joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800500e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov eax, dword [rdx]
mov r9, rcx
lea rcx, [rsp]
mov dword [rcx], eax
mov eax, dword [rdx + 4]
xor ebx, ebx
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
xor r11d, r11d
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
xor r8d, r8d
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor edx, edx
mov dword [rcx + 0x1c], eax
xor r10d, r10d
cmp r10, 0x28
jg 0x18005019e
cmp rdx, 4
jge 0x180050187
cmp r8, 4
jge 0x180050187
movzx eax, byte [rsp + rdx*4]
lea rcx, [r8 + r10]
inc rdx
mov byte [r9 + rcx*4 + 0x14], al
movzx eax, byte [rsp + rdx*4 - 3]
lea rcx, [r8 + r10]
mov byte [r9 + rcx*4 + 0x15], al
movzx eax, byte [rsp + rdx*4 - 2]
inc r11d
mov byte [r9 + rcx*4 + 0x16], al
movzx eax, byte [rsp + rdx*4 - 1]
inc r8
cmp rdx, 4
mov byte [r9 + rcx*4 + 0x17], al
jl 0x180050143
cmp r8, 4
jne 0x180050198
inc ebx
add r10, r8
xor r11d, r11d
xor r8d, r8d
cmp rdx, 4
jl 0x180050137
movsxd r10, ebx
movsxd r8, r11d
cmp r10, 0xa
jg 0x1800502a5
mov qword [rsp + 0x50], rdi
lea rbx, [0x18011bed0]
lea rdi, [0x18011bff0]
movzx eax, byte [rsp + 0xd]
movzx ecx, byte [rsp]
lea rdx, [rsp + 1]
xor cl, byte [rax + rdi]
movzx eax, byte [rsp + 0xe]
mov r11d, 3
movzx eax, byte [rax + rdi]
xor cl, byte [rbx]
xor byte [rsp + 1], al
movzx eax, byte [rsp + 0xf]
mov byte [rsp], cl
movzx eax, byte [rax + rdi]
xor byte [rsp + 2], al
movzx eax, byte [rsp + 0xc]
movzx eax, byte [rax + rdi]
xor byte [rsp + 3], al
inc rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
add rdx, 4
xor byte [rdx - 1], al
movzx eax, byte [rdx - 4]
xor byte [rdx], al
movzx eax, byte [rdx - 3]
xor byte [rdx + 1], al
movzx eax, byte [rdx - 2]
xor byte [rdx + 2], al
sub r11, 1
jne 0x180050210
xor edx, edx
cmp r10, 0xa
jg 0x1800502a0
cmp rdx, 4
jge 0x180050284
cmp r8, 4
jge 0x180050284
movzx eax, byte [rsp + rdx*4]
lea rcx, [r8 + r10*4]
inc rdx
mov byte [r9 + rcx*4 + 0x14], al
movzx eax, byte [rsp + rdx*4 - 3]
lea rcx, [r8 + r10*4]
mov byte [r9 + rcx*4 + 0x15], al
movzx eax, byte [rsp + rdx*4 - 2]
inc r8
cmp rdx, 4
mov byte [r9 + rcx*4 + 0x16], al
movzx eax, byte [rsp + rdx*4 - 1]
mov byte [r9 + rcx*4 + 0x17], al
jl 0x180050243
cmp r8, 4
jne 0x180050290
inc r10
xor r8d, r8d
cmp rdx, 4
jl 0x180050237
cmp r10, 0xa
jle 0x1800501c1
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.180076a70
add rsp, 0x30
pop rbx
ret
Function at 0x1800502c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x10], rax
lea r9, [rcx + 0x24]
lea r10, [rcx + 0x28]
mov ebx, 9
lea rdi, [0x180000000]
nop dword [rax]
xor r11d, r11d
nop word [rax + rax]
movzx eax, byte [r10 - 1]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 - 2]
movzx r8d, byte [rdx + rdi + 0x118ed0]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 - 3]
xor r8b, byte [rcx + rdi + 0x1192d0]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 - 4]
xor r8b, byte [rcx + rdi + 0x1196d0]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 3]
xor r8b, byte [rcx + rdi + 0x119ad0]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 2]
mov byte [rsp + r11], r8b
movzx r8d, byte [rdx + rdi + 0x118ed0]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x1192d0]
movzx eax, byte [r10 + 1]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10]
xor r8b, byte [rcx + rdi + 0x1196d0]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 7]
xor r8b, byte [rcx + rdi + 0x119ad0]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 6]
mov byte [rsp + r11 + 4], r8b
movzx r8d, byte [rdx + rdi + 0x118ed0]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x1192d0]
movzx eax, byte [r10 + 5]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 4]
xor r8b, byte [rcx + rdi + 0x1196d0]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 0xb]
xor r8b, byte [rcx + rdi + 0x119ad0]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 0xa]
mov byte [rsp + r11 + 8], r8b
movzx r8d, byte [rdx + rdi + 0x118ed0]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x1192d0]
movzx eax, byte [r10 + 9]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 8]
xor r8b, byte [rcx + rdi + 0x1196d0]
lea rcx, [r11 + rax*4]
inc r11
xor r8b, byte [rcx + rdi + 0x119ad0]
cmp r11, 4
mov byte [rsp + r11 + 0xb], r8b
jl 0x180050300
lea rcx, [rsp]
add r9, 0x10
add r10, 0x10
sub rbx, 1
mov rax, qword [rcx]
mov qword [r9 - 0x10], rax
mov rax, qword [rcx + 8]
mov qword [r9 - 8], rax
jne 0x1800502f0
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.180076a70
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180050e50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x58]
mov rbx, rcx
mov dword [rcx + 0x3c], 2
mov ecx, dword [0x180113f64]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x180050e85
mov rdi, qword [rax + 8]
mov r8, qword gs:[0x20]
xor ecx, ecx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], ecx
mov rcx, rdi
mov qword [rax + 0x10], r8
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x180050ec3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x28]
cmp rcx, rdx
jbe 0x180050ee2
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x38]
add rax, rcx
cmp rax, rdx
jbe 0x180050ed0
movsxd rax, ecx
mov rcx, qword [rbx + 0x30]
sub rcx, rax
movsxd rax, edx
add rcx, rax
mov qword [rsi], rcx
mov eax, dword [rbx + 0x38]
mov rsi, qword [rsp + 0x38]
sub eax, edx
add eax, dword [rbx + 0x28]
mov ecx, eax
add rcx, rdx
mov qword [rbx + 0x18], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180050f30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x58]
mov rdi, rcx
mov qword [rcx + 0x40], rdx
mov dword [rcx + 0x3c], 3
mov dword [rcx + 0x48], r8d
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x180050f65
mov rbx, qword [rax + 8]
mov rdx, qword gs:[0x20]
xor ecx, ecx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], ecx
mov rcx, rbx
mov qword [rax + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x180050fa3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov eax, dword [rdi + 0x48]
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 0xfffffffb
add rsp, 0x20
pop rdi
ret
Function at 0x180051040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x20020]
jmp 0x180051040
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x18011c518]
xor r15d, r15d
mov r13, r9
mov r14, r8
mov r12d, r15d
call fcn.180054730
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x20], rbp
jbe 0x1800510c3
cmp dword [rbx + 0x3c], 1
je 0x1800510a5
mov rdx, qword [rbx + 0x50]
lea rcx, [0x18011c518]
xor r9d, r9d
xor r8d, r8d
call fcn.180054a20
mov rdx, qword [rbx + 0x50]
lea rcx, [0x18011c518]
xor r9d, r9d
xor r8d, r8d
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
call fcn.180054a20
mov eax, dword [rbx + 0x3c]
cmp eax, 2
jne 0x18005113f
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x38]
mov qword [rbx + 0x28], rdx
mov rax, qword [rcx]
lea r8, [rbx + 0x30]
call qword [rax]
mov r12d, eax
mov ecx, dword [0x180113f64]
mov rdi, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x180051100
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1800510c3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
jmp 0x1800510c3
cmp eax, 3
jne 0x18005115b
movsxd rdx, dword [rbx + 0x48]
add rdx, qword [rbx + 0x20]
cmp rdx, rbp
ja 0x18005115b
mov qword [rbx + 0x20], rdx
mov dword [rbx + 0x48], r15d
jmp 0x1800510e7
mov edi, r15d
mov rsi, r15
test r12d, r12d
jne 0x180051189
cmp eax, 1
jne 0x180051171
lea r12d, [rax + 0xa]
jmp 0x180051189
movsxd rax, dword [rbx + 0x20]
mov edi, dword [rbx + 0x48]
mov rsi, qword [rbx + 0x40]
sub edi, ebp
sub rsi, rax
add edi, eax
movsxd rax, ebp
add rsi, rax
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x1800511bb
mov ecx, dword [0x180113f64]
xor edx, edx
mov dword [rax], r15d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x18011c128]
test r11, r11
je 0x1800511bb
call r11
lea r11, [rsp + 0x50]
mov qword [rbx + 0x58], r15
mov qword [r14], rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r13], edi
mov eax, r12d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800523f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov rsi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
or ecx, 0xffffffff
call fcn.18004f9d0
mov word [rbx + 0x214], ax
shr eax, 0x10
mov word [rbx + 0x216], ax
xor eax, eax
mov word [rbx + 0x21a], ax
mov word [rbx + 0x218], ax
mov byte [rbx + 0x21e], al
mov byte [rbx + 0x21d], al
mov byte [rbx + 0x21c], al
movzx ecx, byte [rsi]
test cl, cl
je 0x1800524a9
lea rdi, [0x180118ad0]
add byte [rbx + 0x21c], cl
xor byte [rbx + 0x21d], cl
movzx eax, byte [rbx + 0x21e]
add al, cl
movzx edx, cl
movzx ecx, cl
rol al, 1
inc rsi
mov byte [rbx + 0x21e], al
movzx eax, cx
xor ax, word [rdi + rdx*4]
xor word [rbx + 0x218], ax
movzx eax, word [rdi + rdx*4 + 2]
add ax, cx
add word [rbx + 0x21a], ax
mov cl, byte [rsi]
test cl, cl
jne 0x180052460
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180054730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x18011c115], 0
mov rsi, rdx
jne 0x18005474b
call fcn.180054690
mov ecx, dword [0x180113f64]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180054773
inc dword [rax + 4]
mov rax, qword [rax + 8]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x12c
mov rax, qword [0x18011c130]
test rax, rax
je 0x1800547ae
mov edx, 1
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
jne 0x1800547d1
xor edx, edx
xor ecx, ecx
call qword [0x18011c130]
mov rbx, rax
jmp 0x1800547b9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rbx, rax
test rbx, rbx
jne 0x1800547d1
inc edi
cmp edi, ebp
cmova edi, ebp
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x180054782
mov ecx, dword [0x180113f64]
mov rdx, rsi
mov dword [rsi], 0x54626966
mov dword [rsi + 4], 1
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180054920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
lea rdx, [rsp + 0x48]
lea rcx, [0x18011c518]
mov rbx, r8
call fcn.180054730
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x180050fc0]
mov qword [rsp + 0x38], rax
mov rax, qword [0x18011c120]
test rax, rax
je 0x1800549a9
lea rcx, [rsp + 0x30]
mov edx, 0x4000
lea r9, [0x180054830]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov r8d, 1
call rax
mov rbx, rax
test rax, rax
jne 0x1800549c8
lea rax, [rsp + 0x30]
mov edx, 0x4000
lea r9, [0x180054830]
mov rcx, rdx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [0x18011c120]
jmp 0x1800549c0
lea r8, [rsp + 0x30]
lea rdx, [0x180054830]
mov ecx, 0x4000
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rbx, rax
test rax, rax
je 0x1800549dd
lea rcx, [0x18011c518]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.180054a20
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x180054a12
mov ecx, dword [0x180113f64]
xor edx, edx
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x18011c128]
test r11, r11
je 0x180054a12
call r11
mov rax, rbx
add rsp, 0x70
pop rbx
ret
Function at 0x180054a20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x180113f64]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x180054a45
mov rbx, qword [rax + 8]
mov rcx, qword gs:[0x20]
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], 0
mov qword [rax + 0x10], rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180113f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x180054a85
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180057fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
test r9, r9
jne 0x180057ff9
mov eax, 0x80070057
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180058011
add rsp, 0x20
pop rbx
jmp fcn.180003220
test al, 0x10
je 0x180058023
mov dword [rbx], 8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xe00e1001
add rsp, 0x20
pop rbx
ret

Function at 0x180058310
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x18005838d
cmp word [rdx], 0
je 0x18005838d
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180058348
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.180003220
test al, 0x10
je 0x18005838d
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
xor eax, eax
mov rdi, rbx
mov rdx, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x18]
call fcn.180002890
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.180058720
mov eax, 0xe00e1001
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x18005e4e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov edi, r9d
mov rsi, r8
mov rbx, rcx
test r8, r8
jne 0x18005e503
mov eax, 0x80070057
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x18005e52e
test rdx, rdx
je 0x18005e4f6
mov rax, qword [rsp + 0x70]
mov rdx, qword [rdx]
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.180013270
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 0x18]
cmp rcx, 0xffffffffffffffff
jne 0x18005e545
mov eax, 0x80004005
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rdx, rdx
je 0x18005e56a
mov rdx, qword [rdx]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18005e56a
call fcn.180003220
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], rbp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x58], r12
xor r12d, r12d
mov r8d, edi
mov rdx, rsi
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18005e66d
cmp dword [rsp + 0x78], r12d
jne 0x18005e654
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x18005e5d2
cmp eax, 0x3e6
je 0x18005e5d2
test eax, eax
jle 0x18005e67f
movzx eax, ax
or eax, 0x80070000
jmp 0x18005e67f
cmp dword [rbx + 0x458], edi
jae 0x18005e621
mov rcx, qword [rbx + 0x450]
test rcx, rcx
je 0x18005e5f9
call fcn.18007702c
mov qword [rbx + 0x450], r12
mov dword [rbx + 0x458], r12d
lea rdx, [0x1801171e8]
mov rcx, rdi
call fcn.180077024
mov qword [rbx + 0x450], rax
test rax, rax
jne 0x18005e61b
mov eax, 0x8007000e
jmp 0x18005e67f
mov dword [rbx + 0x458], edi
mov rcx, qword [rbx + 0x450]
mov r8, rdi
xor edx, edx
call fcn.1800795c0
mov rdx, qword [rbx + 0x450]
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18005e65b
call fcn.180003220
jmp 0x18005e67f
mov rdx, qword [rbx + 0x450]
mov r8, rdi
mov rcx, rsi
call fcn.1800785c0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18005e67d
mov eax, dword [rsp + 0x60]
mov dword [rcx], eax
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x18005f760
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x18005f907
mov r12d, dword [rdx + 8]
test r12d, r12d
je 0x18005f793
test r8, r8
je 0x18005f907
test r12d, r12d
jne 0x18005f7a6
xor eax, eax
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rcx + 0x18], 0xffffffffffffffff
jne 0x18005f7c5
cmp qword [rcx + 0x20], 0
jne 0x18005f7c5
mov eax, 0x80004005
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rcx + 0x28], 0x990
je 0x18005f7df
mov eax, 0x80004001
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
imul r12d, r12d, 0x990
mov qword [rsp + 0x80], r13
mov edx, r12d
call fcn.180063790
mov r13, rax
test rax, rax
jne 0x18005f805
mov eax, 0x8007000e
jmp 0x18005f86c
mov ecx, dword [rdi + 0x28]
mov rax, qword [rbp]
mov qword [rsp + 0x70], rbx
cqo
xor ebx, ebx
and edx, 0x7ff
add rax, rdx
sar rax, 0xb
imul rax, rcx
mov ecx, dword [rdi + 0x34]
add rax, rcx
test r12d, r12d
je 0x18005f8ca
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x18005f858
lea rdx, [rsp + 0x30]
mov r9d, r12d
mov r8, r13
mov qword [rsp + 0x20], rdx
mov rdx, rax
call fcn.180013270
jmp 0x18005f8c1
mov rcx, qword [rdi + 0x18]
cmp rcx, 0xffffffffffffffff
jne 0x18005f880
mov eax, 0x80004005
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x80]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18005f89a
call fcn.180003220
jmp 0x18005f8c1
mov rcx, qword [rdi + 0x18]
lea r9, [rsp + 0x78]
mov r8d, r12d
mov rdx, r13
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18005f8ca
call fcn.180003220
test eax, eax
js 0x18005f867
cmp eax, 1
je 0x18005f867
cmp dword [rbp + 8], ebx
jbe 0x18005f8f5
nop
mov edx, dword [rdi + 0x28]
mov rcx, rsi
mov r8d, 0x930
imul edx, ebx
add rdx, r13
call fcn.1800785c0
inc ebx
add rsi, 0x930
cmp ebx, dword [rbp + 8]
jb 0x18005f8d0
test r14, r14
je 0x18005f900
mov eax, dword [rbp + 8]
mov dword [r14], eax
xor eax, eax
jmp 0x18005f867
mov eax, 0x80070057
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800603d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x160
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, r9
mov rbx, r8
mov r13, rdx
test rdx, rdx
je 0x1800605c5
test rbx, rbx
je 0x1800605c5
test r9, r9
je 0x1800605c5
mov rcx, rbx
mov qword [rsp + 0x150], rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [rsp + 0x1a0]
add rsi, rdi
cmp dword [rsp + 0x1a8], 0
je 0x180060512
mov ecx, dword [rsi]
lea rdx, [0x1800f4638]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18006052c
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x158], rbp
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbp, rax
test rax, rax
je 0x1800605b4
add rbp, 2
cmp dword [rsp + 0x1a8], 0
je 0x180060549
mov edx, dword [rsi]
mov rcx, rbp
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800605be
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea rdx, [0x1800f4628]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800605be
mov eax, 0xe0032009
mov rbp, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180076a70
add rsp, 0x160
pop r13
pop rdi
pop rbx
ret
mov ecx, dword [rsi]
lea rdx, str..mdf
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180060455
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea rdx, [0x1800f4628]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
jmp 0x1800604ee
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1800795c0
mov edx, dword [rsi]
lea rcx, [rsp + 0x30]
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
mov r11, rbx
lea r8, [rsp + 0x30]
repne scasb al, byte [rdi]
sub r11, rbp
xor edx, edx
not rcx
add r11, 0x208
sar r11, 1
mov r9d, ecx
xor ecx, ecx
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180060498
mov eax, 0x80004005
jmp 0x1800604e6
xor eax, eax
jmp 0x1800604e6
mov eax, 0x80070057
jmp 0x1800604f6
Function at 0x180063470
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rbx, qword [rcx + 0x3f0]
xor r14d, r14d
mov rdi, rcx
mov r12, r14
mov r13d, r14d
cmp rbx, qword [rcx + 0x3f8]
jbe 0x1800634af
call fcn.180076fcc
mov rbp, qword [rdi + 0x3d8]
nop word [rax + rax]
mov rsi, qword [rdi + 0x3f8]
cmp qword [rdi + 0x3f0], rsi
jbe 0x1800634d5
call fcn.180076fcc
test rbp, rbp
je 0x1800634e3
cmp rbp, qword [rdi + 0x3d8]
je 0x1800634e8
call fcn.180076fcc
mov rcx, rdi
cmp rbx, rsi
je 0x1800635e2
mov r8, r12
mov edx, r13d
call fcn.180061050
xor r11d, r11d
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
test rbp, rbp
jne 0x18006351b
call fcn.180076fcc
mov r11, r14
jmp 0x18006351f
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x20]
jb 0x18006352a
call fcn.180076fcc
cmp qword [rbx + 0x20], 8
lea rcx, [rbx + 8]
jb 0x180063538
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x1800635db
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800635c5
mov rax, qword [rsp + 0x40]
lea rcx, [rdi + 0x3a8]
lea rdx, [rsp + 0x40]
sub rax, 0x2c
inc r13d
mov qword [rsp + 0x40], rax
add r12, rax
call fcn.180063f30
test rbp, rbp
jne 0x1800635ad
call fcn.180076fcc
mov r11, r14
jmp 0x1800635b1
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x20]
jb 0x1800635bc
call fcn.180076fcc
add rbx, 0x28
jmp 0x1800634c0
call fcn.180003220
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1800635f3
call fcn.180003220
jmp 0x1800635f3
mov rdx, r12
call fcn.180060f90
mov qword [rdi + 0x370], r12
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret