joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012ea20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rsi, rcx
mov edx, dword [0x14026f4d8]
mov rdi, r8
mov ecx, 4
mov rdx, qword [rax + rdx*8]
mov eax, dword [rcx + rdx]
cmp dword [0x14026d908], eax
jle 0x14012eaa7
lea rcx, [0x14026d908]
call fcn.14019270c
cmp dword [0x14026d908], 0xffffffff
jne 0x14012eaa7
call fcn.14000eeb0
mov rcx, rax
test rax, rax
je 0x14012eb76
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [0x1401bd094]
mov qword [0x14026d900], rax
call fcn.140192458
lea rcx, [0x14026d908]
call fcn.1401926ac
test rdi, rdi
je 0x14012eb81
mov rax, qword [rsi + 0x4b8]
test rax, rax
je 0x14012eb64
cmp qword [rax + 0x40], 0
je 0x14012eb64
test rax, rax
je 0x14012ead4
mov rax, qword [rax + 0x40]
cmp qword [rdi], rax
jne 0x14012eb64
mov rax, qword [rdi + 8]
sub rax, 1
je 0x14012eb2b
sub rax, 1
je 0x14012eafa
cmp rax, 1
jne 0x14012eb64
mov ebx, 0x428e
jmp 0x14012eb30
mov ecx, 0x11
mov ebx, 0x3ea1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14012eb30
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x680]
test eax, eax
je 0x14012eb30
mov ebx, 0x3ea4
jmp 0x14012eb30
mov ebx, 0x3ea0
mov ecx, ebx
call fcn.14001d3a0
test rax, rax
je 0x14012eb87
mov r8d, ebx
lea rcx, [0x14026d900]
mov rdx, rax
call fcn.1400088c8
test eax, eax
je 0x14012eb87
mov rax, qword [0x14026d900]
mov qword [rdi + 0x18], rax
mov eax, 1
jmp 0x14012eb66
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400028a0
int3
call fcn.14000daf0
int3
call fcn.14000daf0
int3

Function at 0x140144b08
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14026dd00]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402657f0]
test eax, eax
je 0x140144b53
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402657f0]
test eax, eax
jne 0x140144b5c
call fcn.140006554
test eax, eax
je 0x140144b78
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14025e018]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140144b80
xor eax, eax
jmp 0x140144bdd
test rbx, rbx
jne 0x140144ba0
lea rcx, str.ChooseColorA
call fcn.140023cf8
mov rbx, rax
test rax, rax
je 0x140144bab
mov qword [0x14026dd00], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140144bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140144bc2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140144bdb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140149258
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14026de50]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402657f0]
test eax, eax
je 0x1401492a3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402657f0]
test eax, eax
jne 0x1401492ac
call fcn.140006554
test eax, eax
je 0x1401492c8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14025e018]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401492d0
xor eax, eax
jmp 0x14014932d
test rbx, rbx
jne 0x1401492f0
lea rcx, str.PrintDlgA
call fcn.140023cf8
mov rbx, rax
test rax, rax
je 0x1401492fb
mov qword [0x14026de50], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140149310
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140149312
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14014932b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140161688
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14025f760]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
cmp r8, 0x20
jne 0x14016172e
mov rcx, qword [rcx + 0x40]
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
lea rdx, [rsp + 0x20]
add eax, 4
mov rcx, rbx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x2c]
add eax, 0x17
mov dword [rsp + 0x24], eax
call fcn.1401628ac
mov rcx, rbx
call fcn.140161b40
mov rcx, qword [rbx + 0x40]
mov edx, 0xec1a
call qword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140192540
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor esi, esi
cmp dword [rcx + 0x458], esi
jne 0x14016174d
cmp r8, 0x79
je 0x140161744
cmp r8, 0x12
jne 0x140161749
mov esi, 1
mov eax, esi
jmp 0x14016170d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
shr ebp, 0xf
and ebp, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
cmp rdi, 0x12
je 0x140161782
cmp rdi, 0x79
jne 0x1401616fc
cmp qword [0x14026bf08], rsi
jne 0x14016170b
test byte [rbx + 0x478], 2
jne 0x14016170b
cmp rdi, 0x12
je 0x1401617b8
cmp rdi, 0x79
jne 0x14016170b
test ebp, ebp
jne 0x14016170b
test eax, eax
jne 0x14016170b
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.14001430c
cmp rax, rbx
jne 0x1401617dd
bt r15, 0x1e
jb 0x1401617dd
cmp rdi, 0x79
jne 0x1401617ed
mov rcx, r14
jmp 0x1401617e6
cmp rdi, 0x79
jne 0x1401617ed
mov rcx, rbx
call fcn.14001ae20
jmp 0x14016180d
cmp dword [rbx + 0x414], esi
jge 0x14016180d
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov edx, 0xec1a
mov r8d, 0xc8
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
jmp 0x14016170d

Function at 0x14019231c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1401923ad
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1401923ad
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401923ad
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140192391
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14019238b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140192393
add rdx, 0x28
jmp 0x140192370
xor edx, edx
test rdx, rdx
jne 0x14019239c
xor al, al
jmp 0x1401923b3
test dword [rdx + 0x24], 0x80000000
je 0x1401923a9
xor al, al
jmp 0x1401923b3
mov al, 1
jmp 0x1401923b3
xor al, al
jmp 0x1401923b3
add rsp, 0x18
ret
Function at 0x1401a5454
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401a5228
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401a5228
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401a5228
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401a5228
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401a5228
cmp dword [rcx + 0x84], 0xe
jbe 0x1401a5228
cmp dword [rcx + 0xf8], esi
je 0x1401a5228
mov ecx, r14d
call fcn.1401a5370
mov ecx, 2
call fcn.1401ab6d8
nop
cmp byte [0x14026fcc8], 0
jne 0x1401a52f2
mov r15d, 1
mov eax, r15d
xchg dword [0x14026fcb8], eax
test ebx, ebx
jne 0x1401a529b
mov rdi, qword [0x14025f760]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14026fcc0]
cmp rcx, rax
je 0x1401a5292
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400adfbc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14026fcf0]
jmp 0x1401a52a7
cmp ebx, r15d
jne 0x1401a52ad
lea rcx, [0x14026fd08]
call fcn.1401a5b70
nop
test ebx, ebx
jne 0x1401a52c4
lea rdx, [0x1401bf9c8]
lea rcx, [0x1401bf9a8]
call fcn.1401a6244
lea rdx, [0x1401bf9d8]
lea rcx, [0x1401bf9d0]
call fcn.1401a6244
movzx eax, byte [0x14026fcc8]
test esi, esi
cmove eax, r15d
mov byte [0x14026fcc8], al
jmp 0x1401a52f2
mov ecx, 2
call fcn.1401ab72c
test esi, esi
jne 0x1401a5309
mov ecx, r14d
call fcn.1401a5324
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1401a51b8
Function at 0x6c283210
Capabilities:
Inspect section memory permissions

Disassembly:
sub rsp, 0x28
test ecx, 0x40000000
mov dword [rdx], 0
jne 0x6c283290
test ch, 8
jne 0x6c283290
test cl, 8
jne 0x6c283290
test cl, 4
jne 0x6c283290
test cl, 0x40
jne 0x6c283290
test cl, 0x80
jne 0x6c283290
test ch, 0x20
jne 0x6c283290
test ecx, 0x20000000
jne 0x6c283290
test ch, 2
jne 0x6c283290
test ch, 0x80
jne 0x6c283290
test ch, 0x40
jne 0x6c283290
test cl, 1
jne 0x6c283290
test cl, 2
jne 0x6c283290
test cl, 0x10
jne 0x6c283290
test ch, 0x10
jne 0x6c283290
test ch, 4
jne 0x6c283290
test cl, 0x20
jne 0x6c283290
test ch, 1
jne 0x6c283290
mov eax, ecx
and eax, 0x10000
jne 0x6c283290
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x6c2857b0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rsi, rcx
mov r12, rdx
mov rbp, r9
call sym.fwrite
cmp rbx, rax
mov rdi, rax
je 0x6c285810
xor edx, edx
mov rcx, rbp
mov r8d, 1
call sym.fseek
mov rcx, rbx
sub rbx, rdi
mov r9, rbp
imul rcx, rdi
mov r8, rbx
mov rdx, r12
add rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.fwrite
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6c286630
Capabilities:
Hash data with crc32

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x100
test r8d, r8d
mov ebx, edx
mov esi, r8d
jle 0x6c28679c
lea r8, [rsp + 0x80]
lea r9, [rsp + 0x100]
mov dword [rsp + 0x80], 0xedb88320
mov edx, 1
lea rax, [r8 + 4]
mov dword [rax], edx
add rax, 4
add edx, edx
cmp r9, rax
jne 0x6c28666c
xor r11d, r11d
mov rdx, rsp
mov eax, dword [r8 + r11]
xor r10d, r10d
test eax, eax
je 0x6c28669f
mov r9, r8
nop dword [rax]
test al, 1
je 0x6c286697
xor r10d, dword [r9]
add r9, 4
shr eax, 1
jne 0x6c286690
mov dword [rdx + r11], r10d
add r11, 4
cmp r11, 0x80
jne 0x6c28667f
xor r11d, r11d
mov eax, dword [rdx + r11]
xor r10d, r10d
test eax, eax
je 0x6c2866d0
mov r9, rdx
test al, 1
je 0x6c2866c8
xor r10d, dword [r9]
add r9, 4
shr eax, 1
jne 0x6c2866c1
mov dword [r8 + r11], r10d
add r11, 4
cmp r11, 0x80
jne 0x6c2866b3
xor r11d, r11d
mov eax, dword [r8 + r11]
xor r10d, r10d
test eax, eax
je 0x6c286701
mov r9, r8
test al, 1
je 0x6c2866f9
xor r10d, dword [r9]
add r9, 4
shr eax, 1
jne 0x6c2866f2
mov dword [rdx + r11], r10d
add r11, 4
cmp r11, 0x80
jne 0x6c2866e4
test sil, 1
je 0x6c286732
test ecx, ecx
je 0x6c286732
mov eax, ecx
mov r9, rdx
xor ecx, ecx
test al, 1
je 0x6c28672a
xor ecx, dword [r9]
add r9, 4
shr eax, 1
jne 0x6c286723
mov edi, esi
sar edi, 1
je 0x6c28679a
xor r11d, r11d
nop dword [rax + rax]
mov eax, dword [rdx + r11]
xor r10d, r10d
test eax, eax
je 0x6c28675f
mov r9, rdx
nop
test al, 1
je 0x6c286757
xor r10d, dword [r9]
add r9, 4
shr eax, 1
jne 0x6c286750
mov dword [r8 + r11], r10d
add r11, 4
cmp r11, 0x80
jne 0x6c286740
and edi, 1
je 0x6c28678f
test ecx, ecx
je 0x6c28678f
mov eax, ecx
mov r9, r8
xor ecx, ecx
test al, 1
je 0x6c286787
xor ecx, dword [r9]
add r9, 4
shr eax, 1
jne 0x6c286780
sar esi, 2
test esi, esi
jne 0x6c2866e1
xor ecx, ebx
mov eax, ecx
add rsp, 0x100
pop rbx
pop rsi
pop rdi
ret
Function at 0x6c289400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rsp + 0x90]
mov ebp, dword [rsp + 0x80]
mov r12d, edx
mov rsi, rcx
mov edi, r9d
mov r14d, dword [rsp + 0x88]
mov edx, dword [rsp + 0x98]
test rax, rax
je 0x6c289680
cmp byte [rax], 0x31
jne 0x6c289680
cmp edx, 0x58
jne 0x6c289680
test rcx, rcx
je 0x6c289694
cmp qword [rcx + 0x30], 0
mov qword [rcx + 0x20], 0
je 0x6c289660
cmp qword [rsi + 0x38], 0
je 0x6c289650
cmp r12d, 0xffffffff
mov eax, 6
cmove r12d, eax
test edi, edi
js 0x6c289643
cmp edi, 0xf
mov r13d, 1
jg 0x6c289635
lea eax, [rbp - 1]
cmp eax, 8
ja 0x6c289694
lea eax, [rdi - 8]
cmp eax, 7
ja 0x6c289694
cmp r8d, 8
jne 0x6c289694
cmp r12d, 9
ja 0x6c289694
cmp r14d, 4
ja 0x6c289694
cmp edi, 8
mov eax, 9
mov rcx, qword [rsi + 0x40]
cmove edi, eax
mov r8d, 0x1720
mov edx, 1
call qword [rsi + 0x30]
test rax, rax
mov rbx, rax
je 0x6c2896c5
mov qword [rsi + 0x28], rax
mov dword [rax + 0x2c], r13d
mov r13d, 1
mov ecx, edi
mov r9d, r13d
mov qword [rax], rsi
shl r9d, cl
mov qword [rax + 0x30], 0
mov dword [rax + 0x48], edi
mov dword [rax + 0x44], r9d
lea eax, [r9 - 1]
lea ecx, [rbp + 7]
lea edx, [rbp + 9]
mov r8d, 2
mov dword [rbx + 0x4c], eax
mov eax, r13d
mov dword [rbx + 0x78], ecx
shl eax, cl
mov ecx, 0xaaaaaaab
mov dword [rbx + 0x74], eax
sub eax, 1
mov dword [rbx + 0x7c], eax
mov eax, edx
mul ecx
shr edx, 1
mov dword [rbx + 0x80], edx
mov edx, r9d
mov rcx, qword [rsi + 0x40]
call qword [rsi + 0x30]
mov edx, dword [rbx + 0x44]
mov qword [rbx + 0x50], rax
mov r8d, 2
mov rcx, qword [rsi + 0x40]
call qword [rsi + 0x30]
mov edx, dword [rbx + 0x74]
mov qword [rbx + 0x60], rax
mov r8d, 2
mov rcx, qword [rsi + 0x40]
call qword [rsi + 0x30]
lea ecx, [rbp + 6]
mov edx, r13d
mov qword [rbx + 0x68], rax
mov dword [rbx + 0x1718], 0
mov r8d, 4
shl edx, cl
mov dword [rbx + 0x16f0], edx
mov rcx, qword [rsi + 0x40]
call qword [rsi + 0x30]
mov edx, dword [rbx + 0x16f0]
cmp qword [rbx + 0x50], 0
mov qword [rbx + 0x10], rax
lea ecx, [rdx*4]
mov dword [rbx + 0x18], ecx
je 0x6c2896a0
cmp qword [rbx + 0x60], 0
je 0x6c2896a0
cmp qword [rbx + 0x68], 0
je 0x6c2896a0
test rax, rax
je 0x6c2896a0
mov ecx, edx
lea rdx, [rdx + rdx*2]
mov dword [rbx + 0xac], r12d
shr ecx, 1
mov dword [rbx + 0xb0], r14d
mov byte [rbx + 0x3c], 8
lea rcx, [rax + rcx*2]
add rax, rdx
mov qword [rbx + 0x16e8], rax
mov qword [rbx + 0x16f8], rcx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp dbg.deflateReset
sub edi, 0x10
mov r13d, 2
jmp 0x6c28949b
neg edi
xor r13d, r13d
jmp 0x6c28949b
mov rax, qword [dbg.zcfree]
mov qword [rsi + 0x38], rax
jmp 0x6c289477
mov rax, qword [dbg.zcalloc]
mov qword [rcx + 0x40], 0
mov qword [rcx + 0x30], rax
jmp 0x6c28946c
mov eax, 0xfffffffa
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 0xfffffffe
jmp 0x6c289685
mov rax, qword [sym.libMonoPosixHelper.dll_z_errmsg]
mov dword [rbx + 8], 0x29a
mov rcx, rsi
mov rax, qword [rax + 0x30]
mov qword [rsi + 0x20], rax
call dbg.deflateEnd
mov eax, 0xfffffffc
jmp 0x6c289685
mov eax, 0xfffffffc
jmp 0x6c289685
Function at 0x6c28fe30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rcx, r8
mov r8d, r9d
mov r9, rdx
mov edx, 1
call sym.fread
add rsp, 0x28
ret

Function at 0x6c28fe50
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rcx, r8
mov r8d, r9d
mov r9, rdx
mov edx, 1
call sym.fwrite
add rsp, 0x28
ret
Function at 0x6c291d00
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x40e8]
mov r9d, dword [rcx + 0xbc]
mov rsi, rcx
test eax, eax
je 0x6c291d83
test r9d, r9d
je 0x6c291d83
lea rbp, [rcx + 0xe0]
lea rdi, [rcx + 0x40ec]
xor r12d, r12d
mov r11, rbp
nop word [rax + rax]
movzx eax, word [rsi + 0x40f4]
movzx r8d, byte [r11]
mov rcx, rdi
mov rdx, qword [rsi + 0x40f8]
add r12d, 1
or eax, 2
mov ebx, eax
call dbg.update_keys
mov eax, ebx
xor eax, 1
imul eax, ebx
shr eax, 8
xor byte [r11], al
add r11, 1
mov r9d, dword [rsi + 0xbc]
cmp r9d, r12d
ja 0x6c291d40
jmp 0x6c291d8a
lea rbp, [rsi + 0xe0]
mov rdx, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x38]
mov r8, rbp
call qword [rsi + 0x10]
cmp dword [rsi + 0xbc], eax
mov dword [rsi + 0xbc], 0
setne al
movzx eax, al
neg eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6c29c270
Capabilities:
Create directory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
call sym.libMonoPosixHelper.dll_monoeg_g_path_get_dirname
test rax, rax
mov rbx, rax
je 0x6c29c28a
cmp byte [rax], 0
jne 0x6c29c295
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rax
call sym.strlen
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, rbx
mov qword [rsp + 0x20], 0
call dbg.monoeg_g_utf8_to_utf16
mov rcx, rbx
mov rsi, rax
call sym.libMonoPosixHelper.dll_monoeg_g_free
test rsi, rsi
je 0x6c29c28a
movzx eax, word [rsi]
test ax, ax
je 0x6c29c2fd
mov rdx, rsi
jmp 0x6c29c2df
add rdx, 2
movzx eax, word [rdx]
test ax, ax
je 0x6c29c2fa
cmp ax, 0x2f
jne 0x6c29c2d3
mov ecx, 0x5c
add rdx, 2
mov word [rdx - 2], cx
movzx eax, word [rdx]
test ax, ax
jne 0x6c29c2df
movzx eax, word [rsi]
mov rcx, rsi
jmp 0x6c29c305
movzx eax, word [rcx]
add rcx, 2
cmp ax, 0x5c
jne 0x6c29c302
mov rdi, qword [sym.imp.msvcrt.dll__wmkdir]
mov rbp, qword [sym.imp.msvcrt.dll__errno]
jmp 0x6c29c32c
mov eax, 0x5c
lea rcx, [rbx + 2]
mov word [rbx], ax
mov edx, 0x5c
call sym.wcschr
test rax, rax
mov rbx, rax
je 0x6c29c355
xor edx, edx
mov rcx, rsi
mov word [rax], dx
call rdi
test eax, eax
je 0x6c29c320
call rbp
cmp dword [rax], 0x11
je 0x6c29c320
jmp 0x6c29c369
mov rcx, rsi
call rdi
test eax, eax
je 0x6c29c380
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x11
je 0x6c29c380
mov rcx, rsi
call sym.libMonoPosixHelper.dll_monoeg_g_free
jmp 0x6c29c28a
mov rcx, rsi
call sym.libMonoPosixHelper.dll_monoeg_g_free
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6c29ca80
Capabilities:
Move file
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r13, rdx
mov edx, 0x5c
mov rsi, rcx
mov rbp, r8
mov r12, r9
call sym.strrchr
test rax, rax
je 0x6c29cc30
lea r9, [rax + 1]
mov rdx, r9
sub rdx, rsi
lea rcx, str._.s_s.tmp
mov r8, rsi
call dbg.monoeg_g_strdup_printf
lea rdx, [0x6c2a8055]
mov rcx, rax
mov rdi, rax
call sym.fopen
test rax, rax
mov rbx, rax
je 0x6c29cc40
test rbp, rbp
js 0x6c29cc00
mov rcx, r13
mov r9, rbx
mov r8, rbp
mov edx, 1
call sym.fwrite
cmp rbp, rax
mov rcx, rbx
jbe 0x6c29cb80
call sym.ferror
mov ecx, eax
call dbg.monoeg_g_strerror
mov rcx, rbx
mov rsi, rax
call sym.ferror
sub eax, 1
mov r8d, 0x18
cmp eax, 0x71
ja 0x6c29cb37
lea rdx, [0x6c2a8060]
movzx r8d, byte [rdx + rax]
lea r9, [0x6c2a8058]
lea rdx, str.FileError
mov rcx, r12
mov qword [rsp + 0x20], rsi
call dbg.monoeg_g_set_error
mov rcx, rdi
call sym.unlink
mov rcx, rdi
call sym.libMonoPosixHelper.dll_monoeg_g_free
mov rcx, rbx
call sym.fclose
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call sym.fclose
mov rdx, rsi
mov rcx, rdi
call sym.rename
test eax, eax
je 0x6c29cc10
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
mov ecx, dword [rax]
call dbg.monoeg_g_strerror
mov rsi, rax
call rbx
mov eax, dword [rax]
mov r8d, 0x18
sub eax, 1
cmp eax, 0x71
ja 0x6c29cbc5
lea rdx, [0x6c2a8060]
movzx r8d, byte [rdx + rax]
lea r9, [0x6c2a8058]
lea rdx, str.FileError
mov rcx, r12
mov qword [rsp + 0x20], rsi
call dbg.monoeg_g_set_error
mov rcx, rdi
call sym.unlink
mov rcx, rdi
call sym.libMonoPosixHelper.dll_monoeg_g_free
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, r13
call sym.strlen
mov rbp, rax
jmp 0x6c29caeb
mov rcx, rdi
call sym.libMonoPosixHelper.dll_monoeg_g_free
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r9, rsi
xor edx, edx
jmp 0x6c29cab5
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
mov ecx, dword [rax]
call dbg.monoeg_g_strerror
mov rsi, rax
call rbx
mov eax, dword [rax]
mov r8d, 0x18
sub eax, 1
cmp eax, 0x71
ja 0x6c29cc71
lea rdx, [0x6c2a8060]
movzx r8d, byte [rdx + rax]
lea r9, [0x6c2a8058]
lea rdx, str.FileError
mov rcx, r12
mov qword [rsp + 0x20], rsi
call dbg.monoeg_g_set_error
mov rcx, rdi
call sym.libMonoPosixHelper.dll_monoeg_g_free
xor eax, eax
jmp 0x6c29cb6c
Function at 0x6c29cca0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
test rcx, rcx
mov rdi, rdx
mov rbp, r8
mov rbx, r9
je 0x6c29ced0
test rdx, rdx
je 0x6c29cf03
test r9, r9
je 0x6c29cd20
cmp qword [r9], 0
je 0x6c29cd20
lea rax, [0x6c2a8130]
mov dword [rsp + 0x20], 0x3f
mov qword [rsp + 0x28], rax
lea r9, str.gfile_posix.c
lea r8, [0x6c2a80ee]
mov edx, 8
xor ecx, ecx
xor esi, esi
call dbg.monoeg_g_log
mov eax, esi
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rbp, rbp
mov qword [rdi], 0
je 0x6c29cd34
mov qword [rbp], 0
xor edx, edx
call sym.open
cmp eax, 0xffffffff
mov esi, eax
jne 0x6c29cd70
xor esi, esi
test rbx, rbx
je 0x6c29cd09
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sym.libMonoPosixHelper.dll_monoeg_g_file_error_from_errno
lea r8, str.Error_opening_file
mov edx, eax
xor ecx, ecx
call dbg.monoeg_g_error_new
mov qword [rbx], rax
jmp 0x6c29cd09
lea rdx, [rsp + 0x60]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__fstat64]
cmp eax, 0xffffffff
je 0x6c29ceb0
mov edx, dword [rsp + 0x60]
mov r13, qword [rsp + 0x78]
test eax, eax
mov dword [rsp + 0x30], edx
movzx edx, word [rsp + 0x64]
mov r12d, r13d
mov dword [rsp + 0x44], r13d
mov word [rsp + 0x34], dx
movzx edx, word [rsp + 0x66]
mov word [rsp + 0x36], dx
movzx edx, word [rsp + 0x68]
mov word [rsp + 0x38], dx
movzx edx, word [rsp + 0x6a]
mov word [rsp + 0x3a], dx
movzx edx, word [rsp + 0x6c]
mov word [rsp + 0x3c], dx
mov edx, dword [rsp + 0x70]
mov dword [rsp + 0x40], edx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x50], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rdx
je 0x6c29ce33
test rbx, rbx
je 0x6c29ce25
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sym.libMonoPosixHelper.dll_monoeg_g_file_error_from_errno
lea r8, str.Error_in_fstat__
mov edx, eax
xor ecx, ecx
call dbg.monoeg_g_error_new
mov qword [rbx], rax
mov ecx, esi
xor esi, esi
call sym.close
jmp 0x6c29cd09
lea ecx, [r13 + 1]
xor ebx, ebx
xor r15d, r15d
movsxd rcx, ecx
call sym.libMonoPosixHelper.dll_monoeg_malloc
mov r14, rax
nop word [rax + rax]
lea rdx, [r14 + r15]
mov r8d, r12d
mov ecx, esi
sub r8d, ebx
call sym.read
test eax, eax
jle 0x6c29ce71
add ebx, eax
cmp ebx, r12d
jge 0x6c29ce81
movsxd r15, ebx
jmp 0x6c29ce50
cmp eax, 0xffffffff
jne 0x6c29ce81
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x6c29ce50
mov ecx, esi
movsxd r13, r13d
call sym.close
test rbp, rbp
mov byte [r14 + r13], 0
je 0x6c29ce99
mov qword [rbp], r13
mov qword [rdi], r14
mov esi, 1
jmp 0x6c29cd09
lea rdx, [rsp + 0x30]
mov ecx, 6
xor eax, eax
mov rdi, rdx
rep stosq qword [rdi], rax
jmp 0x6c29ce00
lea rax, [0x6c2a810b]
lea r9, str.gfile_posix.c
lea r8, [0x6c2a80ee]
mov dword [rsp + 0x20], 0x3d
mov edx, 8
xor esi, esi
mov qword [rsp + 0x28], rax
call dbg.monoeg_g_log
jmp 0x6c29cd09
lea rax, str.contents___NULL
mov dword [rsp + 0x20], 0x3e
mov qword [rsp + 0x28], rax
jmp 0x6c29cced