joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000fc80
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xa8]
sub rsp, 0x190
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180079370]
xor rax, rsp
mov qword [rbp + 0x80], rax
movzx eax, byte [0x18007c011]
test al, al
jne 0x18000ff01
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.18003c5d0
mov r9d, 1
lea r8d, [r9 + 0x19]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x18000fefa
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
mov r8d, 0x14
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x48]
call fcn.180004f50
nop
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
cmp byte [rsp + 0x70], 0
jne 0x18000fd4e
xor r8d, r8d
jmp 0x18000fd6a
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000fd60
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.180004f50
mov r15, qword [rsp + 0x58]
lea r14, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r14, qword [rsp + 0x48]
test r15, r15
je 0x18000fe23
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x18000fe1c
cmp r15, rbx
ja 0x18000fe1c
sub rbx, r15
inc rbx
lea rsi, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rsi, qword [rsp + 0x28]
nop
test rbx, rbx
je 0x18000fe1c
movsx edx, byte [r14]
mov r8, rbx
mov rcx, rsi
call fcn.18003c820
mov rdi, rax
test rax, rax
je 0x18000fe1c
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.18003c850
test eax, eax
je 0x18000fdfd
sub rsi, rdi
dec rsi
add rbx, rsi
lea rsi, [rdi + 1]
jmp 0x18000fdc0
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rax, rcx
sub rdi, rax
cmp rdi, 0xffffffffffffffff
jne 0x18000fe28
jmp 0x18000fe2f
mov rcx, qword [rsp + 0x28]
jmp 0x18000fe2f
mov rcx, qword [rsp + 0x28]
mov byte [0x18007c011], 1
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x18000fe84
inc rax
cmp rax, 0x1000
jb 0x18000fe7f
test byte [rsp + 0x28], 0x1f
je 0x18000fe52
call fcn.18003dfc0
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000fe61
call fcn.18003dfc0
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000fe70
call fcn.18003dfc0
int3
cmp rcx, 0x27
jbe 0x18000fe7c
call fcn.18003dfc0
int3
mov rcx, rax
call fcn.18001b21c
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x18000fefa
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x18000fef5
test cl, 0x1f
je 0x18000fec1
call fcn.18003dfc0
int3
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax - 8]
cmp rcx, rax
jb 0x18000fed5
call fcn.18003dfc0
int3
mov rax, qword [rsp + 0x48]
sub rax, rcx
cmp rax, 8
jae 0x18000fee9
call fcn.18003dfc0
int3
cmp rax, 0x27
jbe 0x18000fef5
call fcn.18003dfc0
int3
call fcn.18001b21c
movzx eax, byte [0x18007c011]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.18001b720
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180010300
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov ebp, r9d
mov edi, r8d
mov rsi, rdx
mov r14, rcx
xor bl, bl
call fcn.18000fbb0
mov r15d, 1
test al, al
je 0x180010386
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call fcn.18000fac0
test al, al
je 0x180010386
mov r8, qword [rsp + 0x30]
mov r9d, r15d
mov edx, edi
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x180010386
movzx eax, bl
jmp 0x1800103a4
mov r9d, ebp
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
cmovne ecx, r15d
movzx eax, cl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x1800103c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov ebp, r9d
mov edi, r8d
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.18000fc80
test al, al
jne 0x18001040c
mov r9d, ebp
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x18001040c
lea eax, [rbx + 1]
jmp 0x18001045f
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x30]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x18001045d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x18001045d
mov r8, qword [rsp + 0x30]
mov r9d, 1
mov edx, edi
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x18001045d
lea ebx, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180010fe0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180079370]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x18001102b
xor eax, eax
jmp 0x180011232
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rcx], bx
jne 0x180011048
mov r8, rbx
jmp 0x18001105a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rcx + r8*2], bx
jne 0x180011050
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.180009bb0
nop
lea rcx, [rsp + 0x50]
call fcn.1800130c0
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp - 0x70]
call fcn.18003c5d0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180011213
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180011209
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
cmp word [rbp - 0x44], 0
jne 0x1800110d4
mov r8, rbx
jmp 0x1800110eb
lea rax, [rbp - 0x44]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800110e0
