joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023790
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x13a0]
mov eax, 0x14a0
call fcn.1801e7850
sub rsp, rax
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rbp + 0x1390], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x30]
call fcn.180024bd0
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800258e0
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x30]
call fcn.180028bc0
lea rcx, [rsp + 0x30]
call fcn.180027520
cmp eax, 0x104
jle 0x180023929
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xa0]
call fcn.180024bd0
nop
lea rcx, [rbp + 0xa0]
call fcn.180029d90
lea rcx, [rsp + 0x30]
call fcn.180028210
mov rcx, rax
lea r9, [rsp + 0x20]
lea r8, [rbp + 0x380]
mov edx, 0x800
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rcx, [rbp + 0xa0]
test eax, eax
je 0x18002387e
lea rdx, [rbp + 0x380]
call fcn.180029590
mov bl, 1
jmp 0x18002388a
lea rdx, [rsp + 0x30]
call fcn.1800262e0
xor bl, bl
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x210]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x210]
call fcn.180024bd0
nop
test bl, bl
je 0x1800238c2
lea rdx, [0x1801f22a8]
lea rcx, [rbp + 0x210]
call fcn.180025770
lea rcx, [rbp + 0xa0]
call fcn.180027e00
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.180025770
lea rcx, [rbp + 0x210]
call fcn.180028210
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
jne 0x180023909
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
cmp eax, 2
cmove ebx, ecx
test ebx, ebx
setne bl
lea rcx, [rbp + 0x210]
call fcn.180024c30
nop
lea rcx, [rbp + 0xa0]
call fcn.180024c30
jmp 0x18002397d
lea rcx, [rsp + 0x30]
call fcn.180028210
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
jne 0x180023978
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x18002396d
mov edx, eax
mov rcx, rdi
call fcn.18002b690
lea r8, [rsp + 0x30]
lea rdx, str.failedToDeleteFilepath
mov rcx, rdi
call fcn.18002ae00
mov ecx, 1
cmp esi, 2
cmove ebx, ecx
test ebx, ebx
setne bl
lea rcx, [rsp + 0x30]
call fcn.180024c30
movzx eax, bl
mov rcx, qword [rbp + 0x1390]
xor rcx, rsp
call fcn.180009610
mov rbx, qword [rsp + 0x14d0]
add rsp, 0x14a0
pop rdi
pop rsi
pop rbp
ret

Function at 0x180023d80
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1850
call fcn.1801e7850
sub rsp, rax
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x1840], rax
mov rbx, rcx
lea rdx, [rsp + 0x830]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x180023dda
lea rdx, [rsp + 0x20]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180029010
jmp 0x180023dea
lea rdx, [rsp + 0x830]
mov rcx, rbx
call fcn.180029590
mov rcx, qword [rsp + 0x1840]
xor rcx, rsp
call fcn.180009610
add rsp, 0x1850
pop rbx
ret
Function at 0x180023e20
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x90]
call fcn.180024bd0
nop
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.180024bd0
nop
mov rdx, rbx
lea rcx, [rbp + 0x90]
call fcn.1800258e0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1800258e0
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rbp + 0x90]
call fcn.180028bc0
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x20]
call fcn.180028bc0
lea rcx, [rbp + 0x90]
call fcn.180028460
test al, al
je 0x180023f18
lea rcx, [rsp + 0x20]
call fcn.180028460
test al, al
je 0x180023f18
lea rcx, [rsp + 0x20]
call fcn.180028210
mov rbx, rax
lea rcx, [rbp + 0x90]
call fcn.180028210
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x180023fc9
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x370]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x370]
call fcn.180024bd0
nop
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x200]
call fcn.180024bd0
nop
xor r8d, r8d
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x90]
call fcn.180022b00
xor r8d, r8d
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x20]
call fcn.180022b00
lea rcx, [rbp + 0x200]
call fcn.180028210
mov rbx, rax
lea rcx, [rbp + 0x370]
call fcn.180028210
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
lea rcx, [rbp + 0x200]
call fcn.180024c30
nop
lea rcx, [rbp + 0x370]
call fcn.180024c30
test bl, bl
jne 0x180023fdb
test rsi, rsi
je 0x180023fdb
mov rcx, rsi
call fcn.18002b1a0
nop
lea rcx, [rsp + 0x20]
call fcn.180024c30
nop
lea rcx, [rbp + 0x90]
call fcn.180024c30
movzx eax, bl
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.180009610
mov rbx, qword [rsp + 0x628]
add rsp, 0x5f0
pop rdi
pop rsi
pop rbp
ret
jmp 0x180023e20
Function at 0x180024020
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x90]
call fcn.180024bd0
nop
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.180024bd0
nop
mov rdx, rbx
lea rcx, [rbp + 0x90]
call fcn.1800258e0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1800258e0
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rbp + 0x90]
call fcn.180028bc0
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x20]
call fcn.180028bc0
lea rcx, [rbp + 0x90]
call fcn.180028460
test al, al
je 0x180023f18
lea rcx, [rsp + 0x20]
call fcn.180028460
test al, al
je 0x180023f18
lea rcx, [rsp + 0x20]
call fcn.180028210
mov rbx, rax
lea rcx, [rbp + 0x90]
call fcn.180028210
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x180023fc9
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x370]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x370]
call fcn.180024bd0
nop
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x200]
call fcn.180024bd0
nop
xor r8d, r8d
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x90]
call fcn.180022b00
xor r8d, r8d
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x20]
call fcn.180022b00
lea rcx, [rbp + 0x200]
call fcn.180028210
mov rbx, rax
lea rcx, [rbp + 0x370]
call fcn.180028210
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
lea rcx, [rbp + 0x200]
call fcn.180024c30
nop
lea rcx, [rbp + 0x370]
call fcn.180024c30
test bl, bl
jne 0x180023fdb
test rsi, rsi
je 0x180023fdb
mov rcx, rsi
call fcn.18002b1a0
nop
lea rcx, [rsp + 0x20]
call fcn.180024c30
nop
lea rcx, [rbp + 0x90]
call fcn.180024c30
movzx eax, bl
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.180009610
mov rbx, qword [rsp + 0x628]
add rsp, 0x5f0
pop rdi
pop rsi
pop rbp
ret
jmp 0x180023e20
Function at 0x1800247a0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.180024bd0
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180029370
lea rcx, [rsp + 0x20]
call fcn.180028210
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.180024c30
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.180009610
add rsp, 0x1a0
pop rbx
ret

Function at 0x180024830
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov edi, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.180024bd0
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180029370
lea rcx, [rsp + 0x20]
call fcn.180028210
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
lea rcx, [rsp + 0x20]
call fcn.180024c30
movzx eax, bl
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.180009610
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret
Function at 0x180042590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x20], 0
mov rbx, rcx
jne 0x18004267f
mov qword [rsp + 0x88], rdi
lea rdx, [rsp + 0x20]
xor edi, edi
mov word [rsp + 0x28], 0x101
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x2a], dil
call fcn.180042420
mov rax, qword [rsp + 0x20]
test rax, rax
js 0x180042677
cmp byte [0x1802e2108], dil
mov qword [rsp + 0x30], rax
jne 0x180042600
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
mov byte [0x1802e2108], 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
mov eax, dword [rsp + 0x4c]
test eax, eax
jns 0x180042623
xor ecx, ecx
call fcn.18000d700
mov eax, dword [rsp + 0x4c]
mov ecx, 0x76c
mov word [rbx + 0x1e], di
add ax, cx
mov dword [rbx + 0x24], 0xffffffff
mov word [rbx + 0x10], ax
movzx eax, word [rsp + 0x48]
inc ax
mov byte [rbx + 0x20], 1
mov word [rbx + 0x12], ax
movzx eax, word [rsp + 0x50]
mov word [rbx + 0x14], ax
movzx eax, word [rsp + 0x44]
mov word [rbx + 0x16], ax
movzx eax, word [rsp + 0x40]
mov word [rbx + 0x18], ax
movzx eax, word [rsp + 0x3c]
mov word [rbx + 0x1a], ax
movzx eax, word [rsp + 0x38]
mov word [rbx + 0x1c], ax
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180009610
add rsp, 0x70
pop rbx
ret

Function at 0x180048120
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov r9d, edx
mov r10, rcx
test edx, edx
je 0x180048176
nop dword [rax]
movzx r8d, byte [r10]
shl r8d, 8
xor eax, r8d
mov r8d, 8
nop dword [rax]
nop word [rax + rax]
mov edx, eax
mov ecx, eax
xor edx, 0x8380
and ecx, 0x8000
cmove edx, eax
mov eax, edx
add eax, eax
sub r8d, 1
jne 0x180048150
inc r10
sub r9d, 1
jne 0x180048130
shr eax, 8
ret
Function at 0x18004e140
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rdx
mov rax, qword [rcx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x18004e213
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x18004e20f
test rdi, rdi
je 0x18004e20f
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x20]
call fcn.18000aea0
nop
lea rcx, [rsp + 0x20]
call fcn.18000c540
mov rbx, qword [rdi]
lea rcx, [rsp + 0x20]
call fcn.180010a70
mov rdx, rax
mov rcx, rdi
call qword [rbx + 0x28]
mov rax, qword [rdi]
lea rdx, str.Failed_to_get_file_size__32_
mov rcx, rdi
call qword [rax + 0x28]
nop
lea rcx, [rsp + 0x20]
call fcn.18000aef0
mov eax, esi
jmp 0x18004e231
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18004e22c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__filelength]
jmp 0x18004e231
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180009610
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18004e260
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x18004e37f
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18004e372
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18004e372
test rdi, rdi
je 0x18004e34a
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x30]
call fcn.18000aea0
nop
lea rcx, [rsp + 0x30]
call fcn.18000c540
mov rbx, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.180010a70
mov rdx, rax
mov rcx, rdi
call qword [rbx + 0x28]
mov rax, qword [rdi]
lea rdx, str.Failed_to_get_file_size__64_
mov rcx, rdi
call qword [rax + 0x28]
nop
lea rcx, [rsp + 0x30]
call fcn.18000aef0
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180009610
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
mov edx, dword [rsp + 0x20]
mov ecx, ebx
call fcn.18004bf70
jmp 0x18004e351
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18004e34a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__filelengthi64]
jmp 0x18004e351
Function at 0x18004e510
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, qword [rsp + 0xd0]
mov rax, rdx
mov r14, qword [rsp + 0xd8]
xor r15d, r15d
mov qword [rsp + 0x30], rcx
mov rdi, r9
mov ebx, r8d
mov rdx, rcx
mov byte [rsi], 0
mov dword [r9], r15d
test rax, rax
jne 0x18004e57f
test r14, r14
je 0x18004e6a2
mov rax, qword [r14]
lea rdx, str.NULL_buf_pointer.
mov rcx, r14
call qword [rax + 0x28]
xor al, al
jmp 0x18004e6a8
test ebx, ebx
je 0x18004e6a6
mov ecx, 0x10000
mov byte [rsi], r15b
cmp ebx, ecx
mov dword [rsp + 0x48], r15d
mov ebp, ebx
mov r13, rax
cmova ebp, ecx
mov r12, rax
test rax, rax
je 0x18004e685
mov rcx, qword [rdx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x18004e5ff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r15
mov r8d, ebp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18004e5f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x18004e63f
test r14, r14
je 0x18004e5e8
mov edx, eax
mov rcx, r14
call fcn.18002b690
mov eax, dword [rsp + 0x48]
add dword [rdi], eax
xor al, al
jmp 0x18004e6a8
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x18004e646
jmp 0x18004e643
mov r9, qword [rdx + 8]
test r9, r9
je 0x18004e677
mov r8d, ebp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [rsp + 0x48], eax
cmp eax, ebp
jne 0x18004e62c
add dword [rdi], eax
sub ebx, eax
mov eax, eax
add rax, r13
jmp 0x18004e64d
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
jne 0x18004e660
mov eax, dword [rsp + 0x48]
mov byte [rsi], 1
add dword [rdi], eax
sub ebx, eax
add rax, r12
cmp byte [rsi], r15b
jne 0x18004e6a6
test ebx, ebx
je 0x18004e6a6
mov rdx, qword [rsp + 0x30]
jmp 0x18004e587
test r14, r14
je 0x18004e5e8
mov rcx, r14
call fcn.18002b1a0
mov eax, dword [rsp + 0x48]
add dword [rdi], eax
xor al, al
jmp 0x18004e6a8
test r14, r14
je 0x18004e69f
lea rdx, str.No_file_is_open.
jmp 0x18004e691
test r14, r14
je 0x18004e69f
lea rdx, str.NULL_buf_or_bufSize
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x28]
mov r15d, dword [rsp + 0x48]
add dword [rdi], r15d
xor al, al
jmp 0x18004e6a8
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180009610
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18004ea50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov r14, r9
mov rsi, qword [rsp + 0xb0]
mov rdi, r8
mov rbp, rdx
mov r15, rcx
jne 0x18004eab2
cmp qword [rcx + 8], 0
jne 0x18004eab2
test rsi, rsi
je 0x18004ebb1
mov rax, qword [rsi]
lea rdx, str.Failed_to_write_because_file_is_not_open.
mov rcx, rsi
call qword [rax + 0x28]
xor al, al
jmp 0x18004eb7e
xor r13d, r13d
test r14, r14
je 0x18004eabd
mov qword [r9], r13
test r8, r8
je 0x18004eb7c
mov edx, dword [rsp + 0x30]
mov r12d, 0x989680
mov rcx, qword [r15 + 0x10]
cmp rdi, r12
mov ebx, edi
cmovg ebx, r12d
cmp rcx, 0xffffffffffffffff
je 0x18004eb3b
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, ebx
mov qword [rsp + 0x20], r13
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18004eb0a
mov edx, dword [rsp + 0x30]
cmp edx, ebx
je 0x18004eb61
test rsi, rsi
je 0x18004ebb1
mov rax, qword [rsi]
lea rdx, str.WriteFileError
mov r8b, 1
mov rcx, rsi
call qword [rax + 0x48]
mov rcx, rsi
call fcn.18002b1a0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
xor al, al
jmp 0x18004eb7e
mov r9, qword [r15 + 8]
test r9, r9
je 0x18004eb61
mov edx, ebx
mov r8d, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
jne 0x18004eb9c
mov edx, ebx
mov dword [rsp + 0x30], ebx
mov eax, ebx
add rbp, rax
sub rdi, rax
test r14, r14
je 0x18004eb73
mov eax, edx
add qword [r14], rax
test rdi, rdi
jne 0x18004ead0
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180009610
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rsi, rsi
je 0x18004ebb1
mov rax, qword [rsi]
lea rdx, str.fwrite_failed.
mov rcx, rsi
call qword [rax + 0x28]
xor al, al
jmp 0x18004eb7e
Function at 0x18004fbb0
Capabilities:
Hash data using djb2

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
lea rcx, [rsp + 0x20]
call fcn.18000ad90
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x18004fc22
xor ecx, ecx
call fcn.18000d700
xor bl, bl
jmp 0x18004fca9
lea rcx, [rsp + 0x20]
call fcn.180010a70
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18004fc50
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18004fc40
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x18004fca1
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18004fca1
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x18004fca1
call fcn.1800e79a0
mov rbx, rax
test rax, rax
je 0x18004fca1
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800e7a30
test al, al
jne 0x18004fca3
mov rcx, rbx
call fcn.1800e7a00
mov rbx, rax
test rax, rax
jne 0x18004fc80
xor ebx, ebx
test rbx, rbx
setne bl
lea rcx, [rsp + 0x20]
call fcn.18000aef0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180009610
add rsp, 0xc0
pop rbx
ret
Function at 0x18004fcd0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x18004fd0e
xor ecx, ecx
call fcn.18000d700
xor al, al
jmp 0x18004fd83
test rbx, rbx
je 0x18004fd0a
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x20]
call fcn.18000aea0
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18000b3e0
cmp dword [rdi + 0x10], 0x6119a407
je 0x18004fda8
xor ecx, ecx
call fcn.18000d700
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.18000aef0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180009610
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rdi + 0x18], 0
je 0x18004fd74
lea rcx, [rsp + 0x20]
call fcn.180010a70
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18004fde0
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18004fdd0
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x18004fd6d
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18004fd74
lea rsi, [rdx*8]
mov rcx, qword [rsi + rcx]
test rcx, rcx
je 0x18004fd74
call fcn.1800e79a0
mov rbx, rax
test rax, rax
je 0x18004fd74
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800e7a30
test al, al
jne 0x18004fe46
mov rcx, rbx
call fcn.1800e7a00
mov rbx, rax
test rax, rax
jne 0x18004fe20
jmp 0x18004fd74
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x18004fe52
dec eax
mov dword [rdi + 0x20], eax
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov rcx, qword [rcx + rsi]
call fcn.1800e7a70
mov bl, 1
jmp 0x18004fd76

Function at 0x18004ff00
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rbx, rcx
je 0x18004ff21
xor ecx, ecx
call fcn.18000d700
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call fcn.180010a70
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18004ff50
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18004ff40
xor edx, edx
div dword [rbx + 0x14]
mov eax, edx
add rsp, 0x20
pop rbx
ret