joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001fdb0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub rsp, 0x198
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdx, rcx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
lea r8, [0x180155f98]
call fcn.18012589c
test eax, eax
je 0x18001fe16
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x18001fdf9
call fcn.180125984
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x198
ret
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
call fcn.180126310
mov rcx, qword [rsp + 0x20]
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
je 0x18001fe5e
call fcn.180125984
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x198
ret
mov edx, dword [rsp + 0x6c]
xor r8d, r8d
call fcn.18012664c
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x70]
mov edx, 0x108
mov r8d, 1
call fcn.180126310
mov rcx, qword [rsp + 0x20]
call fcn.180125984
cmp dword [rsp + 0x70], 0x4550
jne 0x18001fe44
movzx eax, word [rsp + 0x74]
mov ecx, 0x14c
cmp ax, cx
jne 0x18001fec4
mov eax, 0x20
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x198
ret
mov ecx, 0x200
cmp ax, cx
je 0x18001fedd
mov ecx, 0x8664
cmp ax, cx
mov eax, 1
jne 0x18001fee2
mov eax, 0x40
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x198
ret

Function at 0x18001ff00
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x2e0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor ebx, ebx
mov qword [rsp + 0xa8], rdx
mov dword [rsp + 0x50], ebx
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x40], 0x2000
mov rdi, r8
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0x78]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
mov dword [rsp + 0x30], 7
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rcx
mov edx, 0x80
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x68], 0x80008
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], 0x40
movdqu xmmword [rsp + 0x98], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x18002003f
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0xc0]
mov r9d, 0x20e
mov dword [rsp + 0x20], 9
lea rdx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x180020034
mov eax, dword [rsp + 0xc0]
cmp eax, 0x7fe
jbe 0x18002000f
mov dword [rsp + 0xc0], 0x7fe
mov eax, 0x7fe
shr rax, 1
lea r8, [rsp + 0xc4]
mov edx, 0x3ff
mov rcx, rdi
mov word [rsp + rax*2 + 0xc4], bx
call fcn.1801259f0
mov ebx, 1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
ret
Function at 0x180020070
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov rdx, rcx
mov rbx, r8
mov ecx, esi
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1800200a4
cmp eax, esi
jbe 0x1800200bd
test rbx, rbx
jne 0x1800200ad
xor eax, eax
jmp 0x1800200fa
mov r8, rsi
xor edx, edx
add r8, r8
mov rcx, rdi
call fcn.180113150
test rbx, rbx
je 0x1800200f8
cmp word [rdi], 0
je 0x1800200d2
cmp word [rbx], 0x5c
jne 0x1800200d2
add rbx, 2
lea edx, [rsi - 1]
mov r8, rbx
mov rcx, rdi
call fcn.180125a58
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800200f8
mov rcx, rdi
call sym.SafeBase64.dll_CreateDirs
mov ebp, eax
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180020180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea eax, [rdx - 1]
mov rsi, r9
movsxd rbp, eax
mov rdi, rcx
mov r9, r8
mov rdx, rcx
mov r8, rbp
lea rcx, [rsp + 0x20]
call fcn.1801274fc
test eax, eax
je 0x1800201be
xor eax, eax
jmp 0x18002020c
mov qword [rsp + 0x38], rbx
mov ebx, 1
test rsi, rsi
je 0x180020205
lea r8, [0x180155ad4]
mov rdx, rbp
mov rcx, rdi
call fcn.180125a58
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.180125a58
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180020205
mov rcx, rdi
call sym.SafeBase64.dll_CreateDirs
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180020960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x680
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.180113150
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180113150
xor edx, edx
lea rcx, [rsp + 0x460]
mov r8d, 0x208
call fcn.180113150
mov r8, rbx
lea rcx, [rsp + 0x250]
mov edx, 0x103
call fcn.1801259f0
mov rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x250]
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1800209f0
lea rbx, [rsp + 0x250]
lea rbx, [rbx + rax*2]
lea rax, [rsp + 0x250]
cmp rbx, rax
je 0x180020a4d
movabs rdx, 0x200000000801
nop
movzx eax, word [rbx - 2]
