joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180081a50
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
sub rsp, 0x28
xor ebp, ebp
mov r14, rcx
test rcx, rcx
je 0x180081b7c
xor ecx, ecx
mov qword [rsp + 0x58], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x180081b77
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x180081b77
movsxd rax, dword [r12 + 0x3c]
add rax, r12
je 0x180081b77
cmp dword [rax], 0x4550
jne 0x180081b77
mov qword [rsp + 0x40], rbx
mov ebx, dword [rax + 0x90]
add rbx, r12
je 0x180081b72
mov ecx, dword [rax + 0x94]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], r13
movabs rax, 0xcccccccccccccccd
mov esi, ebp
mul rcx
mov r13, rdx
shr r13, 4
test r13d, r13d
je 0x180081b68
add rbx, 0xc
mov qword [rsp + 0x50], rdi
cmp dword [rbx - 0xc], ebp
jne 0x180081aff
cmp dword [rbx + 4], ebp
je 0x180081b63
mov edi, dword [rbx]
add rdi, r12
je 0x180081b63
mov rdx, r14
mov rcx, rdi
call fcn.18004376c
test eax, eax
je 0x180081b5e
mov edx, 0x5c
mov rcx, rdi
call fcn.180038b64
mov r11, rax
test rax, rax
je 0x180081b51
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r11
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 1
jbe 0x180081b51
lea rcx, [r11 + 1]
mov rdx, r14
call fcn.18004376c
test eax, eax
je 0x180081b5e
inc esi
add rbx, 0x14
cmp esi, r13d
jb 0x180081af5
jmp 0x180081b63
mov ebp, 1
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov eax, ebp
add rsp, 0x28
pop r14
pop rbp
ret
Function at 0x1800825c0
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp eax, 1
jne 0x180082725
test rbx, rbx
je 0x180082725
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x280], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp ecx, 2
jle 0x18008271d
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x180082652
movabs rax, 0x5c003a0041
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
movzx eax, word [rbx]
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
jmp 0x18008271d
cmp word [rbx], 0x5c
jne 0x18008271d
cmp ax, 0x5c
jne 0x18008271d
mov qword [rsp + 0x278], rbp
mov qword [rsp + 0x250], r12
mov r12d, 0x5c
lea rcx, [rbx + 4]
mov edx, r12d
call fcn.1800389cc
mov rbp, rax
test rax, rax
je 0x18008270d
xor eax, eax
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], ax
call fcn.1800369b0
lea rcx, [rbp + 2]
mov edx, r12d
call fcn.1800389cc
test rax, rax
je 0x1800826dd
sub rax, rbx
sar rax, 1
lea ecx, [rax + 1]
cmp ecx, 0x104
jge 0x18008270d
movsxd r8, ecx
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.180036928
jmp 0x180082700
lea eax, [rdi + 1]
cmp eax, 0x104
jge 0x18008270d
movsxd rdi, edi
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
call fcn.180036928
mov word [rsp + rdi*2 + 0x30], r12w
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
mov rbp, qword [rsp + 0x278]
mov r12, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x280]
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180036980
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x180082800
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x18008282e
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov r9, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x180082aa0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.180020d00
test rbx, rbx
je 0x180082b31
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.1800369b0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.18001d4c0
mov eax, ebx
jmp 0x180082b33
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180036980
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
Function at 0x180082b60
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x180082b8e
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x180082bc0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.180020d00
xor esi, esi
test rbx, rbx
je 0x180082c4d
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
call fcn.1800369b0
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.18001d4c0
mov eax, ebx
jmp 0x180082c4f
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180036980
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180082d20
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x430
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.180020d00
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
dec eax
cmp eax, 0x3fe
ja 0x180082d95
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.18001d4c0
mov eax, 1
jmp 0x180082d97
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.180036980
mov rbx, qword [rsp + 0x450]
add rsp, 0x430
pop rdi
ret

Function at 0x180082e90
