joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016bf0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x9e0]
test rcx, rcx
je 0x180016cec
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
xor edx, edx
call qword [rax + 0x50]
test eax, eax
js 0x180016c3b
cmp dword [rsp + 0x40], 2
jne 0x180016c3b
lea r8, str.Start_run_graph._but_the_graph_already_run.
mov edx, 2
mov rcx, rbx
call fcn.1800190c0
add rsp, 0x30
pop rbx
ret
lea r8, str.Start_run_graph.
mov edx, 2
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.1800190c0
mov rcx, qword [rbx + 0x9e0]
xor edi, edi
mov dword [rbx + 0xaa8], 1
mov dword [rbx + 0xcb0], edi
mov dword [rbx + 0xb40], edi
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
jns 0x180016cc3
lea r8, str.Start_run_graph_failed___x_.
lea edx, [rdi + 2]
mov r9d, eax
mov rcx, rbx
call fcn.1800190c0
lea rcx, [rbx + 0x240]
call qword [sym.imp.MSVCR100.dll_atoi]
mov rcx, qword [rbx + 0x1d00]
lea r9d, [rdi + 1]
movsxd r8, eax
mov edx, 0x26ae
call qword [sym.imp.USER32.dll_PostMessageA]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
lea r8, [0x180016d00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0xad8], rax
add rsp, 0x30
pop rbx
ret

Function at 0x180018430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rdi, rdx
mov rbx, rcx
add rcx, 0x4a0
xor edx, edx
mov r8d, 0x400
call sub.MSVCR100.dll_memset
lea rcx, [rbx + 0x340]
or r8, 0xffffffffffffffff
xor edx, edx
call qword [sym.imp.mfc100.dll_Ordinal_12358]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_856]
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_10602]
test eax, eax
je 0x18001850f
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc100.dll_Ordinal_316]
nop
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_11005]
test eax, eax
je 0x1800184f7
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc100.dll_Ordinal_12752]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800184b0
lea rcx, [rbx + 0x340]
lea r8, [rsp + 0x70]
mov rdx, qword [rcx + 0x10]
call qword [sym.imp.mfc100.dll_Ordinal_11775]
jmp 0x1800184b0
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_2454]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc100.dll_Ordinal_889]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_1244]
nop
mov eax, dword [rbx + 0x350]
jmp 0x180018525
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180019010
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x428], 1
mov rcx, qword [rcx + 0x368]
test rcx, rcx
je 0x180019063
mov rcx, qword [rcx + 0x58]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180019058
mov rcx, qword [rbx + 0x368]
xor edx, edx
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + 0x368], 0
mov rcx, qword [rbx + 0x370]
test rcx, rcx
je 0x1800190a3
mov rcx, qword [rcx + 0x58]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180019098
mov rcx, qword [rbx + 0x370]
xor edx, edx
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + 0x370], 0
mov rcx, rbx
call fcn.180018f70
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180019ac0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x3a0], 1
mov rcx, qword [rcx + reloc.mfc100.dll_Ordinal_2040]
test rcx, rcx
je 0x180019b1c
mov rcx, qword [rcx + 0x58]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180019b11
mov rcx, qword [rbx + reloc.mfc100.dll_Ordinal_2040]
xor edx, edx
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + reloc.mfc100.dll_Ordinal_2040], 0
mov rcx, qword [rbx + reloc.mfc100.dll_Ordinal_2048]
test rcx, rcx
je 0x180019b60
mov rcx, qword [rcx + 0x58]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180019b51
mov rcx, qword [rbx + reloc.mfc100.dll_Ordinal_2048]
xor edx, edx
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + reloc.mfc100.dll_Ordinal_2048], 0
nop dword [rax]
lea rcx, [rbx + reloc.mfc100.dll_Ordinal_856]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rbx + 0x384]
test r11d, r11d
jle 0x180019ba7
movsxd rdx, dword [rbx + 0x380]
mov rax, qword [rbx + 0x388]
mov r8d, dword [rbx + 0x390]
mov rdi, qword [rax + rdx*8]
lea eax, [rdx + 1]
cdq
idiv r8d
mov dword [rbx + 0x380], edx
dec dword [rbx + 0x384]
lea rcx, [rbx + reloc.mfc100.dll_Ordinal_856]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x180019bc4
mov rcx, rdi
call qword [sym.imp.ca_core.dll_Ordinal_55]
jmp 0x180019b60
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180019be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rdi, rdx
mov rbx, rcx
add rcx, 0x3e8
xor edx, edx
mov r8d, 0x400
call sub.MSVCR100.dll_memset
lea rcx, [rbx + 0x3c0]
or r8, 0xffffffffffffffff
xor edx, edx
call qword [sym.imp.mfc100.dll_Ordinal_12358]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_856]
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_10602]
test eax, eax
je 0x180019cbf
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc100.dll_Ordinal_316]
nop
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_11005]
test eax, eax
je 0x180019ca7
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc100.dll_Ordinal_12752]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180019c60
lea rcx, [rbx + 0x3c0]
lea r8, [rsp + 0x70]
mov rdx, qword [rcx + 0x10]
call qword [sym.imp.mfc100.dll_Ordinal_11775]
jmp 0x180019c60
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_2454]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc100.dll_Ordinal_889]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc100.dll_Ordinal_1244]
nop
mov eax, dword [rbx + 0x3d0]
jmp 0x180019cd5
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x18001a3e0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc100.dll_Ordinal_316]
nop
lea rcx, [rsp + 0x80]
call fcn.18001af80
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov r8, qword [rbx]
lea rdx, str._s_tmp_d.png
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc100.dll_Ordinal_4124]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc100.dll_Ordinal_889]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc100.dll_Ordinal_300]
mov rdx, rdi
mov rcx, rax
call fcn.180019f50
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18001a4f2
xor ecx, ecx
mov qword [rsp + 0x80], rcx
xorpd xmm0, xmm0
movsd qword [rsp + 0x88], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
lea r9d, [rcx + 1]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ca_core.dll_Ordinal_22]
test eax, eax
jns 0x18001a4cf
lea r8, str.Text_create_yuv_faild.
mov edx, 2
mov rcx, rsi
call fcn.1800190c0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc100.dll_Ordinal_889]
mov rax, rbx
jmp 0x18001a4ff
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc100.dll_Ordinal_889]
xor eax, eax
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001af80
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [rsp + 0x20], 1
mov dl, 0x5c
mov rcx, rbx
call qword [sym.imp.mfc100.dll_Ordinal_12762]
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18003c580
add rsp, 0x160
pop rbx
ret

Function at 0x18001b0e0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x30], 0
call sub.MSVCR100.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.mfc100.dll_Ordinal_310]
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18003c580
add rsp, 0x150
pop rbx
ret

Function at 0x18001b160
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
movzx eax, word [0x1800480f4]
mov word [rsp + 0x58], ax
movzx eax, byte [0x1800480f6]
mov byte [rsp + 0x5a], al
xor edx, edx
call qword [sym.imp.mfc100.dll_Ordinal_4308]
mov byte [rsp + 0x58], al
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov rax, qword [rsp + 0x60]
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and edx, 0x3ff
lea rbx, [rdx + rax]
sar rbx, 0xa
mov rcx, rdi
call qword [sym.imp.mfc100.dll_Ordinal_889]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x18001b1f0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x58
movsx ecx, cl
call qword [sym.imp.MSVCR100.dll_toupper]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x18001b2bd
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x60], 0x5c3a41
mov qword [rsp + 0x48], rsi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x40], rdi
xor esi, esi
mov byte [rsp + 0x60], al
call qword [sym.imp.MSVCR100.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov ecx, pe_nt_image_headers64
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov rdi, rax
call qword [sym.imp.MSVCR100.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rsp + 0x38], pe_nt_image_headers64
mov qword [rsp + 0x30], rax
mov rbx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, pe_nt_image_headers64
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_]
test byte [rsp + 0x68], 8
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov eax, 1
cmovne esi, eax
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x58
ret
mov eax, 1
add rsp, 0x58
ret

Function at 0x18001b530
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbp, rcx
mov rdx, r8
mov rcx, rdi
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
jne 0x18001b566
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rdx, rbx
mov rcx, rdi
push rcx
call 0x18040584f
test rax, rax
je 0x18001b557
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x18001b557
mov qword [rsp + 0x60], r12
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 3]
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
test rax, rax
je 0x18001b5e4
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rdi
mov rcx, rax
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x78], esi
je 0x18001b5e8
xor eax, eax
jmp 0x18001b5ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001cf60
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov qword [rcx + 0xf0], rax
mov qword [rcx + 0xf8], rax
mov qword [rcx + 0x100], rax
mov qword [rcx + 0x108], rax
mov qword [rcx + 0x118], rax
lea rcx, str.HID.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.HidP_GetExtendedAttributes
mov rcx, rax
mov qword [rbx + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0xf0]
lea rdx, str.HidP_InitializeReportForID
mov qword [0x18005ecf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x18005ecf0], 0
mov qword [0x18005ecf8], rax
je 0x18001cfe3
test rax, rax
jne 0x18001cff0
lea rcx, str.Fail_to_get_HID_function_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x18001d270
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
cmp qword [rdx + 8], 0xffffffffffffffff
mov rsi, rcx
je 0x18001d353
mov r8d, 0xf0
call sub.MSVCR100.dll_memcpy
cmp word [rsi + 0x5e], 2
jb 0x18001d346
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 0xc0]
mov qword [rsp + 0x38], rbp
movzx eax, word [rbx + 0x14]
mov qword [rsp + 0x40], rdi
inc eax
mov ecx, eax
mov dword [rsi + 0x110], eax
call qword [sym.imp.MSVCR100.dll_malloc]
mov qword [rsi + 0x100], rax
movzx ecx, word [rbx + 0x5c]
mov rdi, rax
inc ecx
mov dword [rsi + 0x114], ecx
call qword [sym.imp.MSVCR100.dll_malloc]
mov qword [rsi + 0x108], rax
movzx ecx, word [rbx + 0xa4]
mov rbp, rax
inc ecx
mov dword [rsi + 0x118], ecx
call qword [sym.imp.MSVCR100.dll_malloc]
mov rbx, qword [rsp + 0x30]
test rdi, rdi
mov rdi, qword [rsp + 0x40]
mov qword [rsi + 0xf8], rax
je 0x18001d31f
test rbp, rbp
je 0x18001d31f
test rax, rax
jne 0x18001d32c
lea rcx, str.Error_allocating_memory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbp, qword [rsp + 0x38]
mov dword [rsi + 0x11c], 1
mov eax, 1
add rsp, 0x20
pop rsi
ret
lea rcx, str.Error_initializing_flash_and_RW_buffer_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x18001d540
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov r9, qword [rcx + 0xf8]
mov rdi, rdx
xor eax, eax
lea rdx, [rsp + 0x30]
lea r8, [0x18005b8c0]
mov rbx, rcx
mov qword [rsp + 0x20], rax
call fcn.18001d410