mov rcx, rbx
sub rbx, 2
sub ax, 0x2f
cmp ax, 0x2d
ja 0x180020a3b
bt rdx, rax
jb 0x180020a4a
lea rax, [rsp + 0x250]
cmp rbx, rax
jne 0x180020a20
jmp 0x180020a4d
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x40]
mov edx, 0x103
test rbx, rbx
je 0x180020a6b
mov r8, rbx
call fcn.1801259f0
mov word [rbx], bp
jmp 0x180020a77
lea r8, [0x180155ad4]
call fcn.180125a58
lea rax, [rsp + 0x40]
nop dword [rax]
cmp word [rax + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x180020a80
lea rax, [rsp + 0x40]
lea rax, [rax + rdi*2]
lea rcx, [rsp + 0x40]
cmp rax, rcx
je 0x180020ad7
nop
mov rbx, rax
sub rax, 2
cmp word [rax], 0x2e
je 0x180020ab9
lea rcx, [rsp + 0x40]
cmp rax, rcx
jne 0x180020aa0
jmp 0x180020ad7
test rbx, rbx
je 0x180020ad7
mov r8, rbx
lea rcx, [rsp + 0x460]
mov edx, 0x103
call fcn.1801259f0
mov word [rbx - 2], bp
cmp word [rsp + 0x40], bp
jne 0x180020af4
lea r8, str.Unnamed
mov edx, 0x103
lea rcx, [rsp + 0x40]
call fcn.1801259f0
lea rax, [rsp + 0x460]
mov edx, 0x103
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x250]
lea rax, [rsp + 0x40]
mov rcx, rsi
lea r8, str._s_s._s
mov qword [rsp + 0x20], rax
call fcn.18000f870
mov ebx, 1
nop dword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180020b83
lea rcx, [rsp + 0x460]
mov edx, 0x103
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x250]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea r8, str._s_s__d_._s
mov rcx, rsi
call fcn.18000f870
inc ebx
cmp ebx, 0x100
jl 0x180020b30
mov eax, ebp
jmp 0x180020b88
mov eax, 1
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x680
pop rdi
pop rsi
pop rbp
ret
Function at 0x180020ca0
Capabilities:
Get file size
Hash data with md5
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
mov eax, 0x20d0
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x20c0], rax
mov r14, r8
mov ebx, edx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x180020d1e
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180020d3f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x20c0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x20d0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
test ebx, ebx
je 0x180020d59
mov rax, rbx
mov rbx, qword [rsp + 0x48]
cmp rbx, rax
cmovg rbx, rax
mov qword [rsp + 0x48], rbx
jmp 0x180020d5e
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], 0x67452301
mov dword [rsp + 0x6c], 0xefcdab89
mov dword [rsp + 0x70], 0x98badcfe
mov dword [rsp + 0x74], 0x10325476
mov r15d, 0x2000
nop dword [rax]
test rbx, rbx
jle 0x180020de7
cmp rbx, r15
cmova ebx, r15d
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
mov r8d, ebx
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180020df9
mov r8d, dword [rsp + 0x50]
mov eax, r8d
mov rbx, qword [rsp + 0x48]
sub rbx, r8
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.180030bd0
jmp 0x180020d90
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.180030ca0
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180020d20
Function at 0x180020ea0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
mov eax, 0x2160
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2150], rax
mov r14, r8
mov ebx, edx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x180020f1e
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180020f3f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x2150]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x2160
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
test ebx, ebx
je 0x180020f59
mov rax, rbx
mov rbx, qword [rsp + 0x48]
cmp rbx, rax
cmovg rbx, rax
mov qword [rsp + 0x48], rbx
jmp 0x180020f5e
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], 0x7380166f
mov dword [rsp + 0x6c], 0x4914b2b9
mov dword [rsp + 0x70], 0x172442d7
mov dword [rsp + 0x74], 0xda8a0600
mov dword [rsp + 0x78], 0xa96f30bc
mov dword [rsp + 0x7c], 0x163138aa
mov dword [rsp + 0x80], 0xe38dee4d
mov dword [rsp + 0x84], 0xb0fb0e4e
mov r15d, 0x2000
nop
test rbx, rbx
jle 0x180021007
cmp rbx, r15
cmova ebx, r15d
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
mov r8d, ebx
lea rdx, [rsp + 0x150]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180021019
mov r8d, dword [rsp + 0x50]
mov eax, r8d
mov rbx, qword [rsp + 0x48]
sub rbx, r8
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x60]
call fcn.180048d50
jmp 0x180020fb0
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.180048e40
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180020f20
Function at 0x1800210c0
Capabilities:
Get file size
Hash data using sha1
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
mov eax, 0x20d0
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x20c0], rax
mov r14, r8
mov esi, edx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x18002113f
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180021165
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x20c0]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x2108]
add rsp, 0x20d0
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x48]
test esi, esi
je 0x18002117a
cmp rax, rsi
cmovg rax, rsi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x60], 0x67452301
mov dword [rsp + 0x64], 0xefcdab89
mov dword [rsp + 0x68], 0x98badcfe
mov dword [rsp + 0x6c], 0x10325476
mov dword [rsp + 0x70], 0xc3d2e1f0
mov dword [rsp + 0x74], ebx
mov dword [rsp + 0xb8], ebx
mov esi, 0x2000
test rax, rax
jle 0x180021202
cmp rax, rsi
cmova eax, esi
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, eax
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180021214
mov r8d, dword [rsp + 0x50]
sub qword [rsp + 0x48], r8
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.180047f40
mov rax, qword [rsp + 0x48]
jmp 0x1800211b2
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.180048050
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180021141
Function at 0x180021b20
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x2070
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov rbx, r8
mov rdi, rcx
xor esi, esi
mov r8, rdx
mov edx, 0x3ff
lea rcx, [rsp + 0x60]
call fcn.1801259f0
mov r8, rbx
mov edx, 0x3ff
lea rcx, [rsp + 0x60]
call fcn.180125a58
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 3]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180021c1f
mov qword [rsp + 0x20], rbx
mov r9, rdi
lea r8, [0x180155c60]
mov edx, 0x3ff
lea rcx, [rsp + 0x860]
call fcn.18000f870
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rsi + 1]
lea rcx, [rsp + 0x860]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x180021c49
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x20b8]
add rsp, 0x2070
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [rsp + 0x40], eax
mov r12d, 0x1000
test ebx, ebx
je 0x180021cb9
mov edi, ebx
cmp ebx, r12d
cmova edi, r12d
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
mov r8d, edi
lea rdx, [rsp + 0x1060]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180021cbe
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
mov r8d, edi
lea rdx, [rsp + 0x1060]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180021cbe
sub ebx, edi
mov dword [rsp + 0x40], ebx
jmp 0x180021c60
mov esi, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x180021c21
Function at 0x180022030
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbx
mov eax, 0x8050
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x8040], rax
mov rax, rdx
mov dword [rsp + 0x20], 0x16
mov rbx, rcx
lea r8, [rsp + 0x40]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r9d, 0x8000
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x180022080
xor eax, eax
jmp 0x1800220ac
cmp dword [rsp + 0x40], 0
je 0x1800220a7
mov r9d, dword [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x16
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
not eax
shr eax, 0x1f
mov rcx, qword [rsp + 0x8040]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x8050
pop rbx
ret

Function at 0x1800220d0
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x10058
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x10040], rax
mov r9d, 0x10000
mov dword [rsp + 0x20], 0x16
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x180022135
cmp dword [rsp + 0x40], 0
je 0x180022135
mov eax, 1
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x10058
ret
xor eax, eax
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x10058
ret
Function at 0x1800227b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800228ce
mov rax, qword [rcx + 0x1a8]
sub rax, qword [rcx + 0x1a0]
sar rax, 4
mov esi, edx
cmp rax, rsi
jbe 0x1800228ce
call fcn.180018d80
test eax, eax
jne 0x18002280e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DefragFile:_GetBitmap_error__ErrCode_x
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x1800228d3
mov rdi, qword [rbx + 0x194]
lea r9, [rsp + 0x50]
xor edx, edx
mov rax, rdi
div rsi
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
lea r14, [rax + 1]
call fcn.180018ec0
mov esi, eax
test eax, eax
jne 0x180022855
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DefragFile:_FindFreeRange_error__ErrCode_x
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x1800228d3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
nop dword [rax]
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov r8, rdi
mov rcx, rbx
call fcn.180018ec0
test eax, eax
je 0x18002288c
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1800225e0
mov esi, eax
test eax, eax
jne 0x1800228ce
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x3a98
jbe 0x1800228c2
mov rcx, rbx
call fcn.180018d80
test eax, eax
je 0x1800228e6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
lea r9, [rsp + 0x50]
mov rcx, rbx
mov ebp, eax
lea r8d, [rdx + 1]
call fcn.180018ec0
add rdi, rdi
cmp rdi, r14
jb 0x1800228fe
test esi, esi
je 0x180022860
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DefragFile:_GetBitmap1_error__ErrCode_x
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x1800228d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, r14
lea rcx, str.DefragFile:_Clusters__IA64____MinClusters__IA64__error__ErrCode_x
mov r9d, eax
mov rdx, rdi
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x1800228d3
Function at 0x180023140
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rdx
mov r13, rcx
test r8d, r8d
je 0x1800231d0
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1800231c3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rdi + 3]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180023194
mov r12d, 0x100000
mov ecx, r12d
call fcn.180115540
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180023194
mov rbx, qword [r13 + 0x18c]
mov qword [rsp + 0x40], rbx
mov qword [r13 + 0x1b8], rdi
mov edi, ebx
cmp rbx, r12
cmova edi, r12d
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.180022a40
mov esi, eax
test eax, eax
je 0x1800232b8
nop
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
je 0x1800232b8
mov eax, edi
sub rbx, rax
mov qword [rsp + 0x40], rbx
je 0x1800232b3
mov edi, ebx
cmp rbx, r12
cmova edi, r12d
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, r14
mov rcx, r13
call fcn.180022a40
mov esi, eax
test eax, eax
jne 0x180023260
jmp 0x1800232b8
mov esi, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.180115548
mov eax, esi
jmp 0x180023196
Function at 0x1800232d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, r8d
mov rax, rdx
mov r15, rcx
xor r13d, r13d
mov ebx, r13d
mov r14d, r13d
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r13 + 3]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180023374
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, [rsp + 0x64]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x60], eax
cmp eax, 0xffffffff
jne 0x18002339d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800234b2
mov eax, dword [rsp + 0x60]
mov rdi, qword [rsp + 0x60]
cmp rdi, qword [r15 + 0x18c]
jbe 0x180023424
test esi, esi
jne 0x1800234b2
mov eax, eax
mov qword [rsp + 0x70], rax
xor r9d, r9d
lea r8, [rsp + 0x74]
mov edx, eax
mov rcx, qword [r15 + 0x178]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1800233e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1800233e8
mov ebx, r13d
jmp 0x1800234ae
mov rcx, qword [r15 + 0x178]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1800233e0
mov rcx, qword [r15 + 0x178]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebx, 1
mov dword [rsp + 0x40], ebx
mov rcx, r15
call fcn.1800236c0
test eax, eax
je 0x1800234b2
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x50], rdi
mov ecx, 0x100000
call fcn.180115540
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1800234b2
mov qword [r15 + 0x1b8], r13
nop word [rax + rax]
mov esi, edi
mov eax, 0x100000
cmp rdi, rax
cmova esi, eax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
je 0x1800234b2
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, r14
mov rcx, r15
call fcn.180022dc0
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
je 0x1800234b2
mov eax, esi
sub rdi, rax
mov qword [rsp + 0x50], rdi
jne 0x180023450
mov ebx, 1
mov dword [rsp + 0x40], ebx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1800234c8
mov rcx, r14
call fcn.180115548
mov eax, ebx
jmp 0x18002334a