joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180037590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov edi, dword [rcx + 0x204]
mov r10, rdx
mov ebx, dword [rcx + 0x208]
mov esi, edi
mov ebp, dword [rcx + 0x20c]
mov r14d, dword [rdx + 0xc]
xor esi, dword [rdx]
xor ebx, dword [rdx + 4]
xor ebp, dword [rdx + 8]
xor r14d, dword [rcx + 0x210]
xor r15d, r15d
lea r12d, [r15 + 0x20]
nop dword [rax + rax]
mov rax, r15
mov r8d, r14d
and eax, 3
rol r8d, 0xb
add r8d, ebp
inc r15
mov r9d, dword [rcx + rax*4 + 0x204]
xor r8d, r9d
mov eax, r8d
shr rax, 0x10
movzx eax, al
movzx r11d, byte [rax + rcx + 0x104]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rax + rcx + 0x104]
mov eax, r8d
shr rax, 8
movzx eax, al
shl edx, 8
or r11d, edx
shl r11d, 8
movzx edx, byte [rax + rcx + 0x104]
or r11d, edx
movzx edx, r8b
shl r11d, 8
mov r8d, ebp
ror r8d, 0xf
xor r8d, r14d
movzx eax, byte [rdx + rcx + 0x104]
add r8d, r9d
or r11d, eax
mov eax, r8d
shr rax, 0x10
xor r11d, esi
movzx eax, al
mov esi, ebp
mov ebp, r11d
movzx r9d, byte [rax + rcx + 0x104]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rax + rcx + 0x104]
mov eax, r8d
shl edx, 8
or r9d, edx
shr rax, 8
shl r9d, 8
movzx eax, al
movzx edx, byte [rax + rcx + 0x104]
or r9d, edx
movzx edx, r8b
shl r9d, 8
movzx eax, byte [rdx + rcx + 0x104]
or r9d, eax
xor r9d, ebx
mov ebx, r14d
mov r14d, r9d
sub r12, 1
jne 0x180037240
xor edi, r11d
mov rdx, r10
mov dword [r10], edi
mov eax, dword [rcx + 0x208]
xor eax, r9d
mov dword [r10 + 4], eax
mov eax, dword [rcx + 0x20c]
xor eax, esi
mov dword [r10 + 8], eax
xor ebx, dword [rcx + 0x210]
mov dword [r10 + 0xc], ebx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
jmp 0x180037590
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r9d, dword [rcx + 0x204]
lea rax, [rdx + 1]
mov r10d, dword [rcx + 0x208]
lea r14, [0x1800f00f0]
mov r11d, dword [rcx + 0x20c]
mov rdi, rdx
mov ebx, dword [rcx + 0x210]
mov rsi, rdx
sub rdi, rax
sub rsi, rax
sub rdx, rax
mov r8, rcx
lea rbp, [rdx + 3]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
lea rax, [rax + 4]
xor r9d, dword [r14 + rcx*4]
mov dword [r8 + 0x204], r9d
movzx ecx, byte [rax - 4]
xor r10d, dword [r14 + rcx*4]
mov dword [r8 + 0x208], r10d
movzx ecx, byte [rsi + rax - 2]
xor r11d, dword [r14 + rcx*4]
mov dword [r8 + 0x20c], r11d
movzx ecx, byte [rax + rbp - 4]
xor ebx, dword [r14 + rcx*4]
mov dword [r8 + 0x210], ebx
sub rdx, 1
jne 0x1800375f0
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x180037dc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180037dd4
or ecx, 0xffffffff
call fcn.180035a30
xor r9d, r9d
mov word [rdi + 0x214], ax
shr eax, 0x10
mov word [rdi + 0x216], ax
mov dword [rdi + 0x218], r9d
mov word [rdi + 0x21d], r9w
mov byte [rdi + 0x21c], r9b
movzx edx, byte [rbx]
test dl, dl
je 0x180037ea5
movzx r8d, byte [rdi + 0x21e]
xor r11d, r11d
mov qword [rsp + 0x30], rsi
mov r10d, r9d
mov qword [rsp + 0x38], r14
xor esi, esi
lea r14, [0x1800f00f0]
nop dword [rax]
movzx eax, dl
lea rbx, [rbx + 1]
add sil, dl
xor r11b, dl
add r8b, dl
mov byte [rdi + 0x21c], sil
movzx edx, dl
lea rcx, [r14 + rax*4]
rol r8b, 1
movzx eax, word [rcx]
xor ax, dx
mov byte [rdi + 0x21d], r11b
xor r10w, ax
mov byte [rdi + 0x21e], r8b
movzx eax, word [rcx + 2]
add ax, dx
mov word [rdi + 0x218], r10w
add r9w, ax
mov word [rdi + 0x21a], r9w
movzx edx, byte [rbx]
test dl, dl
jne 0x180037e40
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18003a1f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1800f00e9], 0
mov rsi, rdx
jne 0x18003a20b
call fcn.18003a150
mov ecx, dword [0x1800ec064]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18003a233
inc dword [rax + 4]
mov rax, qword [rax + 8]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x12c
mov rax, qword [0x1800f04f8]
xor ecx, ecx
test rax, rax
je 0x18003a269
lea edx, [rcx + 1]
call rax
mov rbx, rax
test rax, rax
jne 0x18003a28a
xor edx, edx
xor ecx, ecx
call qword [0x1800f04f8]
jmp 0x18003a26f
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rbx, rax
test rax, rax
jne 0x18003a28a
inc edi
cmp edi, ebp
cmova edi, ebp
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x18003a242
mov ecx, dword [0x1800ec064]
mov rdx, rsi
mov dword [rsi], 0x54626966
mov dword [rsi + 4], 1
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18003a3d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
lea rdx, [rsp + 0x48]
mov rbx, r8
call fcn.18003a1f0
mov qword [rsp + 0x30], rax
lea rax, [0x180036dd0]
mov qword [rsp + 0x38], rax
mov rax, qword [0x1800f0508]
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x18003a450
lea rcx, [rsp + 0x30]
mov edx, 0x4000
mov qword [rsp + 0x20], rcx
lea r9, [0x18003a2e0]
mov ecx, edx
mov r8d, 1
call rax
mov rbx, rax
test rax, rax
jne 0x18003a46f
mov edx, 0x4000
lea rax, [rsp + 0x30]
mov ecx, edx
mov qword [rsp + 0x20], rax
lea r9, [0x18003a2e0]
xor r8d, r8d
call qword [0x1800f0508]
jmp 0x18003a467
lea r8, [rsp + 0x30]
mov ecx, 0x4000
lea rdx, [0x18003a2e0]
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rbx, rax
test rax, rax
je 0x18003a4db
mov ecx, dword [0x1800ec064]
mov qword [rsp + 0x80], rdi
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x18003a48f
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x1800ec064]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x18003a4db
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov ecx, dword [0x1800ec064]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
sub dword [rax + 4], 1
jne 0x18003a50f
mov ecx, dword [0x1800ec064]
xor edx, edx
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [0x1800f0500]
test rax, rax
je 0x18003a50f
call rax
mov rax, rbx
add rsp, 0x70
pop rbx
ret
Function at 0x18003a520
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800ec064]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x18003a545
mov rbx, qword [rax + 8]
mov rcx, qword gs:[0x20]
mov qword [rax + 0x10], rcx
mov rcx, rbx
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x1800ec064]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x18003a585
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180040ff0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov edi, r9d
mov rsi, r8
mov rbx, rcx
test r9d, r9d
jne 0x180041010
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rsi, rsi
jne 0x180041022
mov eax, 0x80070057
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x18004104d
test rdx, rdx
je 0x180041015
mov rax, qword [rsp + 0x70]
mov r9d, edi
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rax
call fcn.18000b520
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 0x18]
cmp rcx, 0xffffffffffffffff
jne 0x180041064
mov eax, 0x80004005
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rdx, rdx
je 0x180041089
mov rdx, qword [rdx]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180041089
call fcn.180002050
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x50], rbp
mov r8d, edi
mov qword [rsp + 0x58], r14
mov rdx, rsi
xor r14d, r14d
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18004118c
cmp dword [rsp + 0x78], r14d
jne 0x180041173
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x1800410f1
