joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18023a0d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 8], rax
test rcx, rcx
je 0x18023a2c3
cmp r8d, 0x80
jb 0x18023a2c3
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r14
mov r14d, 5
mov dword [rsp], 0x35343332
mov dword [rsp + 4], 0x30636970
nop word [rax + rax]
lea r8d, [r14 - 5]
lea rax, [r8 + rcx]
mov edx, r8d
and edx, 7
movzx ebp, byte [rsp + rdx]
xor byte [rax], bpl
lea eax, [r14 - 4]
mov edx, eax
and edx, 7
movzx esi, byte [rsp + rdx]
xor byte [rax + rcx], sil
lea eax, [r14 - 3]
mov edx, eax
and edx, 7
movzx edi, byte [rsp + rdx]
xor byte [rax + rcx], dil
lea eax, [r14 - 2]
mov edx, eax
and edx, 7
movzx ebx, byte [rsp + rdx]
lea edx, [r14 - 1]
xor byte [rax + rcx], bl
lea eax, [r8 - 4]
and eax, 7
movzx r11d, byte [rsp + rax]
lea eax, [r8 - 3]
and eax, 7
xor byte [rdx + rcx], r11b
mov edx, r14d
movzx r10d, byte [rsp + rax]
lea eax, [r8 - 2]
and eax, 7
xor byte [rdx + rcx], r10b
lea edx, [r14 + 1]
movzx r9d, byte [rsp + rax]
lea eax, [r8 - 1]
and eax, 7
xor byte [rdx + rcx], r9b
lea edx, [r14 + 2]
movzx r8d, byte [rsp + rax]
lea eax, [r14 + 3]
xor byte [rax + rcx], bpl
lea eax, [r14 + 4]
xor byte [rax + rcx], sil
lea eax, [r14 + 5]
xor byte [rax + rcx], dil
lea eax, [r14 + 6]
xor byte [rax + rcx], bl
lea eax, [r14 + 7]
xor byte [rax + rcx], r11b
lea eax, [r14 + 8]
xor byte [rax + rcx], r10b
lea eax, [r14 + 9]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0xa]
xor byte [rax + rcx], r8b
lea eax, [r14 + 0xb]
xor byte [rax + rcx], bpl
lea eax, [r14 + 0xc]
xor byte [rax + rcx], sil
lea eax, [r14 + 0xd]
xor byte [rax + rcx], dil
lea eax, [r14 + 0xe]
xor byte [rax + rcx], bl
lea eax, [r14 + 0xf]
xor byte [rax + rcx], r11b
lea eax, [r14 + 0x10]
xor byte [rax + rcx], r10b
lea eax, [r14 + 0x11]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0x12]
xor byte [rax + rcx], r8b
lea eax, [r14 + 0x13]
xor byte [rax + rcx], bpl
lea eax, [r14 + 0x14]
xor byte [rax + rcx], sil
lea eax, [r14 + 0x15]
xor byte [rax + rcx], dil
lea eax, [r14 + 0x16]
xor byte [rdx + rcx], r8b
xor byte [rax + rcx], bl
lea eax, [r14 + 0x17]
xor byte [rax + rcx], r11b
lea eax, [r14 + 0x18]
xor byte [rax + rcx], r10b
lea eax, [r14 + 0x19]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0x1a]
xor byte [rax + rcx], r8b
add r14d, 0x20
lea eax, [r14 - 5]
cmp eax, 0x80
jb 0x18023a130
mov r14, qword [rsp + 0x10]
mov al, 1
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180385c10
add rsp, 0x28
ret
xor al, al
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180385c10
add rsp, 0x28
ret
Function at 0x18023b9d0
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff3f0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x30]
call fcn.180004a40
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aa30
nop
lea rcx, [rsp + 0x30]
call fcn.180004990
lea rcx, [rsp + 0x50]
call fcn.180004950
mov r9, rax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.Status
lea rcx, str.Matting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.180004990
nop
lea rcx, [rsp + 0x70]
call fcn.180004990
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180385c10
add rsp, 0xa8
ret

Function at 0x18023c2f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x350
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff4b0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x90]
call fcn.180004a40
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aa30
nop
lea rcx, [rsp + 0x90]
call fcn.180004990
lea rcx, [rsp + 0x50]
call fcn.180155ab0
movzx eax, al
test eax, eax
jne 0x18023c392
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.180004990
nop
lea rcx, [rsp + 0x70]
call fcn.180004990
movzx eax, byte [rsp + 0x30]
jmp 0x18023c4c6
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.180004950
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x130]
lea r8, [0x1803be558]
lea rdx, str.Version
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.Application
lea rcx, [rsp + 0xb0]
call fcn.180004a40
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.18015aa30
nop
lea rcx, [rsp + 0xb0]
call fcn.180004990
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0xd0]
call fcn.180004a40
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x110]
call fcn.18015aa30
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x360]
call fcn.1800049b0
nop
lea rcx, [rsp + 0x110]
call fcn.180004990
nop
lea rcx, [rsp + 0xd0]
call fcn.180004990
mov rcx, qword [rsp + 0x360]
call fcn.180155970
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xf0]
call fcn.180004990
nop
lea rcx, [rsp + 0x50]
call fcn.180004990
nop
lea rcx, [rsp + 0x70]
call fcn.180004990
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.180385c10
add rsp, 0x350
pop rdi
ret
Function at 0x18023c6f0
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff3f0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x30]
call fcn.180004a40
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aa30
nop
lea rcx, [rsp + 0x30]
call fcn.180004990
lea rcx, [rsp + 0x50]
call fcn.180004950
mov r9, rax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.Status
lea rcx, [0x1803d4b90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.180004990
nop
lea rcx, [rsp + 0x70]
call fcn.180004990
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180385c10
add rsp, 0xa8
ret

Function at 0x18023d000
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x350
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff5e0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x90]
call fcn.180004a40
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aa30
nop
lea rcx, [rsp + 0x90]
call fcn.180004990
lea rcx, [rsp + 0x50]
call fcn.180155ab0
movzx eax, al
test eax, eax
jne 0x18023d0a2
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.180004990
nop
lea rcx, [rsp + 0x70]
call fcn.180004990
movzx eax, byte [rsp + 0x30]
jmp 0x18023d1d6
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.180004950
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x130]
lea r8, [0x1803be558]
lea rdx, str.Version
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.Application
lea rcx, [rsp + 0xb0]
call fcn.180004a40
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.18015aa30
nop
lea rcx, [rsp + 0xb0]
call fcn.180004990
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0xd0]
call fcn.180004a40
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x110]
call fcn.18015aa30
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x360]
call fcn.1800049b0
nop
lea rcx, [rsp + 0x110]
call fcn.180004990
nop
lea rcx, [rsp + 0xd0]
call fcn.180004990
mov rcx, qword [rsp + 0x360]
call fcn.180155970
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xf0]
call fcn.180004990
nop
lea rcx, [rsp + 0x50]
call fcn.180004990
nop
lea rcx, [rsp + 0x70]
call fcn.180004990
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.180385c10
add rsp, 0x350
pop rdi
ret
Function at 0x18023d3a0
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff3f0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x30]
call fcn.180004a40
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aa30
nop
lea rcx, [rsp + 0x30]
call fcn.180004990
lea rcx, [rsp + 0x50]
call fcn.180004950
mov r9, rax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.Status
lea rcx, str.PicDesigner
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.180004990
nop
lea rcx, [rsp + 0x70]
call fcn.180004990
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180385c10
add rsp, 0xa8
ret
Function at 0x180250400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1802504d3
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.180250500
nop
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edx, eax
mov rcx, rdi
call fcn.18016b310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x18025047e
xor sil, sil
jmp 0x180250492
mov r8, rsi
mov rdx, rax
mov rcx, qword [rdi]
call sub.VCRUNTIME140.dll_memcpy
test esi, esi
setne sil
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1802504cf
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x1802504cf
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1802504cf
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 8]
movzx eax, sil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180258d20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x8f0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x98]
call fcn.180004a80
nop
mov dword [rsp + 0x4c], 0
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x400
lea rax, [rsp + 0x4e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0x400