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x30]
call fcn.180009bb0
nop
lea rcx, [rsp + 0x30]
call fcn.1800130c0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
call fcn.1800096c0
test eax, eax
je 0x180011183
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.180012ab0
or edi, 1
lea r9, [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x180011159
mov rax, qword [rax]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov r9, qword [r9]
mov r8, rax
mov rdx, qword [rsp + 0x60]
call fcn.1800096c0
test eax, eax
je 0x180011183
xor sil, sil
jmp 0x180011186
mov sil, 1
test dil, 1
je 0x1800111ab
and edi, 0xfffffffe
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x1800111ab
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.180009d00
test sil, sil
jne 0x1800111de
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1800111cd
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180009d00
lea rdx, [rbp - 0x70]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
jmp 0x1800110ad
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x68]
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x180011213
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180009d00
jmp 0x180011213
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x180011230
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.180009d00
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.18001b720
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180011450
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180079370]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.18003c5d0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r14, 0xffffffffffffffff
cmp word [rdi], bx
jne 0x1800114bf
mov r8d, ebx
jmp 0x1800114cc
mov r8, r14
inc r8
cmp word [rdi + r8*2], bx
jne 0x1800114c2
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180009bb0
nop
lea rcx, [rsp + 0x28]
call fcn.1800130c0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001162a
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180011620
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rbp - 0x64], 0
jne 0x180011537
mov r8, rbx
jmp 0x18001154b
lea rax, [rbp - 0x64]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180011540
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.180009bb0
nop
lea rcx, [rsp + 0x48]
call fcn.1800130c0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 8
cmovae rdx, rdi
mov r10, qword [rsp + 0x38]
mov r8, r10
mov r11, qword [rsp + 0x58]
cmp r11, r10
cmovb r8, r11
test r8, r8
jmp 0x1800115ca
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x1800115bb
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x1800115ca
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r14d
jmp 0x1800115cf
jne 0x1800115a5
mov r8d, ebx
test r8d, r8d
jne 0x1800115db
cmp r11, r10
jb 0x1800115db
jbe 0x180011604
cmp r9, 8
jb 0x1800115f2
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180009d00
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180011510
mov ebx, 1
cmp r9, 8
jb 0x180011620
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180009d00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x180011647
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.180009d00
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18001b720
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180012580
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
lea rax, [r11 - 0x28]
mov rsi, r9
mov qword [r11 - 0x28], rbp
mov rdi, r8
mov qword [r11 - 0x20], rbp
mov rbx, rcx
mov qword [r11 - 0x18], rbp
mov r9d, 0xf013f
mov qword [r11 - 0x10], rbp
xor r8d, r8d
mov qword [r11 - 0x58], rax
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800126e0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov r9d, 0xf013f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftWare
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800126d5
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rbx
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1800126ca
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1800126bf
mov rcx, qword [rsp + 0xa0]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x180012682
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180012700
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
xor r14d, r14d
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x18], r14
mov rbp, r8
mov qword [r11 - 0x20], r14
mov rsi, rdx
mov qword [r11 - 0x28], r14
mov rdi, rcx
mov qword [r11 - 0x58], rax
mov r9d, 0xf013f
lea rdx, str.SoftWare
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180012844
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180012839
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1800127e9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
jmp 0x18001283e
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x1800127f0
