joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180050a90
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x180050bd7
test r8d, r8d
jle 0x180050bd7
mov rax, qword [rbx + 4]
lea rcx, [r11 - 0x60]
mov qword [r11 + 0x18], rdi
mov qword [rcx], rax
mov rax, qword [rbx + 0xc]
mov qword [r11 - 0x20], r12
mov qword [rcx + 8], rax
mov eax, r8d
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov edi, eax
mov dword [rsp + 0x20], eax
mov r12d, eax
test eax, eax
jle 0x180050baf
mov edi, dword [rsp + 0x28]
mov qword [r11 - 0x28], r13
mov r13d, dword [r11 - 0x54]
mov qword [r11 - 0x30], r14
mov r14d, dword [r11 - 0x58]
mov qword [r11 - 0x38], r15
mov r15d, dword [r11 - 0x5c]
nop dword [rax + rax]
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rbx
call fcn.180050f80
mov r11d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
xor r11d, edi
mov edi, dword [rsi]
xor edx, r15d
mov r15d, dword [rsi + 4]
xor ecx, r14d
mov r14d, dword [rsi + 8]
xor eax, r13d
mov r13d, dword [rsi + 0xc]
dec r12d
mov dword [rbp], r11d
mov dword [rbp + 4], edx
mov dword [rbp + 8], ecx
mov dword [rbp + 0xc], eax
add rbp, 0x10
add rsi, 0x10
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], eax
test r12d, r12d
jg 0x180050b20
mov dword [rsp + 0x34], r13d
mov r13, qword [rsp + 0x60]
mov dword [rsp + 0x30], r14d
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x2c], r15d
mov r15, qword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov edi, dword [rsp + 0x20]
mov r12, qword [rsp + 0x68]
lea rcx, [rsp + 0x28]
shl edi, 4
mov rax, qword [rcx]
mov qword [rbx + 4], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0xc], rax
mov eax, edi
mov rdi, qword [rsp + 0xa0]
jmp 0x180050bd9
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x70
pop rsi
pop rbp
pop rbx
ret
Function at 0x180050bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov eax, dword [rdx]
mov r9, rcx
lea rcx, [rsp]
mov dword [rcx], eax
mov eax, dword [rdx + 4]
xor ebx, ebx
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
xor r11d, r11d
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
xor r8d, r8d
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor edx, edx
mov dword [rcx + 0x1c], eax
xor r10d, r10d
cmp r10, 0x28
jg 0x180050cae
cmp rdx, 4
jge 0x180050c97
cmp r8, 4
jge 0x180050c97
movzx eax, byte [rsp + rdx*4]
lea rcx, [r8 + r10]
inc rdx
mov byte [r9 + rcx*4 + 0x14], al
movzx eax, byte [rsp + rdx*4 - 3]
lea rcx, [r8 + r10]
mov byte [r9 + rcx*4 + 0x15], al
movzx eax, byte [rsp + rdx*4 - 2]
inc r11d
mov byte [r9 + rcx*4 + 0x16], al
movzx eax, byte [rsp + rdx*4 - 1]
inc r8
cmp rdx, 4
mov byte [r9 + rcx*4 + 0x17], al
jl 0x180050c53
cmp r8, 4
jne 0x180050ca8
inc ebx
add r10, r8
xor r11d, r11d
xor r8d, r8d
cmp rdx, 4
jl 0x180050c47
movsxd r10, ebx
movsxd r8, r11d
cmp r10, 0xa
jg 0x180050db5
mov qword [rsp + 0x50], rdi
lea rbx, [0x18010bb90]
lea rdi, [0x18010bcb0]
movzx eax, byte [rsp + 0xd]
movzx ecx, byte [rsp]
lea rdx, [rsp + 1]
xor cl, byte [rax + rdi]
movzx eax, byte [rsp + 0xe]
mov r11d, 3
movzx eax, byte [rax + rdi]
xor cl, byte [rbx]
xor byte [rsp + 1], al
movzx eax, byte [rsp + 0xf]
mov byte [rsp], cl
movzx eax, byte [rax + rdi]
xor byte [rsp + 2], al
movzx eax, byte [rsp + 0xc]
movzx eax, byte [rax + rdi]
xor byte [rsp + 3], al
inc rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
add rdx, 4
xor byte [rdx - 1], al
movzx eax, byte [rdx - 4]
xor byte [rdx], al
movzx eax, byte [rdx - 3]
xor byte [rdx + 1], al
movzx eax, byte [rdx - 2]
xor byte [rdx + 2], al
sub r11, 1
jne 0x180050d20
xor edx, edx
cmp r10, 0xa
jg 0x180050db0
cmp rdx, 4
jge 0x180050d94
cmp r8, 4
jge 0x180050d94
movzx eax, byte [rsp + rdx*4]
lea rcx, [r8 + r10*4]
inc rdx
mov byte [r9 + rcx*4 + 0x14], al
movzx eax, byte [rsp + rdx*4 - 3]
lea rcx, [r8 + r10*4]
mov byte [r9 + rcx*4 + 0x15], al
movzx eax, byte [rsp + rdx*4 - 2]
inc r8
cmp rdx, 4
mov byte [r9 + rcx*4 + 0x16], al
movzx eax, byte [rsp + rdx*4 - 1]
mov byte [r9 + rcx*4 + 0x17], al
jl 0x180050d53
cmp r8, 4
jne 0x180050da0
inc r10
xor r8d, r8d
cmp rdx, 4
jl 0x180050d47
cmp r10, 0xa
jle 0x180050cd1
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x30
pop rbx
ret
Function at 0x180050dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x10], rax
lea r9, [rcx + 0x24]
lea r10, [rcx + 0x28]
mov ebx, 9
lea rdi, [0x180000000]
nop dword [rax]
xor r11d, r11d
nop word [rax + rax]
movzx eax, byte [r10 - 1]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 - 2]
movzx r8d, byte [rdx + rdi + 0x108b90]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 - 3]
xor r8b, byte [rcx + rdi + 0x108f90]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 - 4]
xor r8b, byte [rcx + rdi + 0x109390]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 3]
xor r8b, byte [rcx + rdi + 0x109790]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 2]
mov byte [rsp + r11], r8b
movzx r8d, byte [rdx + rdi + 0x108b90]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x108f90]
movzx eax, byte [r10 + 1]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10]
xor r8b, byte [rcx + rdi + 0x109390]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 7]
xor r8b, byte [rcx + rdi + 0x109790]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 6]
mov byte [rsp + r11 + 4], r8b
movzx r8d, byte [rdx + rdi + 0x108b90]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x108f90]
movzx eax, byte [r10 + 5]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 4]
xor r8b, byte [rcx + rdi + 0x109390]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 0xb]
xor r8b, byte [rcx + rdi + 0x109790]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 0xa]
mov byte [rsp + r11 + 8], r8b
movzx r8d, byte [rdx + rdi + 0x108b90]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x108f90]
movzx eax, byte [r10 + 9]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 8]
xor r8b, byte [rcx + rdi + 0x109390]
lea rcx, [r11 + rax*4]
inc r11
xor r8b, byte [rcx + rdi + 0x109790]
cmp r11, 4
mov byte [rsp + r11 + 0xb], r8b
jl 0x180050e10
lea rcx, [rsp]
add r9, 0x10
add r10, 0x10
sub rbx, 1
mov rax, qword [rcx]
mov qword [r9 - 0x10], rax
mov rax, qword [rcx + 8]
mov qword [r9 - 8], rax
jne 0x180050e00
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.18006a4f0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180051790
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x58]
mov rbx, rcx
mov dword [rcx + 0x3c], 2
mov ecx, dword [0x180103f64]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x1800517c5
mov rdi, qword [rax + 8]
mov r8, qword gs:[0x20]
xor ecx, ecx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], ecx
mov rcx, rdi
mov qword [rax + 0x10], r8
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x180051803
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x28]
cmp rcx, rdx
jbe 0x180051822
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x38]
add rax, rcx
cmp rax, rdx
jbe 0x180051810
movsxd rax, ecx
mov rcx, qword [rbx + 0x30]
sub rcx, rax
movsxd rax, edx
add rcx, rax
mov qword [rsi], rcx
mov eax, dword [rbx + 0x38]
mov rsi, qword [rsp + 0x38]
sub eax, edx
add eax, dword [rbx + 0x28]
mov ecx, eax
add rcx, rdx
mov qword [rbx + 0x18], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180051870
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x58]
mov rdi, rcx
mov qword [rcx + 0x40], rdx
mov dword [rcx + 0x3c], 3
mov dword [rcx + 0x48], r8d
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x1800518a5
mov rbx, qword [rax + 8]
mov rdx, qword gs:[0x20]
xor ecx, ecx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], ecx
mov rcx, rbx
mov qword [rax + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1800518e3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov eax, dword [rdi + 0x48]
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 0xfffffffb
add rsp, 0x20
pop rdi
ret
Function at 0x180051980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x20020]
jmp 0x180051980
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x18010c1e8]
xor r15d, r15d
mov r13, r9
mov r14, r8
mov r12d, r15d
call fcn.1800550c0
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x20], rbp
jbe 0x180051a43
cmp dword [rbx + 0x3c], 1
je 0x1800519e5
mov rdx, qword [rbx + 0x50]
lea rcx, [0x18010c1e8]
xor r9d, r9d
xor r8d, r8d
call fcn.180055410
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov ecx, dword [0x180103f64]
mov rdi, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x180051a06
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x180051a43
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov eax, dword [rbx + 0x3c]
cmp eax, 2
jne 0x180051a69
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x38]
mov qword [rbx + 0x28], rdx
mov rax, qword [rcx]
lea r8, [rbx + 0x30]
call qword [rax]
mov r12d, eax
jmp 0x1800519ed
cmp eax, 3
jne 0x180051a88
movsxd rdx, dword [rbx + 0x48]
add rdx, qword [rbx + 0x20]
cmp rdx, rbp
ja 0x180051a88
mov qword [rbx + 0x20], rdx
mov dword [rbx + 0x48], r15d
jmp 0x1800519ed
mov edi, r15d
mov rsi, r15
test r12d, r12d
jne 0x180051ab6
cmp eax, 1
jne 0x180051a9e
lea r12d, [rax + 0xa]
jmp 0x180051ab6
movsxd rax, dword [rbx + 0x20]
mov edi, dword [rbx + 0x48]
mov rsi, qword [rbx + 0x40]
sub edi, ebp
sub rsi, rax
add edi, eax
movsxd rax, ebp
add rsi, rax
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x180051ae8
mov ecx, dword [0x180103f64]
xor edx, edx
mov dword [rax], r15d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x18010bde0]
test r11, r11
je 0x180051ae8
call r11
lea r11, [rsp + 0x50]
mov qword [rbx + 0x58], r15
mov qword [r14], rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r13], edi
mov eax, r12d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180052d80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov rsi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
or ecx, 0xffffffff
call fcn.1800504e0
mov word [rbx + 0x214], ax
shr eax, 0x10
mov word [rbx + 0x216], ax
xor eax, eax
mov word [rbx + 0x21a], ax
mov word [rbx + 0x218], ax
mov byte [rbx + 0x21e], al
mov byte [rbx + 0x21d], al
mov byte [rbx + 0x21c], al
movzx ecx, byte [rsi]
test cl, cl
je 0x180052e39
lea rdi, [0x180108790]
add byte [rbx + 0x21c], cl
xor byte [rbx + 0x21d], cl
movzx eax, byte [rbx + 0x21e]
add al, cl
movzx edx, cl
movzx ecx, cl
rol al, 1
inc rsi
mov byte [rbx + 0x21e], al
movzx eax, cx
xor ax, word [rdi + rdx*4]
xor word [rbx + 0x218], ax
movzx eax, word [rdi + rdx*4 + 2]
add ax, cx
add word [rbx + 0x21a], ax
mov cl, byte [rsi]
test cl, cl
jne 0x180052df0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800550c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x18010bdcb], 0
mov rsi, rdx
jne 0x1800550db
call fcn.180055020
mov ecx, dword [0x180103f64]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180055103
inc dword [rax + 4]
mov rax, qword [rax + 8]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x12c
mov rax, qword [0x18010bde8]
test rax, rax
je 0x18005513e
mov edx, 1
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
jne 0x180055161
xor edx, edx
xor ecx, ecx
call qword [0x18010bde8]
mov rbx, rax
jmp 0x180055149
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rbx, rax
test rbx, rbx
jne 0x180055161
inc edi
cmp edi, ebp
cmova edi, ebp
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x180055112
mov ecx, dword [0x180103f64]
mov rdx, rsi
mov dword [rsi], 0x54626966
mov dword [rsi + 4], 1
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800552b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
lea rdx, [rsp + 0x48]
lea rcx, [0x18010c1e8]
mov rbx, r8
call fcn.1800550c0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x180051900]
mov qword [rsp + 0x38], rax
mov rax, qword [0x18010bdd8]
test rax, rax
je 0x18005533c
lea rcx, [rsp + 0x30]
mov edx, 0x4000
lea r9, [0x1800551c0]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov r8d, 1
call rax
mov rbx, rax
test rax, rax
jne 0x18005535b
lea rax, [rsp + 0x30]
mov edx, 0x4000
lea r9, [0x1800551c0]
mov rcx, rdx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [0x18010bdd8]
mov rbx, rax
jmp 0x180055356
lea r8, [rsp + 0x30]
lea rdx, [0x1800551c0]
mov ecx, 0x4000
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rbx, rax
test rbx, rbx
je 0x1800553c7
mov ecx, dword [0x180103f64]
mov qword [rsp + 0x80], rdi
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x18005537b
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x18], 0
mov qword [rax + 0x10], rdx
mov dword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1800553c7
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x1800553fc
mov ecx, dword [0x180103f64]
xor edx, edx
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x18010bde0]
test r11, r11
je 0x1800553fc
call r11
mov rax, rbx
add rsp, 0x70
pop rbx
ret
Function at 0x180055410
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x180103f64]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x180055435
mov rbx, qword [rax + 8]
mov rcx, qword gs:[0x20]
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], 0
mov qword [rax + 0x10], rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x180103f64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x180055475
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180059140
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
mov rcx, qword [rcx + 0x220]
xor edi, edi
test rcx, rcx
je 0x180059175
call fcn.18006aaac
mov qword [rbx + 0x220], rdi
mov rcx, qword [rbx + 0x218]
cmp rcx, 0xffffffffffffffff
je 0x18005919e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x218], 0xffffffffffffffff
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800591b3
call fcn.18006aaac
mov qword [rbx], rdi
mov dword [rbx + 8], edi
jmp 0x1800591b6
mov dword [rbx + 8], edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800591d0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
cmp r8d, 0xa00000
jbe 0x180059201
mov eax, 0x80004005
jmp 0x18005934d
mov dword [rcx + 0x228], edx
mov dword [rcx + 0x22c], r8d
mov ecx, r8d
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
lea rdx, [0x180106f48]
cmovo rax, rcx
mov rcx, rax
call fcn.18006aaa4
mov qword [rbx + 0x220], rax
test rax, rax
jne 0x180059249
mov eax, 0x8007000e
jmp 0x18005934d
mov r8d, dword [rbx + 0x22c]
mov edx, 0xff
mov rcx, rax
shl r8, 2
mov qword [rsp + 0x278], rsi
call fcn.18006cf60
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], si
call fcn.18006cf60
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x18005936a
cmp eax, 0x104
ja 0x18005936a
lea rdx, str.WMCache_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800592dc
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18005936a
lea r9, [rbx + 0x10]
lea rdx, [0x1800e17f8]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x280], rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x180059338
mov qword [rsp + 0x30], rsi
lea rcx, [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x20000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x218], rax
cmp rax, 0xffffffffffffffff
jne 0x180059366
call fcn.180003180
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x260
pop rbx
ret
xor eax, eax
jmp 0x18005933d
call fcn.180003180
jmp 0x180059345
Function at 0x180059380
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x250
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r12, r8
mov ebp, edx
mov rbx, rcx
cmp edx, dword [rcx + 0x22c]
jb 0x1800593b8
mov eax, 0x80070057
jmp 0x18005954e
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x40], 0
call fcn.18006cf60
mov ecx, dword [rbx + 0x228]
mov rax, qword [rbx + 0x230]
mov rdi, qword [rbx + 0x218]
lea r10, [rcx + rax - 0x200]
mov qword [rsp + 0x38], r10
cmp rdi, 0xffffffffffffffff
je 0x180059541
mov rax, r10
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
je 0x180059445
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x200
call fcn.180003f70
jmp 0x180059507
xor r9d, r9d
xor r8d, r8d
mov rdx, r10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180059465
call fcn.180003180
jmp 0x180059507
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rdi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180059510
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x1800594b5
cmp eax, 0x3e6
je 0x1800594b5
test eax, eax
jle 0x180059507
movzx eax, ax
or eax, 0x80070000
jmp 0x180059507
mov edx, 0x200
mov rcx, rbx
call fcn.180003da0
test eax, eax
js 0x180059507
cmp eax, 1
je 0x180059507
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
call fcn.18006c2d0
mov rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180059510
call fcn.180003180
test eax, eax
js 0x180059546
cmp eax, 1
je 0x180059546
mov ecx, dword [rbx + 0x228]
mov rax, qword [rbx + 0x230]
xor edx, edx
div rcx
mov dword [r12], eax
mov rcx, qword [rbx + 0x220]
mov dword [rcx + rbp*4], eax
mov eax, dword [rbx + 0x228]
add qword [rbx + 0x230], rax
xor eax, eax
jmp 0x180059546
mov eax, 0x80070057
mov rdi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x250
pop r12
pop rbp
pop rbx
ret
Function at 0x180059570
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rdi, rcx
mov rcx, qword [rcx + 0x220]
mov rsi, r9
test rcx, rcx
je 0x180059719
cmp edx, dword [rdi + 0x22c]
jae 0x180059719
mov eax, edx
mov ecx, dword [rcx + rax*4]
cmp ecx, 0xffffffff
je 0x180059719
mov r10d, dword [rdi + 0x228]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov ebp, dword [rsp + 0x80]
mov eax, r8d
mov qword [rsp + 0x40], r12
imul r10, rcx
mov r12, qword [rdi + 0x218]
add r10, rax
mov qword [rsp + 0x30], r10
test ebp, ebp
jne 0x1800595e5
xor ebx, ebx
jmp 0x180059701
cmp r12, 0xffffffffffffffff
je 0x1800596fc
test r9, r9
je 0x1800596fc
mov rax, r10
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x1800596dd
test ebp, 0x1ff
jne 0x1800596dd
xor r9d, r9d
xor r8d, r8d
mov rdx, r10
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180059642
call fcn.180003180
mov ebx, eax
jmp 0x180059701
xor ebx, ebx
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180059701
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180059690
cmp eax, 0x3e6
je 0x180059690
test eax, eax
jg 0x180059685
mov ebx, eax
jmp 0x180059701
movzx ebx, ax
or ebx, 0x80070000
jmp 0x180059701
mov edx, ebp
mov rcx, rdi
call fcn.180003da0
test eax, eax
js 0x1800596d9
cmp eax, 1
je 0x1800596d9
mov rdx, qword [rdi]
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800596c9
call fcn.180003180
mov ebx, eax
jmp 0x180059701
mov rdx, qword [rdi]
mov r8, rbp
mov rcx, rsi
call fcn.18006c2d0
jmp 0x180059701
mov ebx, eax
jmp 0x180059701
xor ebx, ebx
lea r8, [rsp + 0x30]
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebp
call fcn.180003e10
mov ebx, eax
jmp 0x180059701
mov ebx, 0x80070057
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x48
pop rdi
pop rsi
ret
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, r9
call fcn.18006cf60
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
ret