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 8
mov dword [rsp + 0x20], 0
call fcn.1800011a0
test eax, eax
jne 0x18001d5b3
lea rcx, str.Unknown_error:_Couldnt_execute_REPORT_HDMI_INFO_function_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
mov r8d, dword [rbx + 0x118]
mov rcx, qword [rbx + 0xf8]
xor edx, edx
call sub.MSVCR100.dll_memset
mov rcx, qword [rbx + 0xf8]
mov r11, qword [rsp + 0x50]
mov rax, qword [r11]
mov qword [rcx], rax
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [r11 + 0x10]
mov qword [rcx + 0x10], rax
mov rcx, qword [rbx + 0xf8]
movzx eax, byte [rcx + 3]
movzx edx, byte [rcx + 2]
mov byte [rcx + 2], al
mov rax, qword [rbx + 0xf8]
mov byte [rax + 3], dl
mov rcx, qword [rbx + 0xf8]
movzx eax, byte [rcx + 5]
movzx edx, byte [rcx + 4]
mov byte [rcx + 4], al
mov rax, qword [rbx + 0xf8]
mov byte [rax + 5], dl
mov rcx, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0xb0]
mov rax, qword [rcx]
mov qword [rdi], rax
mov rax, qword [rcx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdi + 0x10], rax
mov eax, 1
add rsp, 0x90
pop rdi
ret
Function at 0x18001d660
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x100a0
call fcn.18003d470
sub rsp, rax
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rsp + 0x10090], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x10000
call sub.MSVCR100.dll_memset
xor r11d, r11d
lea r9, [rsp + 0x90]
lea r8, [0x18005b8d0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], r11
call fcn.18001d410
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 8
mov dword [rsp + 0x20], 0
call fcn.1800011a0
test eax, eax
jne 0x18001d715
lea rcx, str.Unknown_error:_Couldnt_execute_REPORT_DRM_INFO_function_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rcx, qword [rsp + 0x10090]
xor rcx, rsp
call fcn.18003c580
mov rbx, qword [rsp + 0x100c0]
add rsp, 0x100a0
pop rdi
ret
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
mov r11, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xa8], r9
cmp cl, 1
jne 0x18001d6f2
movsd xmm3, qword [0x18004d180]
movsd xmm2, qword [0x18004d178]
mov qword [rdi], rcx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x18], r9
mov qword [rdi + 0x20], r10
mov qword [rdi + 0x28], r11
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rax
movzx eax, word [rsp + 0x96]
mov dword [rdi + 0x80], 0x40
movd xmm0, eax
movzx eax, dx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
divsd xmm0, xmm2
movsd qword [rdi + 0x84], xmm0
movd xmm0, eax
movzx eax, word [rsp + 0x9a]
movd xmm1, eax
movzx eax, word [rsp + 0x9c]
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
divsd xmm0, xmm2
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm3
movsd qword [rdi + 0x9c], xmm0
movd xmm0, eax
movzx eax, word [rsp + 0x9e]
divsd xmm1, xmm2
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
movsd qword [rdi + 0x8c], xmm1
movd xmm1, eax
movzx eax, r8w
divsd xmm0, xmm2
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm3
movsd qword [rdi + 0xa4], xmm0
movd xmm0, eax
movzx eax, word [rsp + 0xa2]
divsd xmm1, xmm2
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
movsd qword [rdi + 0x94], xmm1
movd xmm1, eax
movzx eax, word [rsp + 0xa4]
divsd xmm0, xmm2
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm3
movsd qword [rdi + 0xac], xmm0
movd xmm0, eax
movzx eax, word [rsp + 0xa6]
divsd xmm1, xmm2
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
movsd qword [rdi + 0xb4], xmm1
divsd xmm0, xmm2
movsd qword [rdi + 0xbc], xmm0
movd xmm0, eax
movzx eax, r9w
movd xmm1, eax
movzx eax, word [rsp + 0xaa]
cvtdq2pd xmm0, xmm0
mov dword [rdi + 0xd4], eax
movzx eax, word [rsp + 0xac]
movsd qword [rdi + 0xc4], xmm0
mov dword [rdi + 0xd8], eax
mov eax, 1
cvtdq2pd xmm1, xmm1
divsd xmm1, qword [0x18004c528]
movsd qword [rdi + 0xcc], xmm1
jmp 0x18001d6f4
Function at 0x18001ecb0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
add rcx, 0x690
call fcn.18002d280
xor edi, edi
mov rcx, rbx
mov dword [rbx + 0x6bc], edi
call fcn.18001eea0
mov rcx, rbx
call fcn.18001ef90
lea rcx, [0x18001ec90]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbx + 0x5e0], rdi
mov qword [rbx + 0x5e8], rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.mfc100.dll_Ordinal_1831]
mov qword [rbx + 0x960], rax
mov dword [rax + 0x50], edi
mov rcx, qword [rbx + 0x960]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
add rsp, 0x30
pop rdi
ret

Function at 0x18001ede0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180040ed8]
mov rdx, qword [rcx + 0x670]
mov rbx, rcx
cmp qword [rax], rdx
je 0x18001ee0c
add rcx, 0x668
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov rcx, qword [rbx + 0x970]
call fcn.18001fde0
mov rcx, qword [rbx + 0x960]
mov dword [rbx + 0x6bc], 1
test rcx, rcx
je 0x18001ee7a
mov rcx, qword [rcx + 0x58]
mov edx, Ordinal_2002
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18001ee58
mov rcx, qword [rbx + 0x960]
lea edx, [rax - 3]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x960]
test rcx, rcx
je 0x18001ee6f
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.httpsrv.dll_Ordinal_8]
mov qword [rbx + 0x960], 0
mov rcx, qword [rbx + 0x970]
call fcn.18001fbd0
mov rcx, rbx
call fcn.18001eea0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18001ef90
Function at 0x18001f8e0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x590], 1
mov rcx, qword [rcx + 0x530]
test rcx, rcx
je 0x18001f95b
mov rcx, qword [rcx + 0x58]
mov edx, Ordinal_2002
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18001f929
mov rcx, qword [rbx + 0x530]
lea edx, [rax - 3]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x530]
test rcx, rcx
je 0x18001f940
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.httpsrv.dll_Ordinal_8]
xor eax, eax
mov qword [rbx + 0x530], rax
mov dword [rbx + 0x514], eax
mov dword [rbx + 0x594], eax
add rsp, 0x20
pop rbx
ret
xor eax, eax
mov dword [rbx + 0x514], eax
mov dword [rbx + 0x594], eax
add rsp, 0x20
pop rbx
ret

Function at 0x18001fd10
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov rsi, rcx
mov ebp, r12d
mov edi, r12d
cmp qword [rcx + 0x18], r12
jle 0x18001fdbb
mov qword [rsp + 0x40], rbx
test rdi, rdi
js 0x18001fdd1
cmp rdi, qword [rsi + 0x18]
jge 0x18001fdd1
mov rax, qword [rsi + 0x10]
lea rcx, [0x18001f590]
xor r9d, r9d
mov rbx, qword [rax + rdi*8]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov rdx, rbx
mov qword [rbx + 0x588], r12
mov qword [rbx + 0x590], r12
mov dword [rsp + 0x20], 4
call qword [sym.imp.mfc100.dll_Ordinal_1831]
mov qword [rbx + 0x530], rax
mov dword [rax + 0x50], r12d
mov rcx, qword [rbx + 0x530]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
inc ebp
inc rdi
movsxd rax, ebp
cmp rax, qword [rsi + 0x18]
jl 0x18001fd40
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
call qword [sym.imp.mfc100.dll_Ordinal_2022]
int3

Function at 0x18001fde0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov rsi, rcx
mov ebp, r12d
mov edi, r12d
cmp qword [rcx + 0x18], r12
jle 0x18001feae
mov qword [rsp + 0x30], rbx
test rdi, rdi
js 0x18001fec4
cmp rdi, qword [rsi + 0x18]
jge 0x18001fec4
mov rax, qword [rsi + 0x10]
mov rbx, qword [rax + rdi*8]
mov rcx, qword [rbx + 0x530]
mov dword [rbx + 0x590], 1
test rcx, rcx
je 0x18001fe89
mov rcx, qword [rcx + 0x58]
mov edx, Ordinal_2002
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18001fe6b
mov rcx, qword [rbx + 0x530]
lea edx, [rax - 3]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x530]
test rcx, rcx
je 0x18001fe82
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.httpsrv.dll_Ordinal_8]
mov qword [rbx + 0x530], r12
inc ebp
mov dword [rbx + 0x594], r12d
mov dword [rbx + 0x514], r12d
movsxd rax, ebp
inc rdi
cmp rax, qword [rsi + 0x18]
jl 0x18001fe10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
call qword [sym.imp.mfc100.dll_Ordinal_2022]
int3