cmp eax, 0x3e6
je 0x1800410f1
test eax, eax
jle 0x18004119e
movzx eax, ax
or eax, 0x80070000
jmp 0x18004119e
cmp dword [rbx + 0x428], edi
jae 0x180041140
mov rcx, qword [rbx + 0x420]
test rcx, rcx
je 0x180041118
call fcn.18007294c
mov qword [rbx + 0x420], r14
mov dword [rbx + 0x428], r14d
mov rcx, rdi
lea rdx, [0x1800ece24]
call fcn.180072944
mov qword [rbx + 0x420], rax
test rax, rax
jne 0x18004113a
mov eax, 0x8007000e
jmp 0x18004119e
mov dword [rbx + 0x428], edi
mov rcx, qword [rbx + 0x420]
mov r8, rdi
xor edx, edx
call fcn.18008c000
mov rdx, qword [rbx + 0x420]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx + 0x18]
mov r8d, edi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18004117a
call fcn.180002050
jmp 0x18004119e
mov rdx, qword [rbx + 0x420]
mov r8, rdi
mov rcx, rsi
call fcn.18008b7d0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18004119c
mov eax, dword [rsp + 0x68]
mov dword [rcx], eax
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180042270
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r12
push r15
sub rsp, 0x48
mov r12, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x180042482
mov eax, dword [rdx + 8]
test eax, eax
je 0x1800422a4
test r8, r8
je 0x180042482
test eax, eax
jne 0x1800422b1
xor eax, eax
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
cmp qword [rcx + 0x18], 0xffffffffffffffff
jne 0x1800422cf
cmp qword [rcx + 0x20], 0
jne 0x1800422cf
mov eax, 0x80004005
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
cmp dword [rcx + 0x28], 0x990
je 0x1800422e8
mov eax, 0x80004001
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x80], rbp
imul ebp, eax, 0x990
mov qword [rsp + 0x40], r14
mov edx, ebp
call fcn.180045710
mov r14, rax
test rax, rax
jne 0x180042311
mov eax, 0x8007000e
jmp 0x180042376
mov ecx, dword [rdi + 0x28]
mov rax, qword [rsi]
cqo
mov qword [rsp + 0x70], rbx
and edx, 0x7ff
xor ebx, ebx
add rax, rdx
sar rax, 0xb
imul rax, rcx
mov ecx, dword [rdi + 0x34]
add rax, rcx
test ebp, ebp
je 0x1800423d1
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x180042362
lea rdx, [rsp + 0x30]
mov r9d, ebp
mov qword [rsp + 0x20], rdx
mov r8, r14
mov rdx, rax
call fcn.18000b520
jmp 0x1800423c8
mov rcx, qword [rdi + 0x18]
cmp rcx, 0xffffffffffffffff
jne 0x18004238e
mov eax, 0x80004005
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800423c3
mov rcx, qword [rdi + 0x18]
lea r9, [rsp + 0x78]
mov r8d, ebp
mov dword [rsp + 0x78], ebx
mov rdx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800423d1
call fcn.180002050
test eax, eax
js 0x180042371
cmp eax, 1
je 0x180042371
cmp dword [rsi + 8], ebx
jbe 0x18004246f
mov r8d, ebx
nop dword [rax]
mov eax, dword [rdi + 0x28]
mov ecx, send
imul eax, ebx
mov edx, r8d
add rdx, r15
add rax, r14
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1800423f4
movups xmm0, xmmword [rax]
inc ebx
add r8d, 0x930
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
cmp ebx, dword [rsi + 8]
jb 0x1800423e0
test r12, r12
je 0x18004247b
mov eax, dword [rsi + 8]
mov dword [r12], eax
xor eax, eax
jmp 0x180042371
mov eax, 0x80070057
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
Function at 0x1800424a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov edx, dword [rcx + 0x34]
mov qword [rsp + 0x68], rdx
xor r9d, r9d
lea r8, [rsp + 0x68]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1800424dc
call fcn.180002050
jmp 0x180042620
mov ecx, 0xa290
call fcn.180072d68
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x1800424fd
mov edi, 0x8007000e
jmp 0x180042611
xor edx, edx
mov r8d, 0xa290
mov rcx, rbx
call fcn.18008c000
xor edi, edi
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov r8d, 0xa290
mov rdx, rbx
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180042540
call fcn.180002050
mov edi, eax
jmp 0x180042611
mov eax, dword [rbx + 0x8001]
cmp eax, dword [0x1800d9828]
jne 0x180042561
movzx eax, byte [rbx + 0x8005]
cmp al, byte [0x1800d982c]
je 0x180042611
mov eax, dword [rbx + 0x8001]
cmp eax, dword [str.BEA01]
jne 0x180042582
movzx eax, byte [rbx + 0x8005]
cmp al, byte [0x1800d9824]
je 0x180042611
mov r8d, 0x9311
mov rdx, rbx
call fcn.180044320
test eax, eax
jne 0x180042611
mov r8d, 0x9319
call fcn.180044320
test eax, eax
jne 0x180042611
mov r8d, 0x9911
call fcn.180044320
test eax, eax
jne 0x180042611
mov r8d, 0x9919
call fcn.180044320
test eax, eax
jne 0x180042611
mov r8d, 0x9209
call fcn.180044320
test eax, eax
jne 0x180042611
mov r8d, 0x9201
call fcn.180044320
test eax, eax
jne 0x180042611
cmp dword [rsi + 0x34], edi
je 0x1800425f3
mov dword [rsi + 0x34], edi
mov rcx, rsi
call fcn.1800424a0
mov edi, eax
jmp 0x180042611
mov eax, dword [rsi + 0x38]
cmp eax, 1
jne 0x180042602
mov edi, 0xe003200b
jmp 0x180042611
cmp eax, 2
mov edi, 0xe003200a
je 0x180042611
mov edi, 0xe00e1001
test rbx, rbx
je 0x18004261e
mov rcx, rbx
call fcn.18007294c
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180042c20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x158
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov esi, dword [rsp + 0x1a0]
mov rdi, r9
mov rbx, r8
mov r15, rdx
test rdx, rdx
je 0x180042e01
test rbx, rbx
je 0x180042e01
test r9, r9
je 0x180042e01
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
add rsi, rdi
mov ecx, dword [rsi]
add rcx, rdi
cmp dword [rsp + 0x1a8], 0
je 0x180042d54
lea rdx, [0x1800d96a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180042d69
xor edx, edx
mov qword [rsp + 0x150], rbp
mov rcx, rbx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbp, rax
test rax, rax
je 0x180042df0
add rbp, 2
cmp dword [rsp + 0x1a8], 0
je 0x180042d86
mov edx, dword [rsi]
mov rcx, rbp
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180042dfa
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rcx, rax
lea rdx, [0x1800d9698]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180042dfa
mov eax, 0xe0032009
mov rbp, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180072920
add rsp, 0x158
pop r15
pop rdi
pop rsi
pop rbx
ret
lea rdx, str..mdf
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180042c9e
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rcx, rax
lea rdx, [0x1800d9698]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
jmp 0x180042d37
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.18008c000
mov edx, dword [rsi]
lea rcx, [rsp + 0x30]
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rbx
lea rdx, [rsp + 0x30]
sub rcx, rbp
add rcx, 0x208
sar rcx, 1
or rax, 0xffffffffffffffff
cmp byte [rdx + rax + 1], 0
lea rax, [rax + 1]
jne 0x180042dc1
mov dword [rsp + 0x28], ecx
lea r9d, [rax + 1]
xor ecx, ecx
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180042ce1
mov eax, 0x80004005
jmp 0x180042d2f
xor eax, eax
jmp 0x180042d2f
mov eax, 0x80070057
jmp 0x180042d37
Function at 0x180044360
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rdi, rcx
cmp dword [rcx + 0x38], 8
jne 0x180044397
mov dword [rcx + 0x34], 0x2c
mov dword [rcx + 0x28], 0x930
xor eax, eax
jmp 0x1800445e8
lea rdx, [0x1800ece24]
mov ecx, 0xa290
call fcn.180072944
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1800443bf
mov eax, 0x8007000e
jmp 0x1800445d7
xor edx, edx
mov r8d, 0xa290
mov rcx, rbx
call fcn.18008c000
mov r8, qword [rdi + 0x20]
xor esi, esi
mov edx, dword [rdi + 0x34]
test r8, r8
je 0x180044444
mov ebp, 0xa290
mov rcx, qword [r8 + 0x130]
cmp rdx, rcx
jae 0x1800445d2
lea rax, [rdx + 0xa290]
cmp rax, rcx
jbe 0x180044402
mov ebp, ecx
sub ebp, edx
lea rcx, [r8 + 0xc8]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r8
lea r8, [0x18000b5a0]
mov qword [rsp + 0x20], r8
mov r9d, ebp
mov r8, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
js 0x1800445d7
cmp eax, 1
je 0x1800445d7
cmp ebp, 0xa290
je 0x1800444a0
jmp 0x1800445d2
mov qword [rsp + 0x70], rdx
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180044468
call fcn.180002050
jmp 0x1800445d7
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
mov r8d, 0xa290
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180044492
call fcn.180002050
jmp 0x1800445d7
cmp dword [rsp + 0x60], 0xa290
jne 0x1800445d2
mov r8d, 0x8001
mov rdx, rbx
call fcn.180044320
test eax, eax
je 0x1800444c6
mov qword [rdi + 0x28], 0x800
mov dword [rdi + 0x30], 0x18
jmp 0x1800445d9
mov r8d, 0x9311
mov rdx, rbx
call fcn.180044320
test eax, eax
je 0x1800444f2
mov dword [rdi + 0x28], 0x930
mov dword [rdi + 0x2c], reloc.WS2_32.dll_recv
mov dword [rdi + 0x30], reloc.WS2_32.dll_recv
jmp 0x1800445d9
mov r8d, 0x9319
mov rdx, rbx
call fcn.180044320
test eax, eax
je 0x18004451e
mov dword [rdi + 0x28], 0x930
mov dword [rdi + 0x2c], 0x18
mov dword [rdi + 0x30], 0x18
jmp 0x1800445d9
mov r8d, 0x9911
mov rdx, rbx
call fcn.180044320
test eax, eax
je 0x18004454a
mov dword [rdi + 0x28], 0x990
mov dword [rdi + 0x2c], reloc.WS2_32.dll_recv
mov dword [rdi + 0x30], reloc.WS2_32.dll_recv
jmp 0x1800445d9
mov r8d, 0x9919
mov rdx, rbx
call fcn.180044320
test eax, eax
je 0x180044573
mov dword [rdi + 0x28], 0x990
mov dword [rdi + 0x2c], 0x18
mov dword [rdi + 0x30], 0x18
jmp 0x1800445d9
mov r8d, 0x9209
mov rdx, rbx
call fcn.180044320
test eax, eax
je 0x18004459c
mov dword [rdi + 0x28], 0x920
mov dword [rdi + 0x2c], 8
mov dword [rdi + 0x30], 0x18
jmp 0x1800445d9
mov r8d, 0x9201
mov rdx, rbx
call fcn.180044320
test eax, eax
je 0x1800445bf
mov qword [rdi + 0x28], 0x920
mov dword [rdi + 0x30], reloc.WS2_32.dll_recv
jmp 0x1800445d9
cmp dword [rdi + 0x38], 4
jne 0x1800445cf
mov qword [rdi + 0x28], 0x930
jmp 0x1800445d9
mov dword [rdi + 0x38], esi
mov eax, 0xe00e1001
mov esi, eax
test rbx, rbx
je 0x1800445e6
mov rcx, rbx
call fcn.18007294c
mov eax, esi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180045460
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rbx, qword [rcx + 0x3c0]
xor r14d, r14d
mov rdi, rcx
mov esi, r14d
mov ebp, r14d
cmp rbx, qword [rcx + 0x3c8]
je 0x180045542
nop word [rax + rax]
mov r8, rsi
mov edx, ebp
mov rcx, rdi
call fcn.1800438c0
xor eax, eax
cmp qword [rbx + 0x18], 8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
jb 0x1800454c5
mov rcx, qword [rbx]
jmp 0x1800454c8
mov rcx, rbx
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180045587
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180045571
mov rax, qword [rsp + 0x40]
lea rcx, [rdi + 0x3a8]
sub rax, 0x2c
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
add rsi, rax
inc ebp
call fcn.180045c40
add rbx, 0x20
cmp rbx, qword [rdi + 0x3c8]
jne 0x1800454a0
mov rdx, rsi
mov rcx, rdi
call fcn.1800437f0
xor eax, eax
mov qword [rdi + 0x370], rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
call fcn.180002050
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180045556
call fcn.180002050
jmp 0x180045556