mov dl, 1
mov rax, qword [rsp + 0x900]
mov rcx, qword [rax + 0x20]
call fcn.1802037c0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, qword [rsp + 0x910]
mov rdx, qword [rsp + 0x908]
mov rax, qword [rsp + 0x900]
mov rcx, qword [rax + 0x20]
call fcn.180202b40
movzx eax, al
test eax, eax
jne 0x180258e22
mov rcx, qword [rsp + 0x908]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x98]
call fcn.180004990
movzx eax, byte [rsp + 0x40]
jmp 0x180258f88
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x180258f58
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x98]
call fcn.18000d570
lea rcx, [rsp + 0x98]
call fcn.180004940
movzx eax, al
test eax, eax
jne 0x180258eff
lea rcx, [rsp + 0x98]
call fcn.180154a00
lea r8, [rsp + 0x4e0]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xb8]
call fcn.18025c540
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x918]
call fcn.18025c590
nop
lea rax, [rsp + 0xb8]
mov rcx, rax
call fcn.180004990
mov dword [rsp + 0x44], 0x400
mov dword [rsp + 0x48], 0x400
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xe0]
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x70]
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x4e0]
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x78]
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
jmp 0x180258e22
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x908]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x41], 1
lea rcx, [rsp + 0x98]
call fcn.180004990
movzx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.180385c10
add rsp, 0x8f0
pop rdi
ret
Function at 0x1802615e0
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x240
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x18026172d
mov edx, dword [rdx + 8]
xor esi, esi
sub edx, 0x100
je 0x180261640
sub edx, 4
je 0x180261640
cmp edx, 0x12f
jne 0x180261729
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x38]
mov esi, 1
mov eax, esi
jmp 0x18026172f
cmp qword [rbx + 0x10], 0x1b
jne 0x180261686
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x103
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.RCInplaceEdit
lea rcx, [rsp + 0x20]
call fcn.180154610
test al, al
jne 0x18026172d
mov eax, dword [rbx + 8]
sub eax, 0x100
test eax, 0xfffffffb
jne 0x180261729
cmp qword [rbx + 0x10], 0xe5
mov qword [rsp + 0x270], rbp
mov qword [rsp + 0x278], rdi
mov edi, dword [rbx + 0x10]
jne 0x1802616c1
mov rcx, qword [rbx]
call qword [sym.imp.IMM32.dll_ImmGetVirtualKey]
mov edi, eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
mov ebp, 0x8000
bts ebx, 0x1f
mov ecx, 0x12
and ax, bp
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, 0x10
bts edi, 0x1e
and ax, bp
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, edi
mov rcx, r14
bts edx, 0x1d
and ax, bp
cmove edx, edi
call fcn.180261b20
mov rdi, qword [rsp + 0x278]
test al, al
mov rbp, qword [rsp + 0x270]
setne sil
mov eax, esi
jmp 0x18026172f
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180385c10
add rsp, 0x240
pop r14
pop rsi
pop rbx
ret
Function at 0x18026d710
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
cmp qword [rcx + 0x60], 0
jne 0x18026d83e
xor esi, esi
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x20], 7
mov word [rsp + 0x30], si
lea r8d, [rsi + 0x26]
lea rdx, str.02099BA0_F791_4224_AD07_4C4EA722B792
lea rcx, [r11 - 0x38]
call fcn.180004e70
nop
lea ecx, [rsi + 0x10]
call fcn.180385c34
mov rbx, rax
mov qword [rsp + 0x28], rax
mov qword [rax], rsi
mov word [rax + 8], si
cmp qword [rsp + 0x40], rsi
je 0x18026d7a6
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
jmp 0x18026d7a9
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x18026d7cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18026d7cc
mov byte [rbx + 9], 1
mov qword [rdi + 0x60], rbx
cmp qword [rbx], 0
jne 0x18026d860
mov rcx, rbx
call fcn.18026b330
mov qword [rdi + 0x60], rsi
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18026d82b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18026d826
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18026d826
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180385c10
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18026d8a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18026d8a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18026d8a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov al, 1
jmp 0x18026d840
Function at 0x1802b7a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r13, rcx
mov r15d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r14, qword [r11]
mov r10, qword [rax + 8]
movsxd rax, dword [r10 + 0x30]
movsxd r10, dword [r11 + 0x30]
cmp eax, r10d
mov qword [rsp + 0x20], rax
mov ecx, r10d
cmovl ecx, eax
xor ebx, ebx
imul r15, rax
mov dword [rsp + 0x78], ecx
mov rcx, rax
cmp eax, r10d
je 0x1802b7a63
cmp byte [r14 + 0x10], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r15
sub rdi, rcx
test ebx, ebx
jne 0x1802b7c04
mov qword [rsp + 0x88], rbp
mov rbp, r10
mov qword [rsp + 0x30], rsi
cmp rdi, r15
jge 0x1802b7be6
mov rax, rdi
mov qword [rsp + 0x70], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x1804ceed8]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x1802b7bdb
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, r10d
mov rcx, r14
call qword [r14 + 0x108]
mov ebx, eax
test eax, eax
jne 0x1802b7b82
mov rcx, qword [rsp + 0x70]
test byte [rcx + 0x34], 4
mov rdx, qword [rcx + 0x28]
je 0x1802b7b09
mov eax, dword [rcx + 0x30]
cmp dword [rdx + 0x1c], eax
jb 0x1802b7b09
cmp dword [rdx + 0x80], ebx
je 0x1802b7b05
call fcn.1802a3b10
jmp 0x1802b7b2a
xor ebx, ebx
jmp 0x1802b7b35
mov ebx, dword [rdx + 0x2c]
test ebx, ebx
jne 0x1802b7b87
mov eax, dword [rdx + 0xbc]
cmp dword [rdx + 0xb8], eax
jbe 0x1802b7b25
call fcn.1802a5400
jmp 0x1802b7b2a
call fcn.1802a5230
mov rcx, qword [rsp + 0x70]
mov ebx, eax
test eax, eax
jne 0x1802b7b87
add rsi, qword [rcx + 8]
mov rax, rdi
movsxd r8, dword [rsp + 0x78]
cqo
idiv qword [rsp + 0x20]
mov rcx, rsi
add rdx, qword [rsp + 0x80]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x10]
mov byte [rcx], 0
test rdi, rdi
jne 0x1802b7b82
test r12d, r12d
jne 0x1802b7b82
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x3c]
btr eax, 0x1f
bswap eax
mov dword [rsi + 0x1c], eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1802b7bdb
test byte [rcx + 0x34], 0x20
je 0x1802b7bd6
mov r8, qword [rcx + 0x28]
mov rax, qword [r8 + 0xa8]
dec dword [r8 + 0x98]
mov qword [rcx + 0x20], rax
mov r9, qword [r8 + 0x48]
movsxd rax, dword [r8 + 0xbc]
mov qword [r8 + 0xa8], rcx
mov edx, dword [rcx + 0x30]
mov r8, qword [rcx + 8]
dec edx
mov r10, qword [r9]
mov rcx, r9
imul rdx, rax
call qword [r10 + 0x90]
jmp 0x1802b7bdb
call fcn.18029efb0
add rdi, rbp
test ebx, ebx
je 0x1802b7a81
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rbp, qword [rsp + 0x88]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x1802caee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.180294f00
mov rbx, rax
test rax, rax
jne 0x1802caf1e
lea eax, [rbx + 7]
jmp 0x1802cafa6
cmp byte [0x1804cb134], 0
je 0x1802caf73
mov rax, qword [0x1804cb2b8]
test rax, rax
je 0x1802caf3e
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1802caf73
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x180297f10]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x1802caf88
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x1802cafa1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1802d77e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov rbx, rdx
mov r14, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0xad
jne 0x1802d77fd
movzx eax, byte [rbx + 2]
cmp al, 0xae
jne 0x1802d7807
mov rax, qword [rbx + 0x20]
jmp 0x1802d7817
cmp al, 0x88
jne 0x1802d78b4
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1802d78b4
mov qword [rsp + 0x50], rdi
xor edi, edi
mov dword [r8], edi
cmp dl, 0x88
jne 0x1802d7849
mov rdx, rbx
mov rcx, r14
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rbx
jmp fcn.1802d5560
mov eax, dword [r14 + 0x38]
mov qword [rsp + 0x40], rbp
mov rbp, rcx
mov qword [rsp + 0x20], r15
lea r15d, [rax + 1]
add eax, ecx
mov dword [r14 + 0x38], eax
test ecx, ecx
jle 0x1802d78af
mov qword [rsp + 0x48], rsi
mov esi, r15d
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, r14
mov rdx, qword [rdx + rdi + 8]
call fcn.1802d90f0
inc esi
lea rdi, [rdi + 0x20]
sub rbp, 1
jne 0x1802d7870
mov rsi, qword [rsp + 0x48]
mov eax, r15d
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rbx
ret
mov eax, r15d
jmp 0x1802d7898
mov rdx, rbx
mov rcx, r14
add rsp, 0x28
pop r14
pop rbx
jmp fcn.1802d8f60