joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180189de0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 9], xmm1
mov word [rbp - 0x19], di
lea r8d, [rdi + 0x3c]
lea rdx, str.RCIM_EMOJ_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x19]
call fcn.180033930
nop
mov r8b, 1
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.18017f350
nop
lea rcx, [rbp - 0x19]
call fcn.1800338a0
lea edx, [rdi + 0x10]
lea rcx, [rbp + 0x17]
call fcn.18003df50
mov qword [rbp + 0x17], rdi
mov word [rbp + 0x1f], di
mov word [rbp + 0x1f], di
cmp qword [rbp + 0x37], rdi
je 0x180189e88
lea r8, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae r8, qword [rbp + 0x27]
jmp 0x180189e8b
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp + 0x17], rax
test rax, rax
je 0x180189eb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp + 0x20]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp + 0x20], cl
xor eax, eax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
lea rax, [rbp + 0x17]
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x11], 0
mov rcx, qword [rbp + 0x17]
test rcx, rcx
jne 0x180189edb
xor al, al
jmp 0x180189ef7
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x180189ef1
xor al, al
jmp 0x180189ef7
mov byte [rbp + 0x1f], 1
mov al, 1
mov byte [rbp - 0x11], al
mov rbx, qword [rbx]
test rbx, rbx
je 0x180189f08
mov rbx, qword [rbx + 8]
jmp 0x180189f0b
mov rbx, rdi
test al, al
je 0x180189f22
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x180189f1e
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x1f], 0
mov qword [rbp - 0x19], rdi
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x180189f39
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x17], rdi
mov word [rbp + 0x1f], 0
lea rcx, [rbp + 0x27]
call fcn.1800338a0
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180189f70
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ebx, edx
mov rdi, rcx
xor esi, esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 9], xmm1
mov word [rbp - 0x19], si
lea r8d, [rsi + 0x3c]
lea rdx, str.RCIM_EMOJ_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x19]
call fcn.180033930
nop
mov r8b, 1
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.18017f350
nop
lea rcx, [rbp - 0x19]
call fcn.1800338a0
lea edx, [rsi + 0x10]
lea rcx, [rbp + 0x17]
call fcn.18003df50
mov qword [rbp + 0x17], rsi
mov word [rbp + 0x1f], si
mov word [rbp + 0x1f], si
cmp qword [rbp + 0x37], rsi
je 0x18018a01e
lea r8, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae r8, qword [rbp + 0x27]
jmp 0x18018a021
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp + 0x17], rax
test rax, rax
je 0x18018a04e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp + 0x20]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp + 0x20], cl
xor eax, eax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
lea rax, [rbp + 0x17]
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x11], 0
mov rcx, qword [rbp + 0x17]
test rcx, rcx
jne 0x18018a071
xor al, al
jmp 0x18018a08d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18018a087
xor al, al
jmp 0x18018a08d
mov byte [rbp + 0x1f], 1
mov al, 1
mov byte [rbp - 0x11], al
mov rcx, qword [rdi]
test rcx, rcx
je 0x18018a09b
mov dword [rcx + 0x10], ebx
test al, al
je 0x18018a0b2
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18018a0ae
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x1f], 0
mov qword [rbp - 0x19], rsi
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18018a0c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x17], rsi
mov word [rbp + 0x1f], 0
lea rcx, [rbp + 0x27]
call fcn.1800338a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18018a100
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x20], rdx
xor r14d, r14d
mov dword [rbp - 0x60], r14d
lea edx, [r14 + 0x10]
lea rcx, [rbp - 0x18]
call fcn.18003df50
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
lea r8d, [r14 + 0x3c]
lea rdx, str.RCIM_EMOJ_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x48]
call fcn.180033930
nop
mov qword [rbp - 0x18], r14
mov word [rbp - 0x10], r14w
mov word [rbp - 0x10], r14w
cmp qword [rbp - 0x38], r14
je 0x18018a1a0
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r8, qword [rbp - 0x48]
jmp 0x18018a1a3
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 0x18], rax
mov r15d, 1
test rax, rax
je 0x18018a1d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp - 0xf]
cmp eax, 0xb7
cmove ecx, r15d
mov byte [rbp - 0xf], cl
lea rcx, [rbp - 0x48]
call fcn.1800338a0
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x58], rax
mov byte [rbp - 0x50], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x18018a1ff
xor dil, dil
jmp 0x18018a21d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18018a216
xor dil, dil
jmp 0x18018a21d
mov byte [rbp - 0x10], 1
mov dil, 1
mov byte [rbp - 0x50], dil
mov rdx, qword [rsi]
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
test rdx, rdx
je 0x18018a259
add rdx, 0x14
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x18018a244
mov rcx, rbx
call fcn.180033930
jmp 0x18018a26b
xor r8d, r8d
lea rdx, [0x1803722e0]
mov rcx, rbx
call fcn.180033930
mov dword [rbp - 0x60], r15d
test dil, dil
je 0x18018a287
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x18018a283
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x58], r14
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x18018a29e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], r14
mov word [rbp - 0x10], 0
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18018a2d0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 9], xmm1