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18001f00c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18001f01f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18001f684
lea rdx, [0x180076f30]
lea rcx, [rsp + 0x20]
call fcn.18003be30
int3

Function at 0x180029d10
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x18007ebd0]
xor edx, edx
jmp fcn.18001f00c

Function at 0x18002a710
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x18007ebd0]
jmp fcn.18001f00c
Function at 0x1400015a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov esi, r8d
mov qword [rcx + 0x408], rbx
lea rax, vtable.MusicLab::CXFileReadBuff.0
mov qword [rcx], rax
mov rbp, rdx
mov qword [rcx + 0x410], rbx
mov rdi, rcx
mov qword [rcx + 0x418], rbx
mov qword [rcx + 0x420], rbx
test r8d, r8d
je 0x1400016f1
test rdx, rdx
je 0x1400016f1
cmp esi, 0x400
ja 0x140001602
lea rax, [rcx + 8]
jmp 0x14000160a
mov rcx, rsi
call fcn.140055b3c
mov qword [rdi + 0x408], rax
cmp qword [rbp + 8], rbx
je 0x14000162b
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14000162b
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rdi + 0x410], rbp
lea r8, [rsp + 0x50]
mov rcx, qword [rbp + 8]
mov r9d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
mov rcx, rbx
cmovne rcx, qword [rsp + 0x50]
mov qword [rdi + 0x418], rcx
mov rdx, qword [rdi + 0x408]
test rdx, rdx
je 0x1400016a8
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400016a8
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
mov r8d, esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400016a8
cmp dword [rsp + 0x60], esi
jne 0x1400016a8
mov dword [rdi + 0x420], esi
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rdi + 0x410]
test rax, rax
je 0x1400016d0
cmp qword [rax + 8], rbx
je 0x1400016c9
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x1400016c9
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rdi + 0x410], rbx
mov rcx, qword [rdi + 0x408]
test rcx, rcx
je 0x1400016f1
lea rax, [rdi + 8]
cmp rcx, rax
je 0x1400016ea
call fcn.140055b28
mov qword [rdi + 0x408], rbx
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001cc0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140001ce4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
xor esi, esi
test rcx, rcx
je 0x140001d08
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10000080
mov edx, 0xc0000000
mov rcx, rdi
mov qword [rbx + 8], rsi
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140001d46
mov qword [rbx + 8], rsi
jmp 0x140001d79
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140001d68
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
setne al
add rsp, 0x40
pop rdi
ret

Function at 0x140001d90
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140001dbc
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov qword [rbx], rax
setne al
add rsp, 0x20
pop rbx
ret

Function at 0x140001de0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x140001ea6
cmp byte [rcx + 0x30], 0
jne 0x140001ea6
cmp dword [rcx + 0x24], 0
je 0x140001ea6
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140001e2d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140001ea6
mov qword [rbx + 8], rsi
mov byte [rbx + 0x30], 0
cmp edi, 0xfffffff1
jge 0x140001e5a
mov edi, 0xfffffff1
jmp 0x140001e64
mov eax, 0xf
cmp edi, eax
cmovg edi, eax
lea rax, [rsp + 0x40]
mov dword [rbx + 0x34], edi
mov qword [rsp + 0x28], rax
lea r8, [0x140002b40]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx], rax
setne al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140002020
Capabilities:
Print debug messages
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rcx + 0x30], 1
cmp qword [rcx], 0
je 0x140002118
cmp dword [rcx + 0x24], 0
jle 0x140002057
mov rax, qword [rcx + 0x28]
inc dword [rax + 0x10]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140002057
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x3a98
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test eax, eax
je 0x140002108
lea rcx, [rsp + 0x30]
call fcn.140014cb0
nop
cmp edi, 0x102
jne 0x140002090
lea rdx, str.Thread__p_does_not_exit_within__u_seconds.
mov edi, 0xf
jmp 0x140002097
lea rdx, str.Cant_wait_for_the_thread__p:_WaitForSingleObject_returned__08X.
mov r9d, edi
mov r8, qword [rbx]
lea rcx, [rsp + 0x30]
call fcn.140015460
lea rdx, str._This_thread_will_be_terminated._n
lea rcx, [rsp + 0x30]
call fcn.140015020
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, 0xffffffff
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x1400020fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rbx]
lea rdx, str.Cannot_terminate_the_thread__p:_error__u__n
lea rcx, [rsp + 0x30]
call fcn.140015460
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
lea rcx, [rsp + 0x30]
call fcn.140014d00
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret