joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802906b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor r8d, r8d
lea rdx, [rsp + 0x30]
call fcn.180290770
test byte [rbx + 0x138], 8
jne 0x1802906f5
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x1802906f5
cmp eax, 0xffffffff
je 0x1802906f5
xor bl, bl
jmp 0x18029072f
mov eax, dword [rbx + 0x138]
shr eax, 1
test al, 1
jne 0x18029072d
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
je 0x180290729
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
jne 0x18029072d
xor bl, bl
jmp 0x18029072f
mov bl, 1
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
lea rax, [0x180660020]
cmp rcx, rax
je 0x180290759
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x180290759
call fcn.18011d9c0
movzx eax, bl
add rsp, 0x20
pop rbx
ret
Function at 0x1802921e0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], r14
mov rbx, rcx
mov r14, rdx
mov rdx, qword [rcx + 0x58]
cmp qword [r14], rdx
je 0x180292321
mov rcx, qword [r14]
call fcn.18001c500
test eax, eax
je 0x180292321
mov qword [rsp + 0x40], rbp
lea rdx, [rbx + 0x48]
mov qword [rsp + 0x28], rdi
mov ebp, 1
xor edi, edi
mov eax, ebp
xchg byte [rbx + 0xc0], al
mov rcx, qword [rbx + 0x68]
test rbx, rbx
cmove rdx, rdi
call fcn.1801736c0
mov eax, edi
xchg byte [rbx + 0xc1], al
cmp dword [rbx + 0xb4], edi
je 0x1802922ae
lea rcx, [rbx + 0xa8]
mov qword [rsp + 0x48], rsi
call fcn.1800c3140
cmp dword [rbx + 0xb0], edi
je 0x180292277
mov rcx, qword [rbx + 0xa8]
call fcn.180124068
mov qword [rbx + 0xa8], rdi
mov rsi, qword [rsp + 0x48]
mov dword [rbx + 0xb0], edi
movzx eax, byte [rbx + 0x40]
nop
test al, al
je 0x1802922ae
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], ebp
jne 0x1802922ae
mov rcx, qword [rbx + 0x10]
call fcn.1801f8f30
test al, al
jne 0x1802922ae
mov rcx, qword [rbx + 0x10]
mov eax, edi
xchg dword [rcx + 0x18], eax
mov rax, qword [r14]
lea rdx, [0x180660020]
sub rax, 0x10
cmp rax, rdx
je 0x1802922c4
lock inc dword [rax]
mov rcx, qword [r14]
xchg qword [rbx + 0x58], rcx
add rcx, 0xfffffffffffffff0
cmp rcx, rdx
je 0x1802922e9
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1802922e9
call fcn.18011d9c0
movzx eax, byte [rbx + 0x40]
nop
test al, al
je 0x180292313
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], ebp
jne 0x180292313
mov rcx, qword [rbx + 0x10]
call fcn.1801f8f30
test al, al
jne 0x180292313
mov rax, qword [rbx + 0x10]
xchg dword [rax + 0x18], edi
and dword [rbx + 0x70], 0xfffffffc
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x40]
mov ecx, dword [rbx + 0x70]
mov r14, qword [rsp + 0x20]
or ecx, 3
cmp dword [rbx + 0x70], ecx
je 0x180292341
mov dword [rbx + 0x70], ecx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.180291f40
add rsp, 0x30
pop rbx
ret

Function at 0x180292570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x58
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x18029261c
lea rcx, [rsp + 0x40]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x18029261c
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rbx
call fcn.180120224
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180067e60
nop
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x40], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
call fcn.1800cfc60
nop
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x18029261c
mov ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
cmp ecx, 1
jne 0x18029261c
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180292670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rdx + 0x10]
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov rdi, rdx
add rcx, 0x18
mov r9b, 1
mov edx, dword [rbx + 0x140]
call fcn.18024c2b0
mov rcx, qword [rbx + 0x110]
lea rdx, [rbx + 0x120]
add rcx, 0x168
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180292670
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x58
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x180292729
lea rcx, [rsp + 0x50]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x180292729
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rbx
call fcn.180120224
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180067e60
nop
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x68]
call fcn.1800cfa80
nop
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x180292729
mov ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
cmp ecx, 1
jne 0x180292729
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1802a83e0
Capabilities:
Create process on windows

Disassembly:
add rcx, 0x220
mov rax, qword [rcx]
cmp byte [rax], 0
jne fcn.180158d00
ret

Function at 0x1802af600
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
xor esi, esi
call fcn.1802ae710
test rax, rax
je 0x1802af647
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1800c58d0
mov rdx, qword [rax]
mov qword [rax], rsi
mov qword [r14], rdx
lea rcx, [rsp + 0x70]
call fcn.18022b3e0
jmp 0x1802af785
mov eax, dword [rdi + 0x24]
lea r15, [0x180660020]
cmp eax, 3
jne 0x1802af65a
mov ebp, eax
jmp 0x1802af6b5
cmp eax, 2
jne 0x1802af6b3
lea rcx, [rdi + 0x18]
xor edx, edx
call fcn.180193250
mov rcx, qword [rax]
lea rbx, [rcx - 0x10]
cmp rbx, r15
je 0x1802af679
lock inc dword [rbx]
lea rdx, [0x1805afb28]
call fcn.1800203e0
mov ebp, 4
mov ecx, 1
test eax, eax
cmove ebp, ecx
cmp rbx, r15
je 0x1802af6b5
mov eax, 0xffffffff
lock xadd dword [rbx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1802af6b5
mov rcx, rbx
call fcn.18011d9c0
jmp 0x1802af6b5
mov ebp, esi
mov ecx, 0x40
call fcn.18011dae8
mov rbx, rax
mov qword [rsp + 0x70], rax
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1802af6d6
mov rdx, qword [rax + 0x10]
jmp 0x1802af6d9
mov rdx, rsi
lea rax, vtable.._AVWindowsMessageBoxBase__1__create_ScopedMessageBoxInterface_detail_juce__SA_AV__unique_ptr_UScopedMessageBoxInterface_detail_juce__U__default_delete_UScopedMessageBoxInterface_detail_juce___std___std__AEBVMessageBoxOptions_4__Z_.0
mov qword [rbx], rax
lea rcx, [rbx + 8]
call fcn.180067e60
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov byte [rbx + 0x20], 0
lea rax, vtable.._AVPreVistaMessageBox__1__create_ScopedMessageBoxInterface_detail_juce__SA_AV__unique_ptr_UScopedMessageBoxInterface_detail_juce__U__default_delete_UScopedMessageBoxInterface_detail_juce___std___std__AEBVMessageBoxOptions_4__Z_.0
mov qword [rbx], rax
mov esi, dword [rdi]
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rcx, [0x1802b2960]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [rsp + 0x70]
neg al
sbb ecx, ecx
and ecx, 0x40000
sub esi, 1
je 0x1802af74e
sub esi, 1
je 0x1802af747
cmp esi, 1
je 0x1802af740
mov eax, 0x12000
jmp 0x1802af753
mov eax, 0x12040
jmp 0x1802af753
mov eax, 0x12030
jmp 0x1802af753
mov eax, 0x12020
or ecx, ebp
or ecx, eax
mov dword [rbx + 0x28], ecx
mov rax, qword [rdi + 8]
mov qword [rbx + 0x30], rax
add rax, 0xfffffffffffffff0
cmp rax, r15
je 0x1802af76e
lock inc dword [rax]
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x38], rax
add rax, 0xfffffffffffffff0
cmp rax, r15
je 0x1802af782
lock inc dword [rax]
mov qword [r14], rbx
mov rax, r14
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802b0990
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rax, [0x180660030]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1802b0a4c
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1802b0a46
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1802b0a46
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.18001d650
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x48]
mov qword [rbx], rcx
lea rcx, [rax - 0x10]
lea rax, [0x180660020]
cmp rcx, rax
je 0x1802b0a3d
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1802b0a3d
call fcn.18011d9c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1802b0a70
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1802b0b0e
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1802b0b02
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rbx
call fcn.18001ec10
mov rbx, rax
add rbx, 4
je 0x1802b0afd
lea rdx, [rbx + 2]
mov qword [rsp + 0x38], rdi
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1802b0af8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1802b0af8
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1801790c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rsi
ret
Function at 0x1802b2560
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x1802b2590
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1802b2593
mov rax, rbx
lea rcx, str.SHCore.dll
mov qword [0x1806862c8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.SHCore.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1802b2739
lea rdx, [0x1803b3730]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetProcessDpiAwareness
mov rcx, rdi
mov qword [0x180686340], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x180686310], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1802b2612
lea rdx, [0x1803b37a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1802b2615
mov rax, rbx
lea rdx, str.GetProcessDpiAwareness
mov qword [0x1806862d0], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x180686300], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1802b2657
lea rdx, [0x1803b3768]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1802b265a
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x180686328], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1802b2683
lea rdx, [0x1803b3748]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1802b26a7
lea rdx, [0x1803b3818]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1802b26aa
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x180686338], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1802b26d5
lea rdx, [0x1803b37f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1802b26d8
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x1806862f0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1802b2703
lea rdx, str.SetProcessDpiAwarenessContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1802b2706
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x1806862e0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1802b2732
lea rdx, str.EnableNonClientDpiScaling
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1806862d8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1802d6cb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
movzx esi, r9b
mov rdi, r8
mov rcx, rdx
call fcn.1802db270
mov rbx, rax
test rax, rax
je 0x1802d6d33
mov dword [rsp + 0x24], 0
mov r9, rax
mov edx, 4
mov r8d, 1
lea rcx, [rsp + 0x24]
call fcn.180132284
cmp byte [rsp + 0x24], 0x4d
je 0x1802d6d57
cmp byte [rsp + 0x25], 0x53
je 0x1802d6d57
cmp byte [rsp + 0x26], 0x45
je 0x1802d6d57
cmp byte [rsp + 0x27], 0x20
je 0x1802d6d57
mov rcx, rbx
call fcn.180135404
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.18011d9a0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x28], 0
mov r9, rbx
mov edx, 4
mov r8d, 1
lea rcx, [rsp + 0x28]
call fcn.180132284
mov byte [rsp + 0x20], 1
mov r9, rbx
mov edx, 1
mov r8d, edx
lea rcx, [rsp + 0x20]
call fcn.180132284
mov r8d, 0x400
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1802db190
nop
mov r8d, 0x400
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1802db190
nop
test sil, sil
je 0x1802d6de0
lea rax, [rsp + 0x30]
cmp rdi, rax
je 0x1802d6e08
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
jmp 0x1802d6e00
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x1802d6e08
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1800dc420
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x70]
call fcn.18037f450
mov r9, rbx
mov edx, 0x250
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.180132284
mov rcx, rbx
call fcn.180135404
mov ebx, dword [rbp - 0x2c]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1802d6e77
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1802d6e71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1802d6ebd
call fcn.18011d9c0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1802d6eb0
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1802d6eab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1802d6eb7
call fcn.18011d9c0
mov eax, ebx
jmp 0x1802d6d35
call fcn.180124488
nop
call fcn.180124488
int3
Function at 0x1802d8d00
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rax, vtable.MInstrument.0
mov qword [rcx], rax
mov byte [rcx + 0x890], 1
mov rcx, qword [rcx + 0x8a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8, qword [0x180686190]
mov rcx, r8
mov r9, qword [0x180686188]
sub rcx, r9
sar rcx, 3
test ecx, ecx
jle 0x1802d8d74
mov rax, r9
cmp qword [rax], rbx
je 0x1802d8d59
inc edx
add rax, 8
cmp edx, ecx
jl 0x1802d8d48
jmp 0x1802d8d74
movsxd rax, edx
lea rcx, [r9 + rax*8]
lea rdx, [rcx + 8]
sub r8, rdx
call fcn.18037edb0
sub qword [0x180686190], 8
mov eax, dword [0x18067b534]
dec eax
mov dword [0x18067b534], eax
test eax, eax
jg 0x1802d8dc9
mov byte [0x18067b4cb], 1
xor r8d, r8d
mov edx, 1
mov rcx, qword [0x180680048]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [0x18067b538]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x18067b538]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1802d6680
mov rcx, rbx
call fcn.1802d5f50
lea rcx, [rbx + 0x19db8]
call fcn.1800dc150
lea rax, vtable.MLFO.0
mov qword [rbx + 0x8b8], rax
lea rcx, [rbx + 0x360]
call fcn.1800dc390
lea rcx, [rbx + 0x348]
call fcn.18002b2f0
lea rcx, [rbx + 0x330]
call fcn.18002b2f0
lea rcx, [rbx + 0x318]
call fcn.18002b2f0
lea rcx, [rbx + 0x300]
call fcn.18002b2f0
lea rcx, [rbx + 0x2e8]
call fcn.18002b2f0
lea rcx, [rbx + 0x2c8]
call fcn.18000c780
lea rcx, [rbx + 0x2a8]
call fcn.18000c780
lea rcx, [rbx + 0x278]
call fcn.18000c780
lea rcx, [rbx + 0x258]
add rsp, 0x20
pop rbx
jmp fcn.18000c780
Function at 0x1802db190
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov rbp, rcx
mov qword [rsp + 0x60], r14
movsxd r14, r8d
mov rcx, r14
mov qword [rsp + 0x30], r15
mov r15, rdx
call fcn.18011de94
mov r8, r14
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.18037f450
mov edx, 1
mov r9, r15
mov r8d, edx
mov rcx, rdi
xor ebx, ebx
call fcn.180132284
cmp byte [rdi], bl
je 0x1802db212
mov qword [rsp + 0x58], rsi
mov rsi, rdi
cmp ebx, r14d
jge 0x1802db20d
mov edx, 1
inc ebx
movsxd rcx, ebx
mov r9, r15
add rcx, rdi
mov r8d, edx
inc rsi
call fcn.180132284
cmp byte [rsi], 0
jne 0x1802db1e8
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x30]
xorps xmm0, xmm0
mov r14, qword [rsp + 0x60]
mov r8, 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
nop
inc r8
cmp byte [rdi + r8], 0
jne 0x1802db240
mov rdx, rdi
mov rcx, rbp
call fcn.18000caf0
mov rcx, rdi
call fcn.18011d9c0
mov rax, rbp
add rsp, 0x38
pop rdi
pop rbp
ret
Function at 0x1802dbec0
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
sub rsp, 0xa0
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm1, xmm1
mov dword [rsp + 0x70], 0x67452301
xor eax, eax
mov dword [rsp + 0x74], 0xefcdab89
xorps xmm0, xmm0
mov dword [rsp + 0x78], 0x98badcfe
movups xmmword [rcx], xmm0
mov rbp, rcx
mov dword [rsp + 0x7c], 0x10325476
movzx ecx, byte [rdx]
mov rbx, rdx
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm1
mov qword [r11 - 0x28], rax
test cl, cl
je 0x1802dc068
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
nop dword [rax]
inc rbx
movzx eax, cl
test cl, cl
jns 0x1802dbfa2
mov ecx, 0x40
xor r8d, r8d
mov edx, 0x7f
test cl, al
je 0x1802dbf70
nop dword [rax + rax]
cmp ecx, 8
jbe 0x1802dbf70
shr edx, 1
inc r8d
shr ecx, 1
test eax, ecx
jne 0x1802dbf60
and eax, edx
sub r8d, 1
js 0x1802dbfa2
nop dword [rax + rax]
movzx edx, byte [rbx]
mov ecx, edx
and cl, 0xc0
cmp cl, 0x80
jne 0x1802dbfa2
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
or eax, ecx
inc rbx
sub r8d, 1
jns 0x1802dbf80
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x80]
mov ecx, eax
shr ecx, 3
add eax, 0x20
and ecx, 0x3f
mov dword [rsp + 0x80], eax
cmp eax, 0x20
jae 0x1802dbfcb
inc dword [rsp + 0x84]
mov eax, ecx
mov edi, 0x40
sub rdi, rax
xor esi, esi
cmp rdi, 4
ja 0x1802dc02f
lea rcx, [rsp + 0x30]
mov r8, rdi
add rcx, rax
lea rdx, [rsp + 0x20]
call fcn.18037edb0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.1800dcda0
mov rsi, rdi
add rdi, 0x40
cmp rdi, 4
ja 0x1802dc02d
nop
lea rdx, [rsp + rdi - 0x20]
lea rcx, [rsp + 0x30]
call fcn.1800dcda0
add rsi, 0x40
add rdi, 0x40
cmp rdi, 4
jbe 0x1802dc010
xor ecx, ecx
lea rax, [rsp + 0x30]
mov r8d, 4
lea rdx, [rsp + 0x20]
sub r8, rsi
add rdx, rsi
add rcx, rax
call fcn.18037edb0
movzx ecx, byte [rbx]
test cl, cl
jne 0x1802dbf40
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.1800dd6b0
mov rax, rbp
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18011d9a0
mov rbx, qword [rsp + 0xc8]
add rsp, 0xa0
pop rbp
ret

Function at 0x1802dd7f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1802dd670
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1802dd816
cmp byte [rax + 8], 0
jne 0x1802dd816
xor bl, bl
jmp 0x1802dd862
lea rdx, [rdi + 0xe0]
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x1802dd85a
lea rcx, [rsp + 0x40]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1802dd85a
mov rcx, rdi
call fcn.1802dcbf0
test al, al
jne 0x1802dd85a
mov rcx, rdi
call fcn.1802dd1c0
test al, al
jne 0x1802dd85a
xor bl, bl
jmp 0x1802dd85c
mov bl, 1
mov byte [rdi + 0x120], bl
lea rcx, [rsp + 0x38]
call fcn.1800dec80
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18030a0f0
Capabilities:
Read file on windows

Disassembly:
cmp dword [rcx + 0x40], 2
mov rax, rdx
jne 0x18030a10c
movsxd rdx, dword [rcx + 0x48]
mov r9, qword [rcx + 0x28]
add rdx, rdx
mov rcx, rax
jmp fcn.180132284
xor eax, eax
ret
Function at 0x18030a430
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test r8, r8
je 0x18030a493
mov qword [rcx + 0x28], r8
lea rdx, [rsp + 0x40]
mov qword [rcx + 0x30], r9
mov rcx, r8
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r9
call fcn.1801354e8
mov r9, qword [rdi + 0x28]
lea rcx, [rdi + 0x40]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov r8d, 1
call fcn.180132284
mov eax, dword [rdi + 0x40]
mov rbx, qword [rsp + 0x30]
sub eax, 2
test eax, 0xfffffffd
jne 0x18030a493
mov byte [rdi + 0x38], 1
mov al, 1
add rsp, 0x20
pop rdi
ret
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x18030b480
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, qword [rcx + 0x28]
mov rbx, rcx
test r8, r8
je 0x18030b589
mov r10, qword [rcx + 0x58]
mov r9, r10
mov qword [rsp + 0x48], rbp
imul r9, rdi
mov qword [rsp + 0x50], rsi
cmp r9, 0x40998
jbe 0x18030b4cc
xor edx, edx
mov eax, 0x40998
div r10
mov rsi, rax
jmp 0x18030b4cf
mov rsi, rdi
mov ecx, dword [rcx + 0x40]
sub rdi, rsi
sub ecx, 1
je 0x18030b529
sub ecx, 1
je 0x18030b513
cmp ecx, 1
jne 0x18030b50c
mov r9, r8
lea rcx, [0x180686390]
mov r8, rsi
mov rdx, r10
call fcn.180132284
mov r9, rsi
mov r8, r14
mov rcx, rbx
mov rbp, rax
call fcn.18030a510
jmp 0x18030b54f
mov rbp, qword [rsp + 0x40]
jmp 0x18030b54f
mov r9, r8
mov rdx, r10
mov r8, rsi
mov rcx, r14
call fcn.180132284
mov rbp, rax
jmp 0x18030b54f
mov r9, r8
lea rcx, [0x180686390]
mov r8, rsi
mov rdx, r10
call fcn.180132284
mov r9, rsi
mov r8, r14
mov rcx, rbx
mov rbp, rax
call fcn.18030a820
test rdi, rdi
je 0x18030b573
mov rax, qword [rbx]
mov r8, rdi
mov rcx, rbx
mov r9, qword [rax + 0x28]
movsxd rax, dword [rbx + 0x38]
imul rax, rsi
lea rdx, [r14 + rax*2]
call r9
add rbp, rax
mov rsi, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret