joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18016b790
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rbx, rcx
call fcn.1801dbd90
test al, al
jne 0x18016b7d4
mov al, 1
jmp 0x18016b9c5
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18016b7e1
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18016b7f6
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18016b7cd
xor edi, edi
cmp qword [rsi + 0x10], rdi
je 0x18016b8e3
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.180037a20
nop
lea edx, [rdi + 0x10]
lea rcx, [rbp - 1]
call fcn.1801da860
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.1801dcc70
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x18016b83f
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 1]
call fcn.180033c20
nop
lea rcx, [rbp - 0x21]
call fcn.1800338a0
mov esi, 1
nop dword [rax + rax]
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], di
xor r8d, r8d
lea rdx, [0x1803722e0]
lea rcx, [rbp - 0x49]
call fcn.180033930
nop
lea r8, [rbp - 1]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x21]
call fcn.18016b520
nop
lea rcx, [rbp - 0x49]
call fcn.1800338a0
cmp qword [rbp - 0x11], 0
je 0x18016b8be
lea rdx, [rbp - 0x21]
mov rcx, rbx
call fcn.1801f0450
test al, al
jne 0x18016b8d0
lea rcx, [rbp - 0x21]
call fcn.1800338a0
inc esi
cmp esi, 3
jle 0x18016b860
jmp 0x18016b8da
lea rcx, [rbp - 0x21]
call fcn.1800338a0
nop
lea rcx, [rbp - 1]
call fcn.1800338a0
mov rcx, rbx
call fcn.1801dbd90
test al, al
je 0x18016b7cd
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 0x11], xmm1
mov word [rbp - 0x21], di
xor r8d, r8d
lea rdx, [0x1803722e0]
lea rcx, [rbp - 0x21]
call fcn.180033930
nop
mov r8, rbx
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x1f]
call fcn.18016b520
nop
lea rcx, [rbp - 0x21]
call fcn.1800338a0
cmp qword [rbp + 0x2f], 0
je 0x18016b94d
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call fcn.1801f0450
mov rcx, rbx
call fcn.1801dbd90
test al, al
jne 0x18016b960
mov bl, 1
jmp 0x18016b9b9
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18016b96d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18016b9ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x18016b995
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x18016b995
cmp rdi, 0x32
ja 0x18016b9ac
jmp 0x18016b9a0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rdi
cmp rdi, 0x258
jb 0x18016b960
mov rcx, rbx
call fcn.1801dbd90
test al, al
sete bl
lea rcx, [rbp + 0x1f]
call fcn.1800338a0
movzx eax, bl
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18016e320
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rdx + 0x10], 0
mov rbx, rcx
je 0x18016e3b8
mov dword [rsp + 0x28], 0x80
mov r9d, 1
mov r8d, 0x80000000
mov dword [rsp + 0x20], 3
add rcx, 8
call fcn.1801e1a50
test al, al
je 0x18016e3b8
mov rax, qword [rbx + 8]
test rax, rax
je 0x18016e3b8
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x18016e3b8
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18016e39a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18016e3b8
mov ecx, dword [rsp + 0x30]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
je 0x18016e3b8
mov dword [rbx + 0x14], ecx
mov al, 1
mov dword [rbx + 0x10], 0
jmp 0x18016e3ba
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18016e3e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsxd rsi, edx
mov rbx, rcx
cmp esi, dword [rcx + 0x14]
jae 0x18016e508
cmp qword [rcx + 0x18], 0
jne 0x18016e508
mov rax, qword [rcx + 8]
test rax, rax
je 0x18016e508
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x18016e508
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x34]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x18016e45c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18016e508
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
cmp rax, rsi
jne 0x18016e508
mov edi, dword [rbx + 0x14]
lea rdx, [0x180488a90]
sub edi, esi
mov ecx, edi
mov esi, edi
call fcn.180299938
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18016e508
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.18029c350
mov rcx, qword [rbx + 8]
xor esi, esi
mov dword [rsp + 0x38], esi
test rcx, rcx
je 0x18016e4fb
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x18016e4fb
cmp qword [rcx], 0xffffffffffffffff
je 0x18016e4fb
mov rcx, qword [rcx]
lea r9, [rsp + 0x38]
mov r8d, edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18016e4fb
mov edx, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rbx + 8]
call fcn.1801e1c20
test al, al
je 0x18016e4fb
mov eax, dword [rbx + 0x10]
cmp qword [rsp + 0x30], rax
jne 0x18016e4fb
mov dword [rbx + 0x20], edi
mov al, 1
jmp 0x18016e50a
mov rcx, qword [rbx + 0x18]
call fcn.180299904
mov qword [rbx + 0x18], rsi
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x18016e5f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r9
mov rbp, r8
mov r9, qword [rcx + 0x18]
mov r14, rdx
mov rdi, rcx
test r9, r9
je 0x18016e65d
mov eax, dword [rcx + 0x14]
sub eax, dword [rcx + 0x10]
mov ecx, dword [rcx + 0x20]
cmp eax, ecx
ja 0x18016e65d
mov esi, ebp
imul esi, ebx
cmp esi, eax
ja 0x18016e713
mov edx, ecx
mov r8d, eax
sub rdx, r8
mov rcx, r14
add rdx, r9
mov r8d, esi
call fcn.18029c510
add dword [rdi + 0x10], esi
mov eax, esi
mov byte [rdi + 0x24], 1
jmp 0x18016e6f6
cmp byte [rdi + 0x24], 0
je 0x18016e6b6
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18016e713
cmp qword [rcx], 0xffffffffffffffff
je 0x18016e713
mov eax, dword [rdi + 0x10]
lea r8, [rsp + 0x3c]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov rcx, qword [rcx]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x38], eax
cmp eax, 0xffffffff
jne 0x18016e6a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18016e713
mov eax, dword [rdi + 0x10]
cmp qword [rsp + 0x38], rax
jne 0x18016e713
mov byte [rdi + 0x24], 0
mov rcx, qword [rdi + 8]
xor eax, eax
mov dword [rsp + 0x30], eax
test rcx, rcx
je 0x18016e6f1
test r14, r14
je 0x18016e6f1
cmp qword [rcx], 0xffffffffffffffff
je 0x18016e6f1
mov rcx, qword [rcx]
lea r9, [rsp + 0x30]
mov r8d, ebp
mov qword [rsp + 0x20], rax
imul r8d, ebx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x30]
add dword [rdi + 0x10], eax
mov eax, eax
xor edx, edx
div rbp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x18016e6fb

Function at 0x180174370
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x2c], 0x493e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x493e0
jbe 0x18017439f
mov al, 1
jmp 0x18017440a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x493e0
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x493e0
jbe 0x1801743c4
mov dword [rsp + 0x24], 0x493e0
cmp qword [rsp + 0x48], 0
je 0x1801743fe
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x102
jne 0x1801743f0
mov byte [rsp + 0x20], 1
jmp 0x1801743f5
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
jmp 0x18017440a
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
add rsp, 0x38
ret
Function at 0x180175260
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x30], 0
movzx eax, word [0x1803722e0]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x1801752f1
mov rcx, qword [rsp + 0x270]
call fcn.180175340
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x270]
jmp 0x180175317
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x270]
call fcn.180033860
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x260
pop rdi
ret
Function at 0x180179070
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.Software2345Pinyin
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x180179106
mov rcx, qword [rsp + 0x280]
call fcn.180037a00
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x280]
jmp 0x1801791da
mov dword [rsp + 0x48], 0x104
movzx eax, word [0x1803722e0]
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x288]
call fcn.180037970
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x18017917b
cmp dword [rsp + 0x48], 0
jbe 0x18017917b
cmp dword [rsp + 0x4c], 1
je 0x1801791a9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
call fcn.180037a00
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x280]
jmp 0x1801791da
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x280]
call fcn.180033860
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x270
pop rdi
ret
Function at 0x18017d1a0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0xe8]
sub rsp, 0x1d0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, rcx
xor r14d, r14d
test dl, dl
je 0x18017d26b
lea rcx, [rsp + 0x20]
call fcn.1801750e0
nop
cmp qword [rax + 0x10], r14
sete al
mov byte [rbx + 0x4b], al
lea rcx, [rsp + 0x20]
call fcn.1800338a0
mov qword [rsp + 0x50], r14
lea ecx, [r14 + 1]
call fcn.1802994e4
mov rdi, rax
mov qword [rsp + 0x50], rax
mov byte [rax], r14b
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp - 0x5c]
call fcn.18029c350
mov dword [rbp - 0x60], 0x11c
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18017d24c
cmp dword [rbp - 0x5c], 6
setae al
mov byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1801e31c0
mov byte [rbx + 0x4c], al
lea rcx, [rsp + 0x50]
call fcn.1801e1f20
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r14w
mov r8d, 0x19
lea rdx, str.RCIM_KERNEL_MANAGER_MUTEX
lea rcx, [rsp + 0x20]
call fcn.180033930
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.18017f4f0
nop
lea rcx, [rsp + 0x20]
call fcn.1800338a0
cmp qword [rbp - 0x78], 0
je 0x18017d309
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r8, qword [rsp + 0x78]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rsi, rax
test rax, rax
je 0x18017d309
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18017d2f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [rbx + 0x28], 0x100
mov qword [rbx + 0x20], rsi
mov byte [rbx + 0x49], 0
jmp 0x18017d31b
mov byte [rbx + 0x49], 1
lea rdx, [rsp + 0x78]
lea rcx, [rbx + 0x20]
call fcn.1801dd8e0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r14w
mov r8d, 0x19
lea rdx, str.RCIM_INPUT_SELECTED_MUTEX
lea rcx, [rsp + 0x20]
call fcn.180033930
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x58]
call fcn.18017f550
nop
lea rcx, [rsp + 0x20]
call fcn.1800338a0
cmp qword [rsp + 0x68], 0
je 0x18017d3b4
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rdi, rax
test rax, rax
je 0x18017d3b4
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x18017d3a8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [rbx + 0x38], 0x100
mov qword [rbx + 0x30], rdi
jmp 0x18017d3c3
lea rdx, [rsp + 0x58]
lea rcx, [rbx + 0x30]
call fcn.1801dd8e0
nop
lea rcx, [rsp + 0x58]
call fcn.1800338a0
nop
lea rcx, [rsp + 0x78]
call fcn.1800338a0
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180184520
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r14w
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x74]
call fcn.18029c350
mov dword [rsp + 0x70], 0x11c
lea rcx, [rsp + 0x70]
call fcn.18018b590
mov esi, dword [rsp + 0x74]
mov ebp, dword [rsp + 0x78]
call fcn.18018b5c0
mov edi, 0x20
mov ecx, 0x40
test al, al
cmovne edi, ecx
lea rax, [rsp + 0x84]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1801845d0
lea rdx, [rsp + 0x84]
lea rcx, [rsp + 0x48]
call fcn.180033930
cmp dword [rsp + 0x74], 5
jne 0x180184609
cmp dword [rsp + 0x78], 2
jne 0x180184609
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], edi
mov r9d, ebp
mov r8d, esi
lea rdx, [0x180388400]
mov rcx, rbx
call fcn.1801dba60
nop
lea rcx, [rsp + 0x48]
call fcn.1800338a0
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180185810
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x380
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rcx, qword [rsp + 0x390]
call fcn.1801969a0
mov rax, qword [rsp + 0x390]
add rax, 0x18
mov rcx, rax
call fcn.180043210
movzx eax, al
test eax, eax
je 0x18018586d
mov al, 1
jmp 0x180185a1a
mov rdx, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x390]
call fcn.180186ad0
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x390]
add rax, 0x18
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.180187420
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1801858ce
mov rax, qword [rsp + 0x390]
add rax, 0x18
mov rcx, rax
call fcn.180055580
cmp dword [rsp + 0x30], eax
jl 0x1801858d6
mov dword [rsp + 0x30], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x390]
add rcx, 0x18
mov rdx, rax
call fcn.1800daf70
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3a8]
mov rax, qword [rsp + 0x3a0]
mov r8d, dword [rax + 4]
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x390]
call fcn.180185cd0
movzx eax, al
test eax, eax
je 0x180185935
mov al, 1
jmp 0x180185a1a
mov dword [rsp + 0x44], 0x64
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x320
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x64
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jg 0x180185970
mov al, 1
jmp 0x180185a1a
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x34], 0
jmp 0x18018598c
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x34], eax
jge 0x1801859b8
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x398]
mov eax, dword [rsp + rax*8 + 0x50]
cmp dword [rcx + 4], eax
jne 0x1801859b6
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
jmp 0x1801859b8
jmp 0x180185982
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1801859d3
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x30], eax
jl 0x1801859db
mov dword [rsp + 0x30], 0
movsxd rax, dword [rsp + 0x30]
mov eax, dword [rsp + rax*8 + 0x50]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3a8]
mov rax, qword [rsp + 0x3a0]
mov r8d, dword [rax + 4]
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x390]
call fcn.180185cd0
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x380
pop rdi
ret
Function at 0x1801864f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x70], 0
jne 0x180186521
xor al, al
jmp 0x18018666b
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov rcx, rax
call fcn.180037960
shl rax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov rcx, rax
call fcn.180037970
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Default
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180186588
xor al, al
jmp 0x18018666b
mov rax, qword [rsp + 0x68]
add rax, 0x30
mov rcx, rax
call fcn.180037960
shl rax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
add rax, 0x30
mov rcx, rax
call fcn.180037970
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Profile
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1801865ec
xor al, al
jmp 0x18018666b
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 4]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x180186614
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call fcn.1801958b0
movzx eax, al
test eax, eax
je 0x180186629
mov rax, qword [rsp + 0x68]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x60]
call fcn.180195990
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.KeyboardLayout
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180186669
xor al, al
jmp 0x18018666b
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x58
ret
Function at 0x180189c70
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rdi, rcx
mov edx, 0x10
lea rcx, [rbp - 0x18]
call fcn.18003df50
xor esi, esi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea r8d, [rsi + 0x3c]
lea rdx, str.RCIM_EMOJ_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x40]
call fcn.180033930
nop
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x10], si
mov word [rbp - 0x10], si
cmp qword [rbp - 0x30], rsi
je 0x180189d02
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
jmp 0x180189d05
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x180189d32
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp - 0xf]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp - 0xf], cl
lea rcx, [rbp - 0x40]
call fcn.1800338a0
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x180189d5e
xor al, al
jmp 0x180189d7a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x180189d74
xor al, al
jmp 0x180189d7a
mov byte [rbp - 0x10], 1
mov al, 1
mov byte [rbp - 0x48], al
mov rcx, qword [rdi]
test rcx, rcx
je 0x180189d88
mov qword [rcx], rbx
test al, al
je 0x180189d9f
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180189d9b
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x50], rsi
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180189db6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x10], 0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret