joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18023c8c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 8], rax
test rcx, rcx
je 0x18023cab3
cmp r8d, 0x80
jb 0x18023cab3
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r14
mov r14d, 5
mov dword [rsp], 0x35343332
mov dword [rsp + 4], 0x30636970
nop word [rax + rax]
lea r8d, [r14 - 5]
lea rax, [r8 + rcx]
mov edx, r8d
and edx, 7
movzx ebp, byte [rsp + rdx]
xor byte [rax], bpl
lea eax, [r14 - 4]
mov edx, eax
and edx, 7
movzx esi, byte [rsp + rdx]
xor byte [rax + rcx], sil
lea eax, [r14 - 3]
mov edx, eax
and edx, 7
movzx edi, byte [rsp + rdx]
xor byte [rax + rcx], dil
lea eax, [r14 - 2]
mov edx, eax
and edx, 7
movzx ebx, byte [rsp + rdx]
lea edx, [r14 - 1]
xor byte [rax + rcx], bl
lea eax, [r8 - 4]
and eax, 7
movzx r11d, byte [rsp + rax]
lea eax, [r8 - 3]
and eax, 7
xor byte [rdx + rcx], r11b
mov edx, r14d
movzx r10d, byte [rsp + rax]
lea eax, [r8 - 2]
and eax, 7
xor byte [rdx + rcx], r10b
lea edx, [r14 + 1]
movzx r9d, byte [rsp + rax]
lea eax, [r8 - 1]
and eax, 7
xor byte [rdx + rcx], r9b
lea edx, [r14 + 2]
movzx r8d, byte [rsp + rax]
lea eax, [r14 + 3]
xor byte [rax + rcx], bpl
lea eax, [r14 + 4]
xor byte [rax + rcx], sil
lea eax, [r14 + 5]
xor byte [rax + rcx], dil
lea eax, [r14 + 6]
xor byte [rax + rcx], bl
lea eax, [r14 + 7]
xor byte [rax + rcx], r11b
lea eax, [r14 + 8]
xor byte [rax + rcx], r10b
lea eax, [r14 + 9]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0xa]
xor byte [rax + rcx], r8b
lea eax, [r14 + 0xb]
xor byte [rax + rcx], bpl
lea eax, [r14 + 0xc]
xor byte [rax + rcx], sil
lea eax, [r14 + 0xd]
xor byte [rax + rcx], dil
lea eax, [r14 + 0xe]
xor byte [rax + rcx], bl
lea eax, [r14 + 0xf]
xor byte [rax + rcx], r11b
lea eax, [r14 + 0x10]
xor byte [rax + rcx], r10b
lea eax, [r14 + 0x11]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0x12]
xor byte [rax + rcx], r8b
lea eax, [r14 + 0x13]
xor byte [rax + rcx], bpl
lea eax, [r14 + 0x14]
xor byte [rax + rcx], sil
lea eax, [r14 + 0x15]
xor byte [rax + rcx], dil
lea eax, [r14 + 0x16]
xor byte [rdx + rcx], r8b
xor byte [rax + rcx], bl
lea eax, [r14 + 0x17]
xor byte [rax + rcx], r11b
lea eax, [r14 + 0x18]
xor byte [rax + rcx], r10b
lea eax, [r14 + 0x19]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0x1a]
xor byte [rax + rcx], r8b
add r14d, 0x20
lea eax, [r14 - 5]
cmp eax, 0x80
jb 0x18023c920
mov r14, qword [rsp + 0x10]
mov al, 1
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180388400
add rsp, 0x28
ret
xor al, al
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180388400
add rsp, 0x28
ret
Function at 0x18023e1c0
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff9b0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x30]
call fcn.180004a70
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aff0
nop
lea rcx, [rsp + 0x30]
call fcn.1800049c0
lea rcx, [rsp + 0x50]
call fcn.180004980
mov r9, rax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.Status
lea rcx, str.Matting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800049c0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180388400
add rsp, 0xa8
ret

Function at 0x18023eae0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x350
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x70]
call fcn.1801ffa70
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x90]
call fcn.180004a70
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aff0
nop
lea rcx, [rsp + 0x90]
call fcn.1800049c0
lea rcx, [rsp + 0x50]
call fcn.180156070
movzx eax, al
test eax, eax
jne 0x18023eb82
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800049c0
movzx eax, byte [rsp + 0x30]
jmp 0x18023ecb6
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.180004980
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x130]
lea r8, [0x1803c0558]
lea rdx, str.Version
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.Application
lea rcx, [rsp + 0xb0]
call fcn.180004a70
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.18015aff0
nop
lea rcx, [rsp + 0xb0]
call fcn.1800049c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0xd0]
call fcn.180004a70
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x110]
call fcn.18015aff0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x360]
call fcn.1800049e0
nop
lea rcx, [rsp + 0x110]
call fcn.1800049c0
nop
lea rcx, [rsp + 0xd0]
call fcn.1800049c0
mov rcx, qword [rsp + 0x360]
call fcn.180155f30
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xf0]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x50]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800049c0
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.180388400
add rsp, 0x350
pop rdi
ret
Function at 0x18023eee0
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff9b0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x30]
call fcn.180004a70
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aff0
nop
lea rcx, [rsp + 0x30]
call fcn.1800049c0
lea rcx, [rsp + 0x50]
call fcn.180004980
mov r9, rax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.Status
lea rcx, [0x1803d6c48]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800049c0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180388400
add rsp, 0xa8
ret

Function at 0x18023f7f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x350
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x70]
call fcn.1801ffba0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x90]
call fcn.180004a70
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aff0
nop
lea rcx, [rsp + 0x90]
call fcn.1800049c0
lea rcx, [rsp + 0x50]
call fcn.180156070
movzx eax, al
test eax, eax
jne 0x18023f892
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800049c0
movzx eax, byte [rsp + 0x30]
jmp 0x18023f9c6
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.180004980
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x130]
lea r8, [0x1803c0558]
lea rdx, str.Version
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.Application
lea rcx, [rsp + 0xb0]
call fcn.180004a70
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.18015aff0
nop
lea rcx, [rsp + 0xb0]
call fcn.1800049c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0xd0]
call fcn.180004a70
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x110]
call fcn.18015aff0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x360]
call fcn.1800049e0
nop
lea rcx, [rsp + 0x110]
call fcn.1800049c0
nop
lea rcx, [rsp + 0xd0]
call fcn.1800049c0
mov rcx, qword [rsp + 0x360]
call fcn.180155f30
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xf0]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x50]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800049c0
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.180388400
add rsp, 0x350
pop rdi
ret
Function at 0x18023fb90
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x70]
call fcn.1801ff9b0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x30]
call fcn.180004a70
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18015aff0
nop
lea rcx, [rsp + 0x30]
call fcn.1800049c0
lea rcx, [rsp + 0x50]
call fcn.180004980
mov r9, rax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.Status
lea rcx, str.PicDesigner
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.1800049c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800049c0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180388400
add rsp, 0xa8
ret
Function at 0x180252bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x180252cc3
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.180252cf0
nop
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edx, eax
mov rcx, rdi
call fcn.18016b8d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x180252c6e
xor sil, sil
jmp 0x180252c82
mov r8, rsi
mov rdx, rax
mov rcx, qword [rdi]
call sub.VCRUNTIME140.dll_memcpy
test esi, esi
setne sil
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180252cbf
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x180252cbf
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x180252cbf
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 8]
movzx eax, sil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18025b510
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x8f0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x98]
call fcn.180004ab0
nop
mov dword [rsp + 0x4c], 0
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x400
lea rax, [rsp + 0x4e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0x400
mov dl, 1
mov rax, qword [rsp + 0x900]
mov rcx, qword [rax + 0x20]
call fcn.180203d80
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, qword [rsp + 0x910]
mov rdx, qword [rsp + 0x908]
mov rax, qword [rsp + 0x900]
mov rcx, qword [rax + 0x20]
call fcn.180203100
movzx eax, al
test eax, eax
jne 0x18025b612
mov rcx, qword [rsp + 0x908]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x98]
call fcn.1800049c0
movzx eax, byte [rsp + 0x40]
jmp 0x18025b778
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x18025b748
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x98]
call fcn.18000d5a0
lea rcx, [rsp + 0x98]
call fcn.180004970
movzx eax, al
test eax, eax
jne 0x18025b6ef
lea rcx, [rsp + 0x98]
call fcn.180154fc0
lea r8, [rsp + 0x4e0]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xb8]
call fcn.18025ed30
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x918]
call fcn.18025ed80
nop
lea rax, [rsp + 0xb8]
mov rcx, rax
call fcn.1800049c0
mov dword [rsp + 0x44], 0x400
mov dword [rsp + 0x48], 0x400
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xe0]
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x70]
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x4e0]
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x78]
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
jmp 0x18025b612
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x908]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x41], 1
lea rcx, [rsp + 0x98]
call fcn.1800049c0
movzx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.180388400
add rsp, 0x8f0
pop rdi
ret
Function at 0x180263dd0
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x240
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x180263f1d
mov edx, dword [rdx + 8]
xor esi, esi
sub edx, 0x100
je 0x180263e30
sub edx, 4
je 0x180263e30
cmp edx, 0x12f
jne 0x180263f19
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x38]
mov esi, 1
mov eax, esi
jmp 0x180263f1f
cmp qword [rbx + 0x10], 0x1b
jne 0x180263e76
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x103
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.RCInplaceEdit
lea rcx, [rsp + 0x20]
call fcn.180154bd0
test al, al
jne 0x180263f1d
mov eax, dword [rbx + 8]
sub eax, 0x100
test eax, 0xfffffffb
jne 0x180263f19
cmp qword [rbx + 0x10], 0xe5
mov qword [rsp + 0x270], rbp
mov qword [rsp + 0x278], rdi
mov edi, dword [rbx + 0x10]
jne 0x180263eb1
mov rcx, qword [rbx]
call qword [sym.imp.IMM32.dll_ImmGetVirtualKey]
mov edi, eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
mov ebp, 0x8000
bts ebx, 0x1f
mov ecx, 0x12
and ax, bp
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, 0x10
bts edi, 0x1e
and ax, bp
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, edi
mov rcx, r14
bts edx, 0x1d
and ax, bp
cmove edx, edi
call fcn.180264310
mov rdi, qword [rsp + 0x278]
test al, al
mov rbp, qword [rsp + 0x270]
setne sil
mov eax, esi
jmp 0x180263f1f
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180388400
add rsp, 0x240
pop r14
pop rsi
pop rbx
ret
Function at 0x18026ff00
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
cmp qword [rcx + 0x60], 0
jne 0x18027002e
xor esi, esi
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x20], 7
mov word [rsp + 0x30], si
lea r8d, [rsi + 0x26]
lea rdx, str.02099BA0_F791_4224_AD07_4C4EA722B792
lea rcx, [r11 - 0x38]
call fcn.180004ea0
nop
lea ecx, [rsi + 0x10]
call fcn.180388424
mov rbx, rax
mov qword [rsp + 0x28], rax
mov qword [rax], rsi
mov word [rax + 8], si
cmp qword [rsp + 0x40], rsi
je 0x18026ff96
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
jmp 0x18026ff99
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x18026ffbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18026ffbc
mov byte [rbx + 9], 1
mov qword [rdi + 0x60], rbx
cmp qword [rbx], 0
jne 0x180270050
mov rcx, rbx
call fcn.18026db20
mov qword [rdi + 0x60], rsi
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18027001b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180270016
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180270016
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180388400
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180270095
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180270090
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180270090
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov al, 1
jmp 0x180270030
Function at 0x1802ba1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r13, rcx
mov r15d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r14, qword [r11]
mov r10, qword [rax + 8]
movsxd rax, dword [r10 + 0x30]
movsxd r10, dword [r11 + 0x30]
cmp eax, r10d
mov qword [rsp + 0x20], rax
mov ecx, r10d
cmovl ecx, eax
xor ebx, ebx
imul r15, rax
mov dword [rsp + 0x78], ecx
mov rcx, rax
cmp eax, r10d
je 0x1802ba253
cmp byte [r14 + 0x10], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r15
sub rdi, rcx
test ebx, ebx
jne 0x1802ba3f4
mov qword [rsp + 0x88], rbp
mov rbp, r10
mov qword [rsp + 0x30], rsi
cmp rdi, r15
jge 0x1802ba3d6
mov rax, rdi
mov qword [rsp + 0x70], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x1804d1ed8]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x1802ba3cb
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, r10d
mov rcx, r14
call qword [r14 + 0x108]
mov ebx, eax
test eax, eax
jne 0x1802ba372
mov rcx, qword [rsp + 0x70]
test byte [rcx + 0x34], 4
mov rdx, qword [rcx + 0x28]
je 0x1802ba2f9
mov eax, dword [rcx + 0x30]
cmp dword [rdx + 0x1c], eax
jb 0x1802ba2f9
cmp dword [rdx + 0x80], ebx
je 0x1802ba2f5
call fcn.1802a6300
jmp 0x1802ba31a
xor ebx, ebx
jmp 0x1802ba325
mov ebx, dword [rdx + 0x2c]
test ebx, ebx
jne 0x1802ba377
mov eax, dword [rdx + 0xbc]
cmp dword [rdx + 0xb8], eax
jbe 0x1802ba315
call fcn.1802a7bf0
jmp 0x1802ba31a
call fcn.1802a7a20
mov rcx, qword [rsp + 0x70]
mov ebx, eax
test eax, eax
jne 0x1802ba377
add rsi, qword [rcx + 8]
mov rax, rdi
movsxd r8, dword [rsp + 0x78]
cqo
idiv qword [rsp + 0x20]
mov rcx, rsi
add rdx, qword [rsp + 0x80]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x10]
mov byte [rcx], 0
test rdi, rdi
jne 0x1802ba372
test r12d, r12d
jne 0x1802ba372
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x3c]
btr eax, 0x1f
bswap eax
mov dword [rsi + 0x1c], eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1802ba3cb
test byte [rcx + 0x34], 0x20
je 0x1802ba3c6
mov r8, qword [rcx + 0x28]
mov rax, qword [r8 + 0xa8]
dec dword [r8 + 0x98]
mov qword [rcx + 0x20], rax
mov r9, qword [r8 + 0x48]
movsxd rax, dword [r8 + 0xbc]
mov qword [r8 + 0xa8], rcx
mov edx, dword [rcx + 0x30]
mov r8, qword [rcx + 8]
dec edx
mov r10, qword [r9]
mov rcx, r9
imul rdx, rax
call qword [r10 + 0x90]
jmp 0x1802ba3cb
call fcn.1802a17a0
add rdi, rbp
test ebx, ebx
je 0x1802ba271
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rbp, qword [rsp + 0x88]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x1802cd6d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.1802976f0
mov rbx, rax
test rax, rax
jne 0x1802cd70e
lea eax, [rbx + 7]
jmp 0x1802cd796
cmp byte [0x1804ce134], 0
je 0x1802cd763
mov rax, qword [0x1804ce2b8]
test rax, rax
je 0x1802cd72e
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1802cd763
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x18029a700]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x1802cd778
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x1802cd791
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1802d9fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov rbx, rdx
mov r14, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0xad
jne 0x1802d9fed
movzx eax, byte [rbx + 2]
cmp al, 0xae
jne 0x1802d9ff7
mov rax, qword [rbx + 0x20]
jmp 0x1802da007
cmp al, 0x88
jne 0x1802da0a4
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1802da0a4
mov qword [rsp + 0x50], rdi
xor edi, edi
mov dword [r8], edi
cmp dl, 0x88
jne 0x1802da039
mov rdx, rbx
mov rcx, r14
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rbx
jmp fcn.1802d7d50
mov eax, dword [r14 + 0x38]
mov qword [rsp + 0x40], rbp
mov rbp, rcx
mov qword [rsp + 0x20], r15
lea r15d, [rax + 1]
add eax, ecx
mov dword [r14 + 0x38], eax
test ecx, ecx
jle 0x1802da09f
mov qword [rsp + 0x48], rsi
mov esi, r15d
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, r14
mov rdx, qword [rdx + rdi + 8]
call fcn.1802db8e0
inc esi
lea rdi, [rdi + 0x20]
sub rbp, 1
jne 0x1802da060
mov rsi, qword [rsp + 0x48]
mov eax, r15d
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rbx
ret
mov eax, r15d
jmp 0x1802da088
mov rdx, rbx
mov rcx, r14
add rsp, 0x28
pop r14
pop rbx
jmp fcn.1802db750