn.100005f04
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rcx, [0x100014d50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, 0xffffffffffffffff
je 0x100004725
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
xor ecx, ecx
call fcn.10000c9ec
mov rdx, rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r12, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100004725
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x10000471c
mov r9d, 0xffff
mov r8d, r14d
mov rdx, rax
lea rcx, [0x1000125b0]
call fcn.100007238
lea rdx, [rsp + 0x50]
lea rcx, [0x1000125b0]
call fcn.100006fa4
nop
mov rcx, qword [0x1000125c8]
lea eax, [r13 + r13]
xor eax, dword [rcx + 0x40]
and eax, 2
xor dword [rcx + 0x40], eax
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100004707
lea rcx, [0x1000125b0]
call fcn.100007020
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100004745
mov eax, ebx
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.10000e1c0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret

Function at 0x10000477c
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, rdx
xor edx, edx
mov r13, r9
mov rsi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
lea r12d, [rax + 0x8000]
call fcn.10000c9ec
and qword [rsp + 0x28], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rbx
mov rdx, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
je 0x10000482b
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x100004822
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rdi
mov qword [rbp], rbx
mov dword [r13], r12d
mov eax, 1
jmp 0x10000482d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret