joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005038
Capabilities:
Get disk size

Disassembly:
jmp 0x18005d580
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x180135088]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rdi, [rcx + 0xb50]
movzx esi, dl
mov rbx, rcx
test rdi, rdi
je 0x18005d5f0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], 0
mov r9d, 0xffffffff
mov dword [rsp + 0x28], 0x104
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test sil, sil
jne 0x18005d5ff
cmp byte [rbx + 8], sil
jne 0x18005d6ab
xor eax, eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x18005d6ab
mov rax, qword [rsp + 0x40]
cmp rax, 0x12c00000
jae 0x18005d6ab
mov rcx, qword [rbx + 0xb28]
test rcx, rcx
je 0x18005d65d
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, 0x80004005
mov dword [rsp + 0x20], 0
mov rax, qword [rcx]
lea edx, [r8 + 0x6e]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x40]
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18005d6a7
shr rax, 0x14
lea rcx, [0x180102a90]
test byte [rbx + 0x50], 2
lea r8, [0x180102a94]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
cmovne r8, rcx
lea rdx, str.MFMuxer::CheckDiskSpace:__s__Insufficient_disk_space_on__s_._Available__lld_MB_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
xor al, al
jmp 0x18005d6ad
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180002397
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180005227
Capabilities:
Terminate process

Disassembly:
jmp 0x1800a9b08
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1800a9b22
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.180005402
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x180005268
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800bad48
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne sil
test eax, eax
je 0x1800bad94
test rbx, rbx
je 0x1800bad83
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.1800017fd
cmp eax, 1
je 0x1800bad94
mov eax, 4
jmp 0x1800badd7
call fcn.180002d88
cmp eax, 2
jne 0x1800badd0
call fcn.18000166d
test al, al
je 0x1800badd0
call fcn.180005c1d
test al, al
jne 0x1800badc6
bts edi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, edi
call fcn.18000582b
jmp 0x1800badd7
call fcn.180002225
mov rcx, rax
jmp 0x1800badb6
movzx eax, sil
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800053d5
Capabilities:
Get session user name

Disassembly:
jmp 0x180033d40
push rbx
sub rsp, 0x20
cmp word [0x180139dd0], 0
jne 0x180033d95
lea rbx, [0x180139dd0]
mov dword [rsp + 0x30], 0x101
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x180033d8c
mov r9, 0xffffffffffffffff
lea r8, [0x1800f90a0]
mov edx, 0x101
mov rcx, rbx
call fcn.1800025b3
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x180139dd0]
add rsp, 0x20
pop rbx
ret

Function at 0x180005470
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x18007fafc
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18010f850]
mov ecx, 2
lea r8, [0x18010f848]
lea rdx, [0x18010f858]
call fcn.18007f4ac
mov ecx, ebx
test rax, rax
je 0x18007fb36
add rsp, 0x20
pop rbx
jmp qword [case.0x18007552e.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x18000550b
Capabilities:
Get common file path

Disassembly:
jmp 0x180073350
sub rsp, 0x258
mov rax, qword [0x180135088]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1800733c6
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x1800733ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.NvFBCDLL::LoadNVFBCDll:_GetSystemDirectoryW_failed._gle___X_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180002397
add rsp, 0x258
ret
cmp eax, 0x104
jbe 0x180073419
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x1800733ff
lfence
mov r9d, 0x104
lea rdx, str.NvFBCDLL::LoadNVFBCDll:_Given_string_buffer_size_is_insufficient._required__d__provided__d_
mov r8d, eax
lea rcx, vtable.CLogger.0
call fcn.1800024fa
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180002397
add rsp, 0x258
ret
lea rax, str.NvFBC64.dll
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, str._s_s
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180002bfd
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180003b8e
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180002397
add rsp, 0x258
ret

Function at 0x180005583
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1800c332c
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x180113178]
mov ecx, 3
lea r8, [0x180113170]
lea rdx, str.FlsAlloc
call fcn.1800c29d8
test rax, rax
je 0x1800c3368
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [case.0x18007552e.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x18000570e
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x180065360
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x18013218c], 6
mov rdi, rcx
mov dword [0x180132050], 6
jg 0x180065398
lea rdx, str.CH264EncodeVideo::DeleteInstance:_IN
lea rcx, vtable.CLogger.0
call fcn.1800024fa
lea rcx, [rdi + 8]
call fcn.180005277
mov esi, eax
test eax, eax
jns 0x1800653ee
lfence
lea rcx, [rdi + 8]
call fcn.1800013a7
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x180065405
lfence
mov r8d, esi
lea rdx, str.CH264EncodeVideo::DeleteInstance:_EventListener_stop_failed._0x_08X
lea rcx, vtable.CLogger.0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800024fa
test rdi, rdi
je 0x180065405
lfence
mov rax, qword [rdi + 8]
lea rcx, [rdi + 8]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800057fe
Capabilities:
Get geographical location

Disassembly:
jmp 0x1800c35cc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x1801132a0]
mov rbp, rcx
lea r8, [0x180113298]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xb
call fcn.1800c29d8
mov rcx, rbp
test rax, rax
je 0x1800c3622
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [case.0x18007552e.0]
jmp 0x1800c3639
xor edx, edx
call fcn.1800034d1
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180005b5f
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x18003b360
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
je 0x18003b3b7
mov rcx, qword [rcx + 0x10]
call fcn.180003512
test rax, rax
je 0x18003b38c
mov qword [rbx], rax
lock inc dword [rax + 0xc8]
add rsp, 0x20
pop rbx
ret
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18003b3e2
lea rdx, str.Stage_Buffer_get_free_failed
lea rcx, vtable.CLogger.0
add rsp, 0x20
pop rbx
jmp fcn.1800024fa
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18003b3e2
lea rdx, str.Stage_Buffer_failed_NULL_ptr
lea rcx, vtable.CLogger.0
add rsp, 0x20
pop rbx
jmp fcn.1800024fa
add rsp, 0x20
pop rbx
ret
Function at 0x180005d62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, r9d
lea rcx, [rbp - 0x29]
lea ecx, [rbp - 0x29]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x6b
jb 0x180005d60
dec rdx
jne 0x180005d59
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
mov ecx, dword [rax + rdx + 0x88]
test ecx, ecx
je 0x180005e0b
invalid
xchg byte [rax], al
add byte [rax], al
lea rax, [r10 + rcx]
mov r11d, r9d
mov esi, dword [rax + 0x18]
Function at 0x1800062eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
mov esi, edx
xor edx, edx
mov r8d, dword [rax + rcx + 0x88]
mov r9, rcx
add r8, rcx
mov r10d, dword [r8 + 0x20]
mov r11d, dword [r8 + 0x1c]
mov ebx, dword [r8 + 0x24]
mov edi, dword [r8 + 0x18]
add r10, rcx
add r11, rcx
add rbx, rcx
test edi, edi
je 0x18000635c
mov ecx, dword [r10]
add rcx, r9
xor r8d, r8d
jmp 0x180006347
movzx eax, al
inc rcx
or eax, 0x60
add r8d, eax
add r8d, r8d
mov al, byte [rcx]
test al, al
jne 0x180006338
cmp r8d, esi
je 0x18000636e
inc edx
add r10, 4
cmp edx, edi
jb 0x18000632d
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rbx + rdx*2]
mov eax, dword [r11 + rcx*4]
add rax, r9
jmp 0x18000635e

Function at 0x18000e690
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x18000e76f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x18000e6c7
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18000e772
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x18000e716
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x18000e720
test rax, rax
je 0x18000e76f
lfence
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18000e760
cmp rdx, rax
jb 0x18000e740
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180013fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x180013fc0
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x1800141ee
xor edx, edx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], dx
jne 0x180013ff0
test rax, rax
je 0x180014024
xor ecx, ecx
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x1800141ee
cmp r8w, 0x2f
je 0x1800141ee
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x180014000
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.180001c85
mov rsi, rax
test rax, rax
je 0x18001411e
mov qword [rsp + 0x50], r14
call fcn.180001e6a
mov r14, rax
test rax, rax
je 0x18001410b
mov rcx, rsi
call fcn.18000e490
test eax, eax
je 0x1800140f4
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x1800140a0
mov r8, rbx
mov rcx, rsi
call fcn.180002aa9
test eax, eax
je 0x1800140c8
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x180014090
jmp 0x1800140d7
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.180012360
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x180014102
mov rcx, rsi
call fcn.18000e420
test eax, eax
je 0x180014102
mov rbp, rsi
xor esi, esi
jmp 0x180014102
mov rdx, rsi
mov rcx, r14
call fcn.180012360
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x1800141ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x1800141c3
mov rcx, rbx
call fcn.18000e2f0
mov rdi, rax
test rax, rax
je 0x1800141c3
mov ecx, 0x37e4
call fcn.180011c20
test eax, eax
je 0x180014158
xor ecx, ecx
call fcn.1800024d2
jmp 0x18001415d
call fcn.180001e6a
mov rbx, rax
test rax, rax
je 0x1800141b1
mov rdx, rdi
mov rcx, rax
call fcn.180012360
mov rbp, rax
test rax, rax
je 0x1800141a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001418a
test al, 0x50
je 0x1800141a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18001419d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x1800141c3
xor ecx, ecx
jmp 0x1800141d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800141d6
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x1800154e0
Capabilities:
Get common file path

Disassembly:
jmp 0x1800154e0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180015542
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180015537
cmp edi, eax
jb 0x180015537
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180015c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x180015c50
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov rbx, rcx
mov r14d, r8d
xor ecx, ecx
mov ebp, edx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x180015db5
movzx eax, word [rbx]
cmp eax, 0x5c
je 0x180015cb3
cmp eax, 0x2f
je 0x180015cb3
mov ecx, eax
call fcn.180002a27
test eax, eax
je 0x180015db5
cmp word [rbx + 2], 0x3a
jne 0x180015db5
movzx eax, word [rbx + 4]
cmp ax, 0x5c
je 0x180015cb3
cmp ax, 0x2f
jne 0x180015db5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180015d99
test al, 0x50
jne 0x180015d99
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180015d20
lea ecx, [rax + 0x21]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
test r14d, r14d
mov dword [rsp + 0x60], edi
lea rdx, [rsp + 0x60]
mov rcx, rbx
cmove rdx, rdi
call fcn.180003dd2
test eax, eax
je 0x180015d6b
test r14d, r14d
je 0x180015d54
cmp dword [rsp + 0x60], edi
jne 0x180015d54
mov ecx, 0x80092009
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180015d6b
and ebp, 0xffffe8f7
xor edx, edx
mov r8d, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rsi, rsi
je 0x180015d89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x180015d0a
xor ecx, ecx
jmp 0x180015d04
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x18001ed20
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x18001ed20
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 8]
mov rbx, rcx
mov rcx, rdi
call fcn.180005277
mov esi, eax
test eax, eax
jns 0x18001edfc
mov qword [rsp + 0x30], rbp
lfence
mov ebp, dword [rbx + 0x17b0]
cmp ebp, 0x3e8
je 0x18001edb4
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18001edb4
mov rbx, qword [rbx + 0x17b8]
call fcn.180002dd8
mov rcx, rax
mov r8d, ebp
sub rcx, rbx
movabs rax, 0x346dc5d63886594b
imul rcx
lea rcx, vtable.CLogger.0
sar rdx, 0xb
mov r9, rdx
shr r9, 0x3f
add r9, rdx
lea rdx, str.CVideoCaptureFbc::DeleteInstance:_thread_did_not_respond.__CHECKPOINT__d___Last_Capture__dms_ago_
call fcn.1800024fa
mov rcx, rdi
call fcn.1800013a7
cmp dword [0x18013218c], 7
mov rbp, qword [rsp + 0x30]
mov dword [0x180132050], 7
jg 0x18001ee11
lfence
mov r8d, esi
lea rdx, str.CVideoCaptureFbc::DeleteInstance:_CVideoCaptureFbc_stop_failed._0x_08X
lea rcx, vtable.CLogger.0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1800024fa
test rbx, rbx
je 0x18001ee11
lfence
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001f410
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x18001f410
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 8]
mov rbx, rcx
mov rcx, rdi
call fcn.180005277
mov esi, eax
test eax, eax
jns 0x18001f4ec
mov qword [rsp + 0x30], rbp
lfence
mov ebp, dword [rbx + 0x17b0]
cmp ebp, 0x3e8
je 0x18001f4a4
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18001f4a4
mov rbx, qword [rbx + 0x17b8]
call fcn.180002dd8
mov rcx, rax
mov r8d, ebp
sub rcx, rbx
movabs rax, 0x346dc5d63886594b
imul rcx
lea rcx, vtable.CLogger.0
sar rdx, 0xb
mov r9, rdx
shr r9, 0x3f
add r9, rdx
lea rdx, str.CVideoCaptureDda::DeleteInstance:_thread_did_not_respond.__CHECKPOINT__d___Last_Capture__dms_ago_
call fcn.1800024fa
mov rcx, rdi
call fcn.1800013a7
cmp dword [0x18013218c], 7
mov rbp, qword [rsp + 0x30]
mov dword [0x180132050], 7
jg 0x18001f501
lfence
mov r8d, esi
lea rdx, str.CVideoCaptureDda::DeleteInstance:_CVideoCaptureDda_stop_failed._0x_08X
lea rcx, vtable.CLogger.0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1800024fa
test rbx, rbx
je 0x18001f501
lfence
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18001fbe0
Capabilities:
Get common file path

Disassembly:
jmp 0x18001fbe0
push rdi
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x298], rbx
mov rax, qword [0x180135088]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x58], rcx
call fcn.180003251
nop
lea rax, str.FrameProviderCreateInterface
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.180003a85
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18010c3a0]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x18001fc80
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x18001fd1c
lea rdx, str.CFrameProviderDll::Initialize:_SHGetKnownFolderPath_failed.HRESULT__0x_08X
jmp 0x18001fd09
lea rax, str.nvfp64.dll
mov qword [rsp + 0x30], rax
lea rax, str.NVIDIA_CorporationShadowPlay
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str._s_s_s
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
call fcn.180002bfd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x40], 0
mov r9d, 1
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800032e2
test eax, eax
jns 0x18001fd1c
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x18001fd1c
lea rdx, str.CFrameProviderDll::Initialize:_InitializeSystemDll_failed_0x_08X_
lfence
mov r8d, eax
lea rcx, vtable.CLogger.0
call fcn.1800024fa
nop
mov dword [rbx + 0x18], edi
mov qword [rbx + 0x20], 0
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180002397
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret

Function at 0x1800210e0
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x1800210e0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.180005277
mov edi, eax
test eax, eax
jns 0x180021139
lfence
mov rcx, rbx
call fcn.1800013a7
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18002114e
lfence
mov r8d, edi
lea rdx, str.CVideoCaptureScheduler::DeleteInstance:_EventListener_stop_failed._0x_08X
lea rcx, vtable.CLogger.0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800024fa
test rbx, rbx
je 0x18002114e
lfence
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180033cc0
Capabilities:
Get session user name

Disassembly:
jmp 0x180033cc0
push rbx
sub rsp, 0x20
cmp byte [0x180139fe0], 0
jne 0x180033d14
lea rbx, [0x180139fe0]
mov dword [rsp + 0x30], 0x101
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x180033d0b
mov r9, 0xffffffffffffffff
lea r8, [0x1800f90a8]
mov edx, 0x101
mov rcx, rbx
call fcn.18000173a
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x180139fe0]
add rsp, 0x20
pop rbx
ret

Function at 0x180033d40
Capabilities:
Get session user name

Disassembly:
jmp 0x180033d40
push rbx
sub rsp, 0x20
cmp word [0x180139dd0], 0
jne 0x180033d95
lea rbx, [0x180139dd0]
mov dword [rsp + 0x30], 0x101
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x180033d8c
mov r9, 0xffffffffffffffff
lea r8, [0x1800f90a0]
mov edx, 0x101
mov rcx, rbx
call fcn.1800025b3
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x180139dd0]
add rsp, 0x20
pop rbx
ret

Function at 0x180034030
Capabilities:
Print debug messages

Disassembly:
jmp 0x180034030
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x868
mov rax, qword [0x180135088]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
lea rdi, [r11 + 0x10]
call fcn.1800052fe
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x450]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x1ff
mov rcx, qword [rax]
or rcx, 1
call fcn.180003553
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x4e]
movzx edx, word [rsp + 0x4c]
movzx r10d, word [rsp + 0x4a]
movzx r9d, word [rsp + 0x48]
movzx r8d, word [rsp + 0x46]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], edx
lea rdx, str.__02i:_02i:_02i:_02i:_03i___5d_
mov dword [rsp + 0x20], r10d
call fcn.1800054fc
lea rax, [rsp + 0x50]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1800340f0
lea r8, [rsp + 0x450]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x180034110
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.180002397
add rsp, 0x868
pop rdi
pop rbx
ret