mov word [rbp - 0x19], si
lea r8d, [rsi + 0x3c]
lea rdx, str.RCIM_EMOJ_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x19]
call fcn.180033930
nop
mov r8b, 1
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.18017f350
nop
lea rcx, [rbp - 0x19]
call fcn.1800338a0
lea edx, [rsi + 0x10]
lea rcx, [rbp + 0x17]
call fcn.18003df50
mov qword [rbp + 0x17], rsi
mov word [rbp + 0x1f], si
mov word [rbp + 0x1f], si
cmp qword [rbp + 0x37], rsi
je 0x18018a37f
lea r8, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae r8, qword [rbp + 0x27]
jmp 0x18018a382
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp + 0x17], rax
test rax, rax
je 0x18018a3af
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp + 0x20]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp + 0x20], cl
xor eax, eax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
lea rax, [rbp + 0x17]
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x11], 0
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18018a3ea
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18018a3e4
xor cl, cl
jmp 0x18018a3ea
mov byte [rbp + 0x1f], 1
mov cl, 1
mov byte [rbp - 0x11], cl
mov rax, qword [rdi]
test rax, rax
je 0x18018a422
cmp qword [rbx + 0x18], 8
jb 0x18018a3ff
mov rbx, qword [rbx]
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x14], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x24], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x34], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rax + 0x44], xmm1
mov word [rax + 0x54], si
test cl, cl
je 0x18018a439
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18018a435
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x1f], 0
mov qword [rbp - 0x19], rsi
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18018a450
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x17], rsi
mov word [rbp + 0x1f], 0
lea rcx, [rbp + 0x27]
call fcn.1800338a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18018a490
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
xor esi, esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 0x49], xmm1
mov word [rbp - 0x59], si
lea r8d, [rsi + 0x3c]
lea rdx, str.RCIM_EMOJ_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x59]
call fcn.180033930
nop
mov r8b, 1
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 7]
call fcn.18017f350
nop
lea rcx, [rbp - 0x59]
call fcn.1800338a0
lea edx, [rsi + 0x10]
lea rcx, [rbp - 9]
call fcn.18003df50
mov qword [rbp - 9], rsi
mov word [rbp - 1], si
mov word [rbp - 1], si
cmp qword [rbp + 0x17], rsi
je 0x18018a53c
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r8, qword [rbp + 7]
jmp 0x18018a53f
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 9], rax
test rax, rax
je 0x18018a56c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp], cl
xor eax, eax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
lea rax, [rbp - 9]
mov qword [rbp - 0x59], rax
mov byte [rbp - 0x51], 0
mov rcx, qword [rbp - 9]
test rcx, rcx
jne 0x18018a58f
xor bl, bl
jmp 0x18018a5ab
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18018a5a5
xor bl, bl
jmp 0x18018a5ab
mov byte [rbp - 1], 1
mov bl, 1
mov byte [rbp - 0x51], bl
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 0x21], xmm1
mov word [rbp - 0x31], si
mov r8d, 0x37
lea rdx, str.RCIM_EMOJ_SHARED_53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x31]
call fcn.180033930
nop
mov r8b, 1
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0x27]
call fcn.18017f350
nop
lea rcx, [rbp - 0x31]
call fcn.1800338a0
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.18018a9f0
test al, al
jne 0x18018a635
cmp qword [rbp + 0x37], 0
je 0x18018a635
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 0x96
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.18018ac00
nop
lea rcx, [rbp + 0x27]
call fcn.1800338a0
nop
test bl, bl
je 0x18018a656
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x18018a652
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 1], 0
mov qword [rbp - 0x59], rsi
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x18018a66d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 9], rsi
mov word [rbp - 1], 0
lea rcx, [rbp + 7]
call fcn.1800338a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18018c680
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, edx
lea r8, [rsp + 0x24]
mov edx, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x18018c6c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18018c740
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x18018c740
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x24]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x18018c702
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18018c740
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x28], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18018c729
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18018c740
mov ecx, dword [rsp + 0x28]
mov rax, rbx
shl rcx, 0x20
add rcx, rbx
cmp rcx, rdi
jne 0x18018c740
mov al, 1
jmp 0x18018c742
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18018fb00
Capabilities:
Get common file path

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x268]
test eax, eax
je 0x18018fb63
mov edx, 0x103
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x18018fb73
mov edx, 0x103
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
call fcn.180033860
nop
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x250
pop rdi
ret
Function at 0x180190e60
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov edx, 0x10
lea rcx, [rbp - 0x18]
call fcn.18003df50
xor edi, edi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
lea r8d, [rdi + 0x44]
lea rdx, str.RCIM_PICFACE_SKIN_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x40]
call fcn.180033930
nop
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x10], di
mov word [rbp - 0x10], di
cmp qword [rbp - 0x30], rdi
je 0x180190eeb
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
jmp 0x180190eee
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x180190f1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp - 0xf]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp - 0xf], cl
lea rcx, [rbp - 0x40]
call fcn.1800338a0
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x180190f47
xor al, al
jmp 0x180190f63
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x180190f5d
xor al, al
jmp 0x180190f63
mov byte [rbp - 0x10], 1
mov al, 1
mov byte [rbp - 0x48], al
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180190f73
mov ebx, dword [rcx]
jmp 0x180190f75
mov ebx, edi
test al, al
je 0x180190f8c
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180190f88
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x50], rdi
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180190fa3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x10], 0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180190fd0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, edx
mov rdi, rcx
mov edx, 0x10
lea rcx, [rbp - 0x18]
call fcn.18003df50
xor esi, esi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea r8d, [rsi + 0x44]
lea rdx, str.RCIM_PICFACE_SKIN_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x40]
call fcn.180033930
nop
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x10], si
mov word [rbp - 0x10], si
cmp qword [rbp - 0x30], rsi
je 0x180191061
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
jmp 0x180191064
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x180191091
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp - 0xf]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp - 0xf], cl
lea rcx, [rbp - 0x40]
call fcn.1800338a0
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x1801910bd
xor al, al
jmp 0x1801910d9
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x1801910d3
xor al, al
jmp 0x1801910d9
mov byte [rbp - 0x10], 1
mov al, 1
mov byte [rbp - 0x48], al
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1801910e7
mov dword [rcx], ebx
test al, al
je 0x1801910fe
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1801910fa
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x50], rsi
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180191115
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x10], 0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180191140
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov edx, 0x10
lea rcx, [rbp - 0x18]
call fcn.18003df50
xor edi, edi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
lea r8d, [rdi + 0x44]
lea rdx, str.RCIM_PICFACE_SKIN_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x40]
call fcn.180033930
nop
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x10], di
mov word [rbp - 0x10], di
cmp qword [rbp - 0x30], rdi
je 0x1801911cb
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
jmp 0x1801911ce
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1801911fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp - 0xf]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp - 0xf], cl
lea rcx, [rbp - 0x40]
call fcn.1800338a0
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x180191227
xor al, al
jmp 0x180191243
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18019123d
xor al, al
jmp 0x180191243
mov byte [rbp - 0x10], 1
mov al, 1
mov byte [rbp - 0x48], al
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180191254
mov ebx, dword [rcx + 4]
jmp 0x180191256
mov ebx, edi
test al, al
je 0x18019126d
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180191269
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x50], rdi
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180191284
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x10], 0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1801912b0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, edx
mov rdi, rcx
mov edx, 0x10
lea rcx, [rbp - 0x18]
call fcn.18003df50
xor esi, esi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea r8d, [rsi + 0x44]
lea rdx, str.RCIM_PICFACE_SKIN_SHARED_MUTEX53007B9A_580F_4DD3_A122_34F2835BFE77
lea rcx, [rbp - 0x40]
call fcn.180033930
nop
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x10], si
mov word [rbp - 0x10], si
cmp qword [rbp - 0x30], rsi
je 0x180191341
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
jmp 0x180191344
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x180191371
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [rbp - 0xf]
mov edx, 1
cmp eax, 0xb7
cmove ecx, edx
mov byte [rbp - 0xf], cl
lea rcx, [rbp - 0x40]
call fcn.1800338a0
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x18019139d
xor al, al
jmp 0x1801913b9
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x1801913b3
xor al, al
jmp 0x1801913b9
mov byte [rbp - 0x10], 1
mov al, 1
mov byte [rbp - 0x48], al
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1801913c8
mov dword [rcx + 4], ebx
test al, al
je 0x1801913df
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1801913db
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x50], rsi
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1801913f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x10], 0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret