joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c7350
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x450
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea ebp, [rdx - 0x418]
xor esi, esi
mov rbx, rcx
test ebp, ebp
jne 0x1800c73b6
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x60]
mov rcx, rax
test rax, rax
jne 0x1800c7397
mov eax, esi
jmp 0x1800c739d
mov rax, qword [rax]
call qword [rax + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1410
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1800c74e6
cmp ebp, 1
jne 0x1800c74e6
mov rax, qword [rcx]
mov qword [rsp + 0x480], rdi
mov qword [rsp + 0x488], r14
call qword [rax + 0x68]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x60]
mov rcx, rax
test rax, rax
jne 0x1800c73eb
mov r14, rsi
jmp 0x1800c73f4
mov rax, qword [rax]
call qword [rax + 8]
mov r14, rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
movzx eax, word [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov rdi, rsi
cmp ax, 0x30
jb 0x1800c7452
nop
cmp ax, 0x39
ja 0x1800c7452
movzx eax, ax
lea rdi, [rdi + rdi*4]
add rdx, 2
lea rdi, [rdi - 0x18]
lea rdi, [rax + rdi*2]
movzx eax, word [rdx]
cmp ax, 0x30
jae 0x1800c7430
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x140]
lea rdx, [rsp + 0x230]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
movzx eax, word [rsp + 0x230]
lea rdx, [rsp + 0x230]
mov rcx, rsi
cmp ax, 0x30
jb 0x1800c74c2
nop dword [rax + rax]
cmp ax, 0x39
ja 0x1800c74c2
movzx eax, ax
lea rcx, [rcx + rcx*4]
add rdx, 2
lea rcx, [rcx - 0x18]
lea rcx, [rax + rcx*2]
movzx eax, word [rdx]
cmp ax, 0x30
jae 0x1800c74a0
movsxd r9, ecx
mov edx, 0x1411
mov rcx, r14
movsxd r8, edi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r14, qword [rsp + 0x488]
mov rdi, qword [rsp + 0x480]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1800c7527
mov rcx, qword [rbx + 0x140]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1800c7527
mov rcx, qword [rbx + 0x68]
cmp ebp, 1
sete sil
mov edx, esi
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x140]
mov edx, esi
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x450
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800c7d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rcx
lea rax, vtable.RC::RCWidgetView.0
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov byte [rcx + 0x28], 1
mov qword [rcx + 0x2c], rsi
mov qword [rcx + 0x34], rsi
mov word [rcx + 0x3c], 0x101
mov dword [rcx + 0x40], esi
mov dword [rcx + 0x44], 0xffffffff
mov byte [rcx + 0x48], sil
lea rax, vtable.RC::RCWidgetListView.0
mov qword [rcx], rax
mov qword [rcx + 0x50], rsi
mov dword [rcx + 0x58], esi
lea rbx, [rcx + 0x60]
mov qword [rsp + 0x48], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.18008d200
mov qword [rbx], rax
mov dword [rdi + 0x70], 0xffffffff
movzx ecx, byte [0x1806703ae]
test cl, cl
je 0x1800c7d9c
lea eax, [rsi + 0x1c]
jmp 0x1800c7db9
mov r8d, 0x60
mov edx, dword [0x180670f48]
lea ecx, [r8 - 0x44]
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx ecx, byte [0x1806703ae]
mov dword [rdi + 0x74], eax
test cl, cl
je 0x1800c7dc7
mov eax, 0x18
jmp 0x1800c7ddd
mov r8d, 0x60
mov edx, dword [0x180670fcc]
lea ecx, [r8 - 0x48]
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rdi + 0x78], eax
mov qword [rdi + 0x80], rsi
lea rax, [rdi + 0x88]
mov qword [rsp + 0x48], rax
mov qword [rax + 0x38], rsi
lea rax, [rdi + 0xc8]
mov qword [rsp + 0x48], rax
mov qword [rax + 0x38], rsi
mov qword [rdi + 0x108], rsi
mov byte [rdi + 0x110], 0
mov qword [rdi + 0x114], rsi
lea rbx, [rdi + 0x120]
mov qword [rsp + 0x48], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.18008d200
mov qword [rbx], rax
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800c91a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rbx, r8
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x1800c932f
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x1800c932f
mov rcx, qword [rdi + 0x108]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
test rcx, rcx
je 0x1800c9224
mov rax, qword [rcx]
call qword [rax + 0x38]
test al, al
je 0x1800c9224
mov rax, qword [rdi + 0x108]
mov ecx, dword [rdi + 0x78]
mov r8d, dword [rax + 0x68]
mov eax, r8d
cdq
idiv ecx
imul ecx, eax
mov r14d, eax
cmp ecx, r8d
jge 0x1800c9227
inc r14d
jmp 0x1800c9227
xor r14d, r14d
cmp byte [rdi + 0x110], 0
jne 0x1800c926d
mov byte [rdi + 0x110], 1
lea rdx, [rdi + 0x60]
mov rax, qword [rbx]
lea r8, [rdi + 0x120]
mov qword [rdi + 0x114], rax
cmp r8, rdx
je 0x1800c926d
mov rax, qword [rdx]
mov rcx, qword [r8]
mov qword [r8], rax
mov qword [rdx], rcx
mov rax, qword [rdx + 8]
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x60]
call fcn.18008d130
mov eax, dword [rbx + 4]
mov ebp, dword [rdi + 0x118]
cmp ebp, eax
mov esi, ebp
cmovge esi, eax
sub esi, dword [rdi + 0x74]
cmp eax, ebp
cmovge ebp, eax
sub ebp, dword [rdi + 0x74]
cmp esi, ebp
jg 0x1800c92dd
movzx ebx, byte [rsp + 0x78]
nop word [rax + rax]
test ebp, ebp
jle 0x1800c9314
test esi, esi
jle 0x1800c92d6
mov eax, esi
cdq
idiv dword [rdi + 0x78]
lea ecx, [rax + r14]
mov dword [rsp + 0x78], ecx
test ecx, ecx
js 0x1800c92d6
cmp ecx, dword [rdi + 0x58]
jge 0x1800c92d6
lea r9, [rsp + 0x78]
mov byte [rsp + 0x20], bl
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x60]
call fcn.1800c98e0
add esi, dword [rdi + 0x78]
cmp esi, ebp
jle 0x1800c92a0
test ebp, ebp
jle 0x1800c9314
mov eax, ebp
cdq
idiv dword [rdi + 0x78]
lea edx, [rax + r14]
mov dword [rsp + 0x78], edx
test edx, edx
js 0x1800c9314
cmp edx, dword [rdi + 0x58]
jge 0x1800c9314
movzx eax, byte [rsp + 0x78]
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x20], al
lea rcx, [rdi + 0x60]
call fcn.1800c98e0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0xd0]
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800cc710
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x1800cc7c5
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x1800cc791
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800cc7b0
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800cc7b0
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x1800cc7b0
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x18067c078], 0
jne 0x1800cc810
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800cc800
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18067c070], rax
mov byte [0x18067c078], 1
jmp 0x1800cc817
mov rax, qword [0x18067c070]
mov byte [0x18067c078], 1
jmp 0x1800cc817
mov rax, qword [0x18067c070]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x1800cc79a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
Function at 0x1800cc940
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.1800cc840
mov ebx, eax
test eax, eax
jne 0x1800cca67
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1800cca41
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800cc940
mov ebx, eax
test eax, eax
jne 0x1800cca67
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800cc9f0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800cca56
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov rdx, rsi
mov rcx, rdi
call fcn.1800cc710
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800cca7c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov eax, ebx
mov dword [rsp + 0x50], ebp
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800cd070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800cd0fe
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800cd0fe
call fcn.1800cc470
mov ebx, eax
jmp 0x1800cd220
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1800cd11f
call fcn.1800cc470
jmp 0x1800cd20f
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1800cd142
call fcn.1800cc470
jmp 0x1800cd20f
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1800cd164
mov ebx, 0x8007000e
jmp 0x1800cd211
mov ecx, eax
test eax, eax
je 0x1800cd199
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1800cd258
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1800cd199
lea rcx, [rsp + 0x70]
call fcn.1800d2130
jmp 0x1800cd1a3
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1800cd1b6
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x1800cd1c7
mov ebx, 0x8007000e
jmp 0x1800cd211
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1800cd1ec
call fcn.1800cc470
jmp 0x1800cd20f
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800ce020
mov ebx, eax
test rdi, rdi
je 0x1800cd220
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1800cd237
lea rcx, [rsp + 0x70]
call fcn.1800d2120
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.180085dd0
int3
Function at 0x1800e1b60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
mov rax, rcx
mov qword [rcx + 0x10], rdi
jb 0x1800e1b95
mov rax, qword [rcx]
xor edx, edx
mov word [rax], di
mov r8d, 0x412
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1800e1bc2
xor al, al
jmp 0x1800e1bf9
cmp eax, 0x208
jae 0x1800e1bbe
mov word [rsp + 0x430], di
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x1800e1be0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18007d760
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret

Function at 0x1800e38b0
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
jne 0x1800e38e6
xor al, al
jmp 0x1800e399c
mov qword [rsp + 0x38], 0
add rdi, 0x38
mov qword [rsp + 0x38], rdi
je 0x1800e3909
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800e3909
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x1800e397b
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x1800e3520]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x1800e39b4
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jne 0x1800e3972
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbx + 0x10]
call fcn.1800e36d0
xor bl, bl
test rdi, rdi
je 0x1800e3999
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800e3990
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x38], 0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rax + 0x10], 1
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x1800e39d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1800e395a
mov bl, 1
jmp 0x1800e397d
Function at 0x1800e4850
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x1800e488e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1800e8760
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x1800e48b4
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x1800e48c7
cmp qword [rsi + 0x18], 8
jb 0x1800e48ca
mov rsi, qword [rsi]
jmp 0x1800e48ca
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x1800e48ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800e48ee
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800e4915
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800e4928
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.18042ce14
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800e4960
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x1800e49a5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov word [rdi + 8], r14w
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.1800e8880
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rbp, [rbx + 0x10]
jne 0x1800e49cc
mov rbp, r14
cmp qword [rsi + 0x10], 0
je 0x1800e49e2
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1800e49e5
mov r8, qword [rsi]
jmp 0x1800e49e5
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
jne 0x1800e4a33
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1800e4a33
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsi + 0x10], 0
je 0x1800e4a1f
cmp qword [rsi + 0x18], 8
jb 0x1800e4a22
mov rsi, qword [rsi]
jmp 0x1800e4a22
mov rsi, r14
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
mov rax, qword [rdi]
test rax, rax
je 0x1800e4a5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800e4a4c
mov byte [rdi + 9], 1
mov rcx, qword [rdi]
call fcn.1800e7500
mov rax, qword [rdi]
test rax, rax
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800e4a7d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800e4a90
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.18042ce14
mov qword [rsp + 0x28], r14
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800e51c0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x1800e51fd
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1800e5210
mov al, 1
jmp 0x1800e52be
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1800e59a0
test al, al
je 0x1800e5261
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1800e5261
mov bl, 1
jmp 0x1800e5263
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1800e52a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e52a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800e52a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18042ce14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1800e52e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x1800e5315
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1800e53c6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1805bf050]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1800e59a0
test al, al
je 0x1800e536e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1800e53b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e53ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800e53ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18042ce14
movdqa xmm0, xmmword [0x1805bf050]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1800e5730
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
cmp qword [rdi + 0x18], 8
jb 0x1800e5772
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x1800e577c
mov rbx, qword [rbx]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1800e57cc
xor eax, eax
mov r8, 0xffffffffffffffff
mov word [rsp + 0x22a], ax
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800e57b0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.18007d760
mov al, 1
jmp 0x1800e57ce
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800e5f30
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.18042ce24
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x1800e5f97
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x150
pop rbx
ret