joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140135af0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rbx, rdx
mov rbp, rcx
call fcn.1401f2234
mov rdi, qword [rax + 8]
lea r12, str.IntMicRange
lea rsi, str.ExtMicRange
test rdi, rdi
je 0x140135b43
mov rcx, qword [rbp + 0x30]
call fcn.14001c870
mov r8, rsi
lea rdx, str.RtkPreset
test eax, eax
mov rcx, rdi
cmovne r8, r12
xor r9d, r9d
call fcn.140204860
mov dword [rbx], eax
xor ecx, ecx
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareRealtekCOMPreset
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov dword [rbx], ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0xa0], 4
mov dword [rsp + 0x98], 4
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140135bef
mov rcx, qword [rbp + 0x30]
call fcn.14001c870
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0xa0]
test eax, eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
cmovne rsi, r12
lea rax, [rsp + 0xa8]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140135bef
mov eax, dword [rsp + 0xa8]
mov dword [rbx], eax
mov eax, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140135c00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
call fcn.1401f2234
lea rdi, str.IntMicRange
mov rbx, qword [rax + 8]
lea rbp, str.ExtMicRange
test rbx, rbx
je 0x140135c55
mov rcx, qword [rsi + 0x30]
call fcn.14001c870
mov r9d, dword [rsp + 0x78]
mov r8, rbp
test eax, eax
lea rdx, str.RtkPreset
mov rcx, rbx
cmovne r8, rdi
call fcn.140204900
lea rax, [rsp + 0x80]
xor ebx, ebx
lea rdx, str.SoftwareRealtekCOMPreset
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140135ce3
mov rcx, qword [rsi + 0x30]
call fcn.14001c870
mov rcx, qword [rsp + 0x88]
lea r9d, [rbx + 4]
test eax, eax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
cmove rdi, rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013fc70
Capabilities:
Get graphical window text

Disassembly:
push rbx
mov eax, 0x10f0
call fcn.14024ccf0
sub rsp, rax
mov rax, qword [0x14031eda0]
xor rax, rsp
mov qword [rsp + 0x10e0], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x2c70]
test rcx, rcx
je 0x14013fec5
cmp qword [rbx + 0x100], 0
je 0x14013fec5
mov rax, qword [rcx]
mov qword [rsp + 0x1108], rbp
mov qword [rsp + 0x1110], rsi
mov qword [rsp + 0x1118], rdi
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x14013fd82
mov rcx, qword [rbx + 0x2c70]
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
je 0x14013fd82
cmp dword [rbx + 0x17e8], 0
jne 0x14013fd09
cmp dword [rbx + 0x16b8], 0
jne 0x14013fd09
xor edx, edx
jmp 0x14013fd0e
mov edx, 1
mov rcx, qword [rbx + 0x2c70]
xor eax, eax
cmp dword [rbx + 0x16b8], 1
sete al
lea rdi, [rbx + 0x40c]
mov dword [rbx + 0x410], eax
mov dword [rdi], edx
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
jne 0x14013fd4a
mov rcx, qword [rbx + 0x2c70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x70]
cmp dword [rdi], 0
je 0x14013fdb8
mov rcx, qword [rbx + 0x2c70]
mov edx, dword [rbx + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
jne 0x14013fdb8
mov rcx, qword [rbx + 0x2c70]
lea rdx, [rbx + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x80]
jmp 0x14013fdb8
mov rcx, qword [rbx + 0x2c70]
xor edx, edx
cmp dword [rbx + 0x17e8], 1
sete dl
lea rdi, [rbx + 0x40c]
mov dword [rdi], edx
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
jne 0x14013fdb8
mov rcx, qword [rbx + 0x2c70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rbx + 0x378]
mov r9d, 0x105
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [rdi]
lea r9, [rsp + 0x20]
neg eax
mov edx, 0x702
mov dword [rsp + 0x20], 3
sbb ecx, ecx
xor r8d, r8d
mov dword [rsp + 0x24], 0
and ecx, 2
mov dword [rsp + 0x2c], 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 0x26d0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rdi]
lea rcx, [rbx + 0x2690]
call fcn.1401f2644
mov rbp, qword [rbx + 0x100]
bt dword [rbp + 0xc], 0xd
jae 0x14013fe66
mov rsi, qword [rbx + 0x108]
lea rcx, [rbp + 0x560]
mov rdx, rsi
call fcn.1400cc0b0
test eax, eax
je 0x14013fe66
lea rcx, [rbp + 0x560]
mov rdx, rsi
call fcn.1400cc150
test eax, eax
jne 0x14013fe66
mov edx, dword [rdi]
mov rcx, qword [rbx + 0x2c70]
call fcn.140130970
cmp dword [rbx + 0x2c84], 0
mov rsi, qword [rsp + 0x1110]
mov rbp, qword [rsp + 0x1108]
jne 0x14013fea1
cmp dword [rdi], 0
je 0x14013fea1
lea r8, str.MicCalExecuted
lea rdx, str.General
lea rcx, [0x140333a50]
xor r9d, r9d
call fcn.140204860
cmp dword [rdi], 0
mov rdi, qword [rsp + 0x1118]
je 0x14013fec5
cmp dword [rbx + 0x45c], 0
je 0x14013fec5
mov rcx, qword [rbx + 0x2c70]
xor edx, edx
call fcn.140132e90
mov rcx, qword [rsp + 0x10e0]
xor rcx, rsp
call fcn.14022b9b0
add rsp, 0x10f0
pop rbx
ret
Function at 0x140153e80
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.14017a640
cmp qword [rbx + 0x350], 0
jle 0x140153f4e
cmp qword [rbx + 0x378], 0
jne 0x140153ec3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x378], rax
test edi, edi
mov qword [rsp + 0x60], rsi
je 0x140153f59
xor esi, esi
lea rcx, [0x1401539c0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
mov qword [rsp + 0x58], rbp
call fcn.140200e00
test rax, rax
mov rbp, rax
je 0x140153f44
lea rdi, [rbx + 0x370]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
mov r9, rdi
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor esi, esi
cmp qword [rbx + 0x370], rsi
mov dword [rsp + 0x50], esi
je 0x140153f49
mov rcx, qword [rbx + 0x378]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x370]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x140153fa5
cmp dword [rsp + 0x50], 0x103
jne 0x140153fa5
mov rcx, qword [rbx + 0x370]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x370]
test rcx, rcx
je 0x140153f49
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x370], rsi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140170610
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r12
push r13
push r14
sub rsp, 0x58
xor r14d, r14d
mov r13, rcx
mov rcx, qword [rcx]
test rcx, rcx
mov rbp, r9
mov r12, rdx
mov dword [rsp + 0x80], r14d
jne 0x140170649
mov eax, 0xc0000008
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbp
ret
test rdx, rdx
mov qword [rsp + 0x90], rsi
je 0x140170779
test r9, r9
je 0x140170779
mov rsi, qword [rsp + 0xa0]
test rsi, rsi
je 0x140170779
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
lea r8d, [r9 + 0xc]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
js 0x14017070a
mov qword [rsp + 0x88], rbx
mov ebx, dword [rsp + 0x80]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
jne 0x14017071e
mov ebx, 0xc0000017
test rdi, rdi
je 0x1401706fb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x90]
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [r13]
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x80]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rdi
lea r8d, [r9 + 0xc]
mov rdx, r12
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
mov ebx, eax
js 0x1401706e2
mov ecx, dword [rsp + 0x80]
mov qword [rbp], rdi
mov dword [rsi], ecx
jmp 0x1401706fd
mov eax, 0xc000000d
jmp 0x14017070a
Function at 0x14017a640
Capabilities:
Resume thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov esi, edx
mov rbx, rcx
call fcn.1401f81ac
cmp dword [rbx + 0xf8], 0
jne 0x14017a671
test esi, esi
je 0x14017a671
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x2c8]
mov dword [rbx + 0xf8], eax
lea rax, [rbx + 0x200]
test rax, rax
je 0x14017a6e9
cmp qword [rax + 0x40], 0
je 0x14017a6e9
movsd xmm0, qword [0x140322538]
mov rcx, qword [rbx + 0x240]
xor r8d, r8d
mov edx, 0x418
mulsd xmm0, qword [0x1402bc0f8]
cvttsd2si eax, xmm0
movsxd r9, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x240]
xor r9d, r9d
lea r8d, [r9 + 2]
mov edx, 0x415
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x240]
mov edx, 0x403
add ax, 0xbb8
mov r8d, 2
movzx r9d, ax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rbx + 0x100]
mov qword [rsp + 0x68], rbp
test rdi, rdi
je 0x14017a78d
cmp dword [rbx + 0x1b0], 0
ja 0x14017a710
cmp dword [rbx + 0x18c], 0
je 0x14017a78d
test esi, esi
je 0x14017a729
lea rdx, [rbx + 0x160]
lea rcx, [rdi + 0x1ac0]
call fcn.14014ec60
jmp 0x14017a78d
lea rbp, [rbx + 0x160]
test rbp, rbp
je 0x14017a78d
cmp qword [rdi + 0x1b00], 0
je 0x14017a78d
lea rcx, [rdi + 0x1b08]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
call fcn.1401fd36c
test rax, rax
mov r13, rax
je 0x14017a783
mov rcx, qword [rdi + 0x1b00]
mov rdx, rbp
mov r8, qword [rcx]
call qword [r8 + 0x38]
lea rcx, [rdi + 0x1b08]
mov rdx, r13
call fcn.1401fd320
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
cmp qword [rbx + 0x2f8], 0
jle 0x14017a8a9
cmp qword [rbx + 0x320], 0
jne 0x14017a7bc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x320], rax
test esi, esi
je 0x14017a844
xor esi, esi
lea rcx, [0x14017aeb0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
call fcn.140200e00
test rax, rax
mov rbp, rax
je 0x14017a8a9
lea rdi, [rbx + 0x318]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
mov r9, rdi
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ResumeThread]
