joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008b70
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r15d, r15d
mov qword [rsp + 0xc8], rbx
mov r14, r8
mov r12, rdx
mov r13, rcx
mov edi, 0x200
mov dword [rsp + 0x40], r15d
mov esi, r15d
mov qword [rsp + 0x70], rbp
cmp esi, 1
jne 0x180008bc3
mov edi, 0x400
jmp 0x180008c55
cmp esi, 2
jne 0x180008c55
xor eax, eax
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, r13
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180008cf3
cmp dword [0x1801030e0], r15d
je 0x180008c45
lea r9, str.CDiskInfoHelper::ReadFileBySectorSize_2
lea r8, str.Asset
lea rcx, [0x1801027f8]
or edx, 0xffffffff
call fcn.180072a80
mov edi, dword [rsp + 0x5c]
cmp edi, 0x200
jb 0x180008d19
mov ecx, edi
mov ebp, edi
call fcn.180039e84
mov rbx, rax
test rax, rax
je 0x180008c75
mov r8d, ebp
xor edx, edx
mov rcx, rax
call fcn.180038130
jmp 0x180008c78
mov rbx, r15
mov r8, rbp
xor edx, edx
mov rcx, rbx
mov qword [r12], rbx
call fcn.180038130
mov rdx, qword [r12]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rcx, r13
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
jne 0x180008cc1
mov rcx, qword [r12]
call fcn.1800390b8
inc esi
mov qword [r12], r15
cmp esi, 3
jl 0x180008bb4
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov eax, ebx
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180038100
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
cmp dword [0x1801030e0], r15d
je 0x180008d19
lea r9, str.CDiskInfoHelper::ReadFileBySectorSize_1
lea r8, str.Asset
lea rcx, [0x1801027f8]
or edx, 0xffffffff
call fcn.180072a80
xor eax, eax
jmp 0x180008cca
Function at 0x180008d20
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edi, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.180038130
movzx eax, word [0x1800b3104]
xor ebx, ebx
mov word [rsp + 0x20], ax
movzx eax, byte [0x1800b3106]
mov byte [rsp + 0x22], al
test edi, edi
je 0x180008d7a
cmp edi, 1
jne 0x180008d8a
call fcn.18002cb70
test eax, eax
jne 0x180008d8a
mov eax, 4
jmp 0x180008df5
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
add dil, 0x41
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
dec eax
cmp eax, 0x102
ja 0x180008df3
lea rcx, [rsp + 0x30]
call fcn.180039bfc
lea rdx, str.cdrom
lea rcx, [rsp + 0x30]
call fcn.1800393f4
mov ecx, 5
lea rdx, str.floppy
test rax, rax
cmovne ebx, ecx
lea rcx, [rsp + 0x30]
call fcn.1800393f4
test rax, rax
mov eax, 4
jne 0x180008df5
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180038100
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x180008e20
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x98
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov rbp, rdx
test rdx, rdx
je 0x180008ff6
cmp r8d, 0x200
jne 0x180008ff6
xor eax, eax
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
add cx, 0x41
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x18], rsi
movabs rax, 0x5c003a0041
mov qword [r11 - 0x60], rax
lea rax, [r11 - 0x58]
mov word [rsp + 0x48], cx
mov qword [r11 - 0x78], rax
lea rax, [r11 - 0x64]
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x80], rax
lea rax, [r11 - 0x68]
lea rcx, [r11 - 0x60]
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x28], r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180008f9e
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
lea r8d, [rbx + 5]
lea rdx, str.FAT16
not rcx
lea rsi, [rcx - 1]
lea rcx, [rbp + 0x36]
call fcn.180044bb0
lea edi, [rbx + 3]
test eax, eax
jne 0x180008f2c
cmp esi, 5
jne 0x180008f0c
mov r8d, esi
lea rdx, [0x1800b3140]
jmp 0x180008f1a
cmp esi, edi
jne 0x180008f2c
mov r8, rdi
lea rdx, [0x1800b3138]
lea rcx, [rsp + 0x50]
call fcn.1800a7d58
test eax, eax
je 0x180008fda
lea rdx, str.FAT12
lea rcx, [rbp + 0x36]
mov r8d, 5
call fcn.180044bb0
test eax, eax
jne 0x180008f62
cmp esi, edi
jne 0x180008f62
lea rdx, [0x1800b3138]
lea rcx, [rsp + 0x50]
mov r8, rdi
call fcn.1800a7d58
test eax, eax
je 0x180008fda
lea rcx, [rbp + 0x52]
lea rdx, str.FAT32
mov r8d, 5
call fcn.180044bb0
test eax, eax
jne 0x180008f9e
cmp esi, 5
jne 0x180008f9e
lea rdx, [0x1800b3118]
lea rcx, [rsp + 0x50]
mov r8d, esi
call fcn.1800a7d58
test eax, eax
jne 0x180008f9e
lea edi, [rsi - 3]
jmp 0x180008fda
lea rdx, str.EXFAT
lea rcx, [rbp + 3]
mov r8d, 5
call fcn.180044bb0
test eax, eax
jne 0x180008fbd
lea edi, [rax + 5]
jmp 0x180008fda
lea rdx, str.NTFS
lea rcx, [rbp + 3]
mov r8d, 4
call fcn.180044bb0
test eax, eax
sete bl
mov edi, ebx
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov eax, edi
mov rdi, qword [rsp + 0x88]
jmp 0x180008ff8
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180038100
add rsp, 0x98
pop rbp
pop rbx
ret
Function at 0x18000a5a0
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1d8], rbx
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x18000a767
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000a767
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000a767
test al, 0x10
je 0x18000a767
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.180019eb0
nop
mov dl, 0x5c
lea rcx, [rsp + 0x20]
call fcn.180017960
mov dword [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x13c
lea rcx, [rsp + 0x54]
call fcn.180038130
lea r8, [0x1800b292c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.18001a240
lea rdx, [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
lea rcx, [rsp + 0x40]
call fcn.180016760
cmp rdi, 0xffffffffffffffff
je 0x18000a756
lea rdx, [0x1800b2ed8]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000a72b
lea rdx, [0x1800b2ed4]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000a72b
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.180019eb0
nop
test byte [rsp + 0x50], 0x10
je 0x18000a717
lea r8, [0x1800b28c8]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001a240
nop
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.18001a1e0
nop
mov r8d, esi
mov rdx, rbx
mov rcx, qword [rax]
call fcn.18000a5a0
nop
lea rcx, [rsp + 0x30]
call fcn.180016760
nop
lea rcx, [rsp + 0x38]
call fcn.180016760
jmp 0x18000a719
inc dword [rbx]
test esi, esi
je 0x18000a721
cmp esi, dword [rbx]
jbe 0x18000a742
lea rcx, [rsp + 0x28]
call fcn.180016760
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x18000a74c
jmp 0x18000a680
lea rcx, [rsp + 0x28]
call fcn.180016760
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x20]
call fcn.180016760
mov eax, 1
jmp 0x18000a769
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.180038100
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000a7d0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x18000a892
test rdx, rdx
je 0x18000a892
mov rax, qword [0x180100458]
mov qword [rsp + 0x30], rbp
mov ebp, dword [rdx]
test rax, rax
jne 0x18000a844
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000a838
lea rdx, str.GetComputerNameExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180100458], rax
jmp 0x18000a83f
mov rax, qword [0x180100458]
test rax, rax
je 0x18000a869
mov r8, rbx
mov rdx, rsi
mov ecx, edi
call rax
mov r11d, eax
test eax, eax
je 0x18000a869
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jne 0x18000a87a
mov rdx, rbx
mov rcx, rsi
mov dword [rbx], ebp
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r11d, eax
mov eax, r11d
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x18000c780
Capabilities:
Check if file exists
Get disk size
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r12, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
test rcx, rcx
je 0x18000c887
test rdx, rdx
jne 0x18000c7d3
test r8, r8
jne 0x18000c7d3
test r9, r9
je 0x18000c887
mov word [rsp + 0x30], bx
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x32]
call fcn.180038130
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.18001aa60
nop
nop dword [rax + rax]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000c82e
test al, 0x10
je 0x18000c82e
mov r9, r12
mov r8, rbp
mov rdx, rsi
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, eax
test eax, eax
jne 0x18000c87d
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call fcn.180038130
mov r8d, 0x207
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call fcn.18002da80
test eax, eax
je 0x18000c87d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call fcn.18003a234
test eax, eax
je 0x18000c87d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180018240
jmp 0x18000c800
lea rcx, [rsp + 0x20]
call fcn.1800180c0
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180038100
add rsp, 0x450
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000f060
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rsi, rcx
mov rcx, rdx
mov ebp, r8d
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp eax, 0xffffffff
je 0x18000f14d
test al, 1
je 0x18000f0b0
and ebx, 0xfffffffe
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x18000f14d
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x20], 0
call fcn.180038130
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str._s.bak_08X
lea rcx, [rsp + 0x20]
mov r9d, eax
mov r8, rdi
call fcn.180037dc8
lea rcx, [rsp + 0x20]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000f13f
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str._s.bak_08X
lea rcx, [rsp + 0x20]
mov r9d, eax
mov r8, rdi
call fcn.180037dc8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc ebx
cmp ebx, 0xa
jge 0x18000f18b
cmp eax, 0xffffffff
jne 0x18000f100
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rcx, rdi
mov ebx, eax
call fcn.18000a340
mov eax, ebx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180038100
mov rbx, qword [rsp + 0x268]
add rsp, 0x230
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x18000f168
Function at 0x18000f720
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x48
mov qword [rsp + 0x40], r13
xor r13d, r13d
mov rsi, rdx
mov r12, rcx
mov ebx, r13d
mov edi, r13d
mov qword [rdx], r13
test rcx, rcx
jne 0x18000f74e
lea edi, [rcx + 1]
jmp 0x18000f869
lea rax, [rsp + 0x80]
mov rdx, rcx
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x78], r13d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x70], r13d
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x18000f7a0
cmp eax, 0x7a
je 0x18000f7a0
lea edi, [rbx + 2]
jmp 0x18000f859
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x88], rbp
call fcn.180039e84
mov ecx, dword [rsp + 0x70]
mov qword [rsi], rax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180039e84
mov rcx, qword [rsi]
mov rbp, rax
test rcx, rcx
je 0x18000f83b
test rax, rax
je 0x18000f83b
mov r8d, dword [rsp + 0x78]
xor edx, edx
call fcn.180038130
mov r8d, dword [rsp + 0x70]
xor edx, edx
add r8, r8
mov rcx, rbp
call fcn.180038130
mov r8, qword [rsi]
lea r11, [rsp + 0x80]
mov qword [rsp + 0x30], r11
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rdx, r12
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test eax, eax
jne 0x18000f840
lea edi, [rax + 4]
jmp 0x18000f840
mov edi, 3
test rbp, rbp
je 0x18000f84d
mov rcx, rbp
call fcn.1800390b8
mov rbp, qword [rsp + 0x88]
test ebx, ebx
jne 0x18000f869
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000f869
call fcn.1800390b8
mov qword [rsi], r13
cmp dword [0x1801030e0], 0
mov r13, qword [rsp + 0x40]
je 0x18000f8b7
mov rax, qword [rsi]
test r12, r12
lea rcx, [0x1800b53d8]
cmovne rcx, r12
mov qword [rsp + 0x38], rax
lea r9, str.CKSecurity::GetSid_____ret:__d___myerror:__d___Name:__s___Sid:__08x_
mov qword [rsp + 0x30], rcx
lea r8, [0x1800b2d18]
lea rcx, [0x1801027f8]
or edx, 0xffffffff
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.180072a80
mov eax, ebx
add rsp, 0x48
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180010140
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r14d, r14d
mov r13d, r8d
mov r12, rdx
mov rbp, rcx
mov esi, r14d
mov edi, r14d
mov ebx, r14d
test rcx, rcx
jne 0x180010180
lea edi, [rcx + 1]
jmp 0x18001023c
xor eax, eax
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x5c], rax
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
mov qword [rsp + 0x5c], 8
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x1800101b4
lea edi, [rax + 2]
jmp 0x18001023c
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x18001023c
lea r8, [rsp + 0x50]
mov edx, ebx
mov rcx, rbp
mov qword [rsp + 0x50], r14
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x180010237
mov rdx, qword [rsp + 0x50]
test byte [rdx + 1], 0x10
jne 0x180010230
add rdx, 8
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1800101ff
inc ebx
cmp ebx, dword [rsp + 0x58]
jb 0x1800101c0
jmp 0x18001023c
mov esi, 1
cmp r13d, 0x10000000
jne 0x18001023c
mov rax, qword [rsp + 0x50]
cmp byte [rax], dil
jne 0x180010226
mov eax, dword [rax + 4]
and eax, 0x1f0000
cmp eax, 0x1f0000
je 0x18001023c
mov edi, 5
mov esi, r14d
jmp 0x18001023c
mov edi, 4
jmp 0x18001023c
mov edi, 3
cmp dword [0x1801030e0], r14d
je 0x18001027d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbp
lea r9, str.CKSecurity::IsInAcl_____Inner___ret:__d___myerror:__d___Acl:__08x___Sid:__08x___Mask:__08x___Index:__d_
lea r8, [0x1800b2d18]
lea rcx, [0x1801027f8]
or edx, 0xffffffff
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.180072a80
mov eax, esi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180038100
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180011c30
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
test rcx, rcx
jne 0x180011c5a
xor eax, eax
jmp 0x180011d05
mov qword [rsp + 0x468], rdi
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.180038130
lea rdx, str.TEC_OCULAR__AGENT_V3_MUTEX_OCPFRAME_RUN__s
lea rcx, [rsp + 0x20]
mov r8, rbx
call fcn.1800029c0
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], di
call fcn.180038130
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180004b10
lea r8, [rsp + 0x230]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x180011cef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
sete dil
mov eax, edi
jmp 0x180011cfd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rdi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180038100
add rsp, 0x450
pop rbx
ret
Function at 0x180011d20
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
test rcx, rcx
jne 0x180011d4a
xor eax, eax
jmp 0x180011dfa
mov qword [rsp + 0x468], rdi
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.180038130
lea rdx, str.TEC_OCULAR__AGENT_V3_MUTEX_OCPFRAME_RUN__s
lea rcx, [rsp + 0x20]
mov r8, rbx
call fcn.1800029c0
call fcn.180069e10
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov rbx, rax
mov word [rsp + 0x230], di
call fcn.180038130
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180004b10
lea r8, [rsp + 0x230]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x180011def
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180011def
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, edi
mov rdi, qword [rsp + 0x468]
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180038100
add rsp, 0x450
pop rbx
ret

Function at 0x180011e20
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
test rcx, rcx
jne 0x180011e4a
xor eax, eax
jmp 0x180011ef5
mov qword [rsp + 0x468], rdi
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.180038130
lea rdx, str.TEC_OCULAR__AGENT_V3_MUTEX_OCPFRAME_START__s
lea rcx, [rsp + 0x20]
mov r8, rbx
call fcn.1800029c0
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], di
call fcn.180038130
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180004b10
lea r8, [rsp + 0x230]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x180011edf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
sete dil
mov eax, edi
jmp 0x180011eed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rdi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180038100
add rsp, 0x450
pop rbx
ret
Function at 0x180011f10
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
test rcx, rcx
jne 0x180011f3a
xor eax, eax
jmp 0x180011fea
mov qword [rsp + 0x468], rdi
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.180038130
lea rdx, str.TEC_OCULAR__AGENT_V3_MUTEX_OCPFRAME_START__s
lea rcx, [rsp + 0x20]
mov r8, rbx
call fcn.1800029c0
call fcn.180069e10
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov rbx, rax
mov word [rsp + 0x230], di
call fcn.180038130
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180004b10
lea r8, [rsp + 0x230]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x180011fdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180011fdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, edi
mov rdi, qword [rsp + 0x468]
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180038100
add rsp, 0x450
pop rbx
ret

Function at 0x180013640
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x240
mov rsi, rcx
mov rdi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x214
mov dword [rsp + 0x20], 0
call fcn.180038130
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
call fcn.1800122d0
test eax, eax
je 0x1800136b5
cmp qword [rsp + 0x230], 0
je 0x1800136aa
mov rcx, qword [rsp + 0x230]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
mov rcx, rsi
call fcn.1800123c0
mov rsi, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret