joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020e50
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x90
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbp, r9
movzx r12d, r8w
movzx ebx, dx
mov rsi, rcx
xor eax, eax
mov qword [rsp + 0x5a], rax
mov qword [rsp + 0x62], rax
mov word [rsp + 0x6a], ax
mov word [rsp + 0x58], dx
lea rdx, [0x1800e2068]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x180020ec8
mov eax, 0xe003200c
jmp 0x180020fd6
xor edi, edi
mov word [rsp + 0x70], di
xor eax, eax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov word [rsp + 0x82], ax
movzx r8d, bx
lea rdx, str.._c:
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x180020f3a
call fcn.180003180
nop
jmp 0x180020fd6
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rsi
call fcn.180020b90
mov edi, eax
test eax, eax
js 0x180020fcb
cmp eax, 1
je 0x180020fcb
mov rax, qword [rbp]
mov rdx, qword [rsp + 0x40]
mov rcx, rbp
call qword [rax + 0x70]
mov edi, eax
test eax, eax
js 0x180020fbe
cmp eax, 1
je 0x180020fbe
test r12w, r12w
je 0x180020fa1
movzx r8d, r12w
mov rdx, rbx
mov rcx, rsi
call fcn.180020d10
mov edi, eax
test eax, eax
js 0x180020f94
cmp eax, 1
jne 0x180020fa1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180020fd6
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.180021000
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180020fd6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180020fd6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180028790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rcx, [0x18010caa0]
xor edx, edx
mov r8d, 0x800
call fcn.18006cf60
mov edi, reloc.WS2_32.dll_recv
xor ebp, ebp
nop word [rax + rax]
mov rbx, qword [rsi + 0x20]
inc dword [rbx + 0x20]
mov edx, dword [rbx + 0x20]
cmp dword [rbx + 0x10], ebp
jne 0x18002885e
mov eax, dword [rbx + 0x28]
test eax, eax
js 0x18002885e
cmp eax, 1
je 0x18002885e
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18002881d
mov eax, dword [rbx + 0x24]
cmp edx, eax
cmovb eax, edx
lea rdx, [rsp + 0x48]
shl rax, 0xb
mov qword [rsp + 0x48], rax
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
je 0x18002881d
mov dword [rbx + 0x28], 0x80004004
jmp 0x18002885e
mov rcx, rbx
call fcn.18002b280
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
lea rdx, [0x18010caa0]
mov r8d, 0x800
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180028856
call fcn.180003180
mov dword [rbx + 0x28], eax
mov rcx, rbx
call fcn.18002b300
sub rdi, 1
jne 0x1800287d0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18002b1d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
test eax, eax
js 0x18002b221
cmp eax, 1
je 0x18002b221
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x18002b22e
mov eax, dword [rbx + 0x20]
mov edx, dword [rbx + 0x24]
cmp eax, edx
cmovb edx, eax
mov eax, edx
lea rdx, [rsp + 0x40]
shl rax, 0xb
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
je 0x18002b22e
mov dword [rbx + 0x28], 0x80004004
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.18002b280
mov rcx, qword [rbx + 8]
xor eax, eax
lea r9, [rsp + 0x40]
mov r8d, 0x800
mov rdx, rdi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002b265
call fcn.180003180
mov dword [rbx + 0x28], eax
mov rcx, rbx
call fcn.18002b300
mov rbx, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x18002b280
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x100
call fcn.18006cf60
mov rax, qword [rbx]
xor ecx, ecx
mov r8d, dword [rax + 0xc]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002b2e2
call fcn.180003180
mov dword [rbx + 0x28], eax
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x150
pop rbx
ret

Function at 0x18002b300
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xa50
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0xa40], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0xa00
call fcn.18006cf60
mov rax, qword [rbx]
xor ecx, ecx
mov r8d, dword [rax + 0x10]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002b362
call fcn.180003180
mov dword [rbx + 0x28], eax
mov eax, 1
mov rcx, qword [rsp + 0xa40]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0xa50
pop rbx
ret
Function at 0x18002e790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
test r9, r9
jne 0x18002e7a9
mov eax, 0x80070057
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18002e7c1
add rsp, 0x20
pop rbx
jmp fcn.180003180
test al, 0x10
je 0x18002e7d3
mov dword [rbx], 8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xe00e1001
add rsp, 0x20
pop rbx
ret

Function at 0x18002eac0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x18002eb3d
cmp word [rdx], 0
je 0x18002eb3d
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18002eaf8
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.180003180
test al, 0x10
je 0x18002eb3d
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
xor eax, eax
mov rdi, rbx
mov rdx, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x18]
call fcn.1800027f0
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.18002ef40
mov eax, 0xe00e1001
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1800368a0
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, qword [rsp + 0xd0]
xor r14d, r14d
mov rdi, r8
mov dword [r8], r14d
mov rbp, r9
mov rsi, rdx
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r14d
mov r13, rcx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18003690f
call fcn.180003180
jmp 0x180036a9a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsi], eax
cmp eax, 0xffffffff
jne 0x180036938
call fcn.180003180
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180036a9a
xor eax, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9, rbp
mov rcx, rbx
mov byte [rsp + 0x40], r14b
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
call fcn.180036c00
mov esi, eax
test eax, eax
js 0x180036a8f
cmp eax, 1
je 0x180036a8f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
mov r8, r12
mov edx, reloc.WS2_32.dll_recv
call fcn.1800367b0
mov dword [rdi], eax
test eax, eax
jne 0x1800369e9
lea rax, [rsp + 0x40]
lea r8, [0x180000000]
mov dx, word [rax]
cmp dx, word [r8 + 0xe403c]
jne 0x1800369da
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0xe403e]
jne 0x1800369da
mov eax, r14d
jmp 0x1800369df
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1800369f0
mov dword [rdi], 5
xor eax, eax
jmp 0x180036a9a
lea rax, [rsp + 0x40]
mov edx, dword [rax]
cmp edx, dword [r8 + 0xe31d4]
jne 0x180036a13
mov dx, word [rax + 4]
cmp dx, word [r8 + 0xe31d8]
jne 0x180036a13
mov eax, r14d
jmp 0x180036a18
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x180036a24
mov dword [rdi], 4
jmp 0x180036a9a
lea rax, [rsp + 0x40]
mov rdx, qword [rax]
cmp rdx, qword [r8 + 0xe31e0]
jne 0x180036a47
mov rdx, qword [rax + 8]
cmp rdx, qword [r8 + 0xe31e8]
jne 0x180036a47
mov eax, r14d
jmp 0x180036a4c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x180036a58
mov dword [rdi], 6
jmp 0x180036a9a
mov eax, dword [rsp + 0x50]
cmp eax, dword [0x1800e31d0]
jne 0x180036a6e
mov dword [rdi], 2
xor eax, eax
jmp 0x180036a9a
cmp dword [rsp + 0xd8], r14d
je 0x180036a88
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.180036ac0
jmp 0x180036a9a
mov dword [rdi], r14d
xor eax, eax
jmp 0x180036a9a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180036ac0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor r12d, r12d
mov rbp, r8
mov rsi, rdx
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180036b17
call fcn.180003180
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
lea rdx, [0x180106f48]
mov ecx, 0x80000
mov qword [rsp + 0x60], rbx
call fcn.18006aaa4
mov rbx, rax
test rax, rax
jne 0x180036b48
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x180036be0
xor edx, edx
mov r8d, 0x80000
mov rcx, rax
call fcn.18006cf60
lea r9, [rsp + 0x78]
mov r8d, 0x80000
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180036b99
call fcn.180003180
mov rcx, rbx
mov esi, eax
call fcn.18006aaac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x180036be0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
mov rdi, rbx
test eax, eax
je 0x180036bd3
nop dword [rax]
mov r8, rbp
mov edx, eax
mov rcx, rdi
call fcn.1800367b0
mov dword [rsi], eax
test eax, eax
jne 0x180036bd6
mov eax, dword [rsp + 0x78]
inc rdi
add eax, 0xffffffff
mov dword [rsp + 0x78], eax
jne 0x180036bb0
mov dword [rsi], r12d
mov rcx, rbx
call fcn.18006aaac
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180041390
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov r12, rcx
mov rcx, qword [rcx + 0x18]
mov rsi, r8
mov rdi, r9
mov rbp, rdx
lea r8, [rsp + 0x40]
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1800413dc
call fcn.180003180
jmp 0x180041413
mov rcx, qword [r12 + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800413d5
mov rax, qword [rsp + 0x40]
mov qword [rbp], 0
mov qword [rsi], rax
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180041460
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x28]
mov eax, r8d
mov rbx, r9
xor r9d, r9d
mov r8d, 0x400000
mov dword [rsp + 0x50], r9d
cmp eax, r8d
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x50]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800414a4
call fcn.180003180
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x1800414af
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180041510
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
jne 0x180041529
mov eax, 0x80070057
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180041550
call fcn.180003180
add rsp, 0x20
pop rbx
ret
mov rax, qword [rsp + 0x38]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180041560
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov rdi, rdx
lea r8, [rsp + 0x30]
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1800415a4
call fcn.180003180
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180041594
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x180041594
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180041594
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800415f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x20]
mov eax, r8d
mov rbx, r9
xor r9d, r9d
mov r8d, 0x400000
mov dword [rsp + 0x50], r9d
cmp eax, r8d
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x50]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180041634
call fcn.180003180
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x18004163f
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180043700
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov ebp, 0x4e20
jne 0x18004373d
cmp r8d, ebp
mov ecx, 0xfffffff6
cmovg edi, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800437a7
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18004378d
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x180043779
cmp eax, 3
jne 0x18004378d
cmp edi, ebp
jle 0x18004378d
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call fcn.180043700
jmp 0x1800437ab
cmp dword [rbx + 0x14], 1
jne 0x1800437a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1800437a2
xor eax, eax
jmp 0x1800437ab
or eax, 0xffffffff
jmp 0x1800437ab
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180046160
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x18]
mov eax, 0x400000
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne dl
test rbx, rbx
je 0x1800461a5
mov ecx, dword [rsp + 0x50]
mov dword [rbx], ecx
test dl, dl
je 0x1800461b1
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800461c6
mov eax, 0x80004005
add rsp, 0x30
pop rbx
ret
jle 0x1800461d0
movzx eax, ax
or eax, 0x80070000
add rsp, 0x30
pop rbx
ret

Function at 0x180046270
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1800462cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1800462cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800462b7
mov eax, 0x80004005
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jle 0x1800462dc
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rbx
xor eax, eax
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180046d00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
lea rax, [rcx + 0x18]
xor r12d, r12d
mov rdi, rcx
mov qword [r8], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov rbp, r9
mov rsi, r8
lea rbx, [rdx + rax]
lea r9d, [r12 + 1]
lea r8, [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x50]
cmp rax, rbx
je 0x180046d74
mov rcx, qword [rdi + 8]
sub rbx, rax
lea r9d, [r12 + 1]
lea r8, [rsp + 0x5c]
mov edx, ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [rsi]
mov rcx, qword [rdi + 8]
mov r9, rbp
mov r8d, 0x20000
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
test eax, eax
mov ecx, 0x1e
cmovne ecx, r12d
mov eax, ecx
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x180046db0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rbp, r8
mov rsi, r9
lea rbx, [rdx + rax]
lea r8, [rsp + 0x54]
xor edx, edx
mov r9d, 1
mov qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x50]
cmp rax, rbx
je 0x180046e1a
mov rcx, qword [rdi + 8]
sub rbx, rax
lea r8, [rsp + 0x5c]
mov edx, ebx
mov r9d, 1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsi]
mov eax, 0x20000
lea rdx, [rdi + 0x18]
mov qword [rbp], rdx
mov rcx, qword [rdi + 8]
cmp r8d, eax
cmova r8d, eax
mov r9, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180046e60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x20020]
jmp 0x180051980
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x18010c1e8]
xor r15d, r15d
mov r13, r9
mov r14, r8
mov r12d, r15d
call fcn.1800550c0
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x20], rbp
jbe 0x180051a43
cmp dword [rbx + 0x3c], 1
je 0x1800519e5
mov rdx, qword [rbx + 0x50]
lea rcx, [0x18010c1e8]
xor r9d, r9d
xor r8d, r8d
call fcn.180055410
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov ecx, dword [0x180103f64]
mov rdi, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x180051a06
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x180051a43
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov eax, dword [rbx + 0x3c]
cmp eax, 2
jne 0x180051a69
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x38]
mov qword [rbx + 0x28], rdx
mov rax, qword [rcx]
lea r8, [rbx + 0x30]
call qword [rax]
mov r12d, eax
jmp 0x1800519ed
cmp eax, 3
jne 0x180051a88
movsxd rdx, dword [rbx + 0x48]
add rdx, qword [rbx + 0x20]
cmp rdx, rbp
ja 0x180051a88
mov qword [rbx + 0x20], rdx
mov dword [rbx + 0x48], r15d
jmp 0x1800519ed
mov edi, r15d
mov rsi, r15
test r12d, r12d
jne 0x180051ab6
cmp eax, 1
jne 0x180051a9e
lea r12d, [rax + 0xa]
jmp 0x180051ab6
movsxd rax, dword [rbx + 0x20]
mov edi, dword [rbx + 0x48]
mov rsi, qword [rbx + 0x40]
sub edi, ebp
sub rsi, rax
add edi, eax
movsxd rax, ebp
add rsi, rax
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x180051ae8
mov ecx, dword [0x180103f64]
xor edx, edx
mov dword [rax], r15d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x18010bde0]
test r11, r11
je 0x180051ae8
call r11
lea r11, [rsp + 0x50]
mov qword [rbx + 0x58], r15
mov qword [r14], rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r13], edi
mov eax, r12d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1800504a0
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
lea r8, [0x180108790]
nop dword [rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x1800504c4
shr eax, 1
xor eax, 0xedb88320
jmp 0x1800504c6
shr eax, 1
sub rcx, 1
jne 0x1800504b7
inc edx
mov dword [r8], eax
add r8, 4
cmp edx, 0x100
jl 0x1800504b0
repz ret
Function at 0x1800504e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
xor r11d, r11d
mov qword [rsp + 0x10], rbx
mov r10, rdx
mov r9d, ecx
lea rdi, [0x180108790]
cmp dword [0x180108794], r11d
jne 0x18005053c
mov edx, r11d
mov rbx, rdi
nop word [rax + rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x180050524
shr eax, 1
xor eax, 0xedb88320
jmp 0x180050526
shr eax, 1
sub rcx, 1
jne 0x180050517
inc edx
mov dword [rbx], eax
add rbx, 4
cmp edx, 0x100
jl 0x180050510
test r8, r8
je 0x180050568
test r10b, 7
je 0x180050568
movzx ecx, byte [r10]
movzx eax, r9b
inc r10
xor rcx, rax
mov eax, r9d
mov r9d, dword [rdi + rcx*4]
shr eax, 8
xor r9d, eax
sub r8, 1
jne 0x180050541
cmp r8, 8
jb 0x1800505fe
mov rbx, r8
shr rbx, 3
mov rax, rbx
imul rax, rax, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
xor r9d, dword [r10]
add r10, 8
movzx eax, r9b
shr r9d, 8
mov ecx, dword [rdi + rax*4]
xor ecx, r9d
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, dword [r10 - 4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov r9d, dword [rdi + rax*4]
xor r9d, ecx
sub rbx, 1
jne 0x180050590
mov rbx, qword [rsp + 0x10]
test r8, r8
je 0x180050631
nop dword [rax + rax]
movzx ecx, byte [r11 + r10]
movzx eax, r9b
inc r11
xor rcx, rax
mov eax, r9d
mov r9d, dword [rdi + rcx*4]
shr eax, 8
xor r9d, eax
cmp r11, r8
jb 0x180050610
mov eax, r9d
pop rdi
ret