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.1800223e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
nop dword [rax]
test dword [rsi], edi
je 0x180082f20
movzx eax, word [0x1800d4768]
mov word [rsp + 0x50], ax
movzx eax, byte [0x1800d476a]
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
add byte [rsp + 0x50], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180020a90
nop
lea r8, [rsp + 0x60]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180022630
nop
lea rcx, [rsp + 0x60]
call fcn.18001d340
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180082ed0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180082f40
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.1800223e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
nop dword [rax]
test dword [rsi], edi
je 0x180082fd0
movzx eax, word [0x1800d4768]
mov word [rsp + 0x50], ax
movzx eax, byte [0x1800d476a]
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
add byte [rsp + 0x50], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180020a90
nop
lea r8, [rsp + 0x60]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180022630
nop
lea rcx, [rsp + 0x60]
call fcn.18001d340
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180082f80
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x180082ff0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.1800228f0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
test dword [rsi], edi
je 0x180083089
mov eax, dword [0x1800d47c0]
mov dword [rsp + 0x30], eax
movzx eax, word [0x1800d47c4]
mov word [rsp + 0x34], ax
xor eax, eax
mov word [rsp + 0x36], ax
add word [rsp + 0x30], bx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180021640
nop
lea r8, [rsp + 0x20]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180022b40
nop
lea rcx, [rsp + 0x20]
call fcn.18001eca0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180083038
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180036980
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800830c0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r12, rdx
mov rbp, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.1800223e0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r12
call fcn.1800223e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, 1
xor ebx, ebx
nop
test esi, edi
je 0x1800831e1
movzx eax, word [0x1800d4768]
mov word [rsp + 0x20], ax
movzx eax, byte [0x1800d476a]
mov byte [rsp + 0x22], al
xor eax, eax
mov byte [rsp + 0x23], al
add byte [rsp + 0x20], bl
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180020a90
nop
lea r8, [rsp + 0x30]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180022630
mov r11, qword [0x1800cb850]
mov qword [rsp + 0x28], r11
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.1800369b0
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov byte [rsp + 0x143], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.18001d4c0
lea r8, [rsp + 0x28]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.180022630
nop
lea rcx, [rsp + 0x28]
call fcn.18001d340
nop
lea rcx, [rsp + 0x30]
call fcn.18001d340
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180083120
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180036980
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180083220
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r12, rdx
mov rbp, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.1800223e0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r12
call fcn.1800223e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, 1
xor ebx, ebx
nop
test esi, edi
je 0x180083341
movzx eax, word [0x1800d4768]
mov word [rsp + 0x20], ax
movzx eax, byte [0x1800d476a]
mov byte [rsp + 0x22], al
xor eax, eax
mov byte [rsp + 0x23], al
add byte [rsp + 0x20], bl
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180020a90
nop
lea r8, [rsp + 0x30]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180022630
mov r11, qword [0x1800cb850]
mov qword [rsp + 0x28], r11
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.1800369b0
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov byte [rsp + 0x143], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.18001d4c0
lea r8, [rsp + 0x28]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.180022630
nop
lea rcx, [rsp + 0x28]
call fcn.18001d340
nop
lea rcx, [rsp + 0x30]
call fcn.18001d340
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180083280
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180036980
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180083380
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2a0], rbx
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, rdx
mov rbp, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.1800228f0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r12
call fcn.1800228f0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, 1
xor r13d, r13d
mov ebx, r13d
test esi, edi
je 0x1800834a8
mov eax, dword [0x1800d47c0]
mov dword [rsp + 0x38], eax
movzx eax, word [0x1800d47c4]
mov word [rsp + 0x3c], ax
xor eax, eax
mov word [rsp + 0x3e], ax
add word [rsp + 0x38], bx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.180021640
nop
lea r8, [rsp + 0x28]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180022b40
mov r11, qword [0x1800cb858]
mov qword [rsp + 0x20], r11
mov word [rsp + 0x40], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.1800369b0
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov word [rsp + 0x246], r13w
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.18001ee20
lea r8, [rsp + 0x20]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.180022b40
nop
lea rcx, [rsp + 0x20]
call fcn.18001eca0
nop
lea rcx, [rsp + 0x28]
call fcn.18001eca0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800833e4
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180036980
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800838b0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.1800223e0
or r8d, 0xffffffff
xor edx, edx
mov rcx, rdi
call fcn.1800223e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov ecx, dword [0x180123084]
test ecx, ecx
je 0x180083961
cmp eax, ecx
jne 0x180083961
mov eax, dword [0x180123088]
test eax, eax
je 0x180083961
cmp ebx, eax
jb 0x180083961
add eax, 0x493e0
cmp eax, ebx
jb 0x180083961
inc dword [0x18012308c]
mov r8d, 1
lea rdx, [0x180123138]
lea rcx, [rsp + 0x28]
call fcn.1800267f0
nop
lea rdx, [0x180123108]
mov rcx, rsi
call fcn.180022550
lea rdx, [0x180123120]
mov rcx, rdi
call fcn.180022550
nop
jmp 0x1800839dd
mov dword [0x18012308c], 0
mov rdx, rdi
mov rcx, rsi
call fcn.180083220
mov r8d, 1
lea rdx, [0x180123138]
lea rcx, [rsp + 0x28]
call fcn.1800267f0
nop
mov dword [0x180123084], ebp
mov dword [0x180123088], ebx
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180123108]
call fcn.1800223e0
mov rdx, rsi
lea rcx, [0x180123108]
call fcn.180022550
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180123120]
call fcn.1800223e0
mov rdx, rdi
lea rcx, [0x180123120]
call fcn.180022550
nop
lea rcx, [rsp + 0x28]
call fcn.180026870
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180083a10
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.1800228f0
or r8d, 0xffffffff
xor edx, edx
mov rcx, rdi
call fcn.1800228f0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov ecx, dword [0x180123090]
test ecx, ecx
je 0x180083ac1
cmp eax, ecx
jne 0x180083ac1
mov eax, dword [0x180123094]
test eax, eax
je 0x180083ac1
cmp ebx, eax
jb 0x180083ac1
add eax, 0x493e0
cmp eax, ebx
jb 0x180083ac1
inc dword [0x180123098]
mov r8d, 1
lea rdx, [0x1801231a0]
lea rcx, [rsp + 0x28]
call fcn.1800267f0
nop
lea rdx, [0x180123170]
mov rcx, rsi
call fcn.180022a60
lea rdx, [0x180123188]
mov rcx, rdi
call fcn.180022a60
nop
jmp 0x180083b3d
mov dword [0x180123098], 0
mov rdx, rdi
mov rcx, rsi
call fcn.180083380
mov r8d, 1
lea rdx, [0x1801231a0]
lea rcx, [rsp + 0x28]
call fcn.1800267f0
nop
mov dword [0x180123090], ebp
mov dword [0x180123094], ebx
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180123170]
call fcn.1800228f0
mov rdx, rsi
lea rcx, [0x180123170]
call fcn.180022a60
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180123188]
call fcn.1800228f0
mov rdx, rdi
lea rcx, [0x180123188]
call fcn.180022a60
nop
lea rcx, [rsp + 0x28]
call fcn.180026870
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180083d40
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov rbx, rcx
lea rdx, [rcx + 8]
mov r8d, 1
lea rcx, [rsp + 0x38]
call fcn.1800267f0
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x180083dcd
test rsi, rsi
je 0x180083dcd
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r11d, r11d
mov dword [rsp + 0x60], r11d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x60]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0x38]
call fcn.180026870
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1800843e0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x438
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x420], rax
cmp dword [0x1801231e0], 0
je 0x180084440
mov r8, rcx
mov byte [rsp + 0x20], 0
lea r9, [r11 + 0x10]
lea rcx, [rsp + 0x20]
mov edx, 0x3ff
mov byte [r11 - 0x19], 0
call fcn.180047420
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.180036980
add rsp, 0x438
ret
Function at 0x180087f30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call fcn.180087cc0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea r8d, [r9 + 7]
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rdi + 0x20], 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x180087fc1
test rax, rax
je 0x180087fc1
lea rdx, [rdi + 0x14]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rdi + 8]
lea r9, [rdi + 0x43c]
lea rdx, [rdi + 0x3c]
mov r8d, 0x400
mov dword [rdi + 0x10], eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180087fc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1800880a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov esi, r8d
mov edi, edx
mov rbx, rcx
cmp rax, 0xffffffffffffffff
je 0x1800881cb
test rax, rax
je 0x1800881cb
mov qword [rsp + 0x60], r12
lea r9, [rsp + 0x50]
xor r12d, r12d
mov edx, edi
mov qword [rsp + 0x50], r12
call fcn.180087de0
mov r10, qword [rsp + 0x50]
cmp r10, qword [rcx + 0x10]
jg 0x18008815d
cmp dword [rsp + 0x54], r12d
jne 0x180088110
mov eax, dword [rcx + 0x43c]
cmp dword [rsp + 0x50], eax
ja 0x180088110
lea rax, [rdi + rcx + 0x3c]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov r11, qword [rbx + 0x28]
test r11, r11
je 0x18008814e
mov edx, dword [rbx + 0x38]
mov r8d, dword [rbx + 0x34]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], r12
call fcn.180087de0
cmp edx, edi
ja 0x18008814e
cmp r10, qword [rsp + 0x50]
jg 0x18008814e
mov r12, qword [rsp + 0x60]
sub edi, edx
mov eax, edi
add rax, r11
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov edx, esi
mov rcx, rbx
call fcn.180087d70
test rax, rax
jne 0x18008816c
xor eax, eax
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov edx, edi
mov rcx, rbx
mov qword [rsp + 0x58], rbp
call fcn.180087e10
test eax, eax
je 0x1800881bb
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x34]
mov r8d, esi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800881bb
cmp dword [rbx + 0x34], esi
jne 0x1800881bb
mov rax, qword [rbx + 0x28]
mov dword [rbx + 0x38], edi
mov rbp, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov qword [rbx + 0x34], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
xor eax, eax
jmp 0x1800881a9
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800884a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
xor r13d, r13d
mov ebp, r13d
cmp dword [rcx + 0x30], ebp
je 0x1800884ce
call fcn.18006b510
mov rbp, rax
mov edx, 0xc0000000
mov eax, 0x80000000
cmp dword [rbx + 0x28], r13d
cmovne edx, eax
mov dword [rsp + 0x90], r13d
mov esi, r13d
mov rcx, qword [rbx + 0x38]
cmp dword [rcx - 8], r13d
je 0x180088552
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov r9, rbp
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x180088535
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp qword [rbx + 8], 0xffffffffffffffff
je 0x1800886a9
cmp dword [rsp + 0x90], r13d
jne 0x180088552
test esi, esi
je 0x1800886a9
mov r14d, 4
mov r12d, r14d
mov eax, 2
cmp dword [rbx + 0x28], r13d
cmovne r12d, eax
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x98]
call fcn.180020a50
nop
cmp dword [rbx + 0x2c], 0
je 0x1800885b8
mov rax, qword [rbx + 0x40]
cmp dword [rax - 8], 0
je 0x1800885b8
call fcn.18002c390
test eax, eax
je 0x1800885b8
lea rdx, str.Global_
lea rcx, [rsp + 0x98]
call fcn.18001d4c0
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x98]
call fcn.18001d680
mov rax, qword [rsp + 0x98]
cmp dword [rax - 8], 0
cmove rax, r13
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18008869c
mov edx, 6
cmp dword [rbx + 0x28], 0
cmovne edx, r14d
mov ecx, dword [rbx + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbx + 0x24]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18008869a
cmp dword [rbx + 0x20], 0
jne 0x180088686
cmp qword [rbx + 8], 0xffffffffffffffff
je 0x180088686
mov dword [rsp + 0xa0], esi
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0xa4], eax
mov eax, dword [rbx + 0x24]
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xac], r13d
mov rcx, qword [rsp + 0xa0]
sub rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xa0], rcx
shr rcx, 0x20
mov edx, dword [rsp + 0xa0]
or r8d, 0xffffffff
test ecx, ecx
cmovg edx, r8d
mov dword [rbx + 0x20], edx
lea rcx, [rsp + 0x98]
call fcn.18001d340
mov eax, 1
jmp 0x1800886ac
jmp 0x18008869c
lea rcx, [rsp + 0x98]
call fcn.18001d340
mov eax, r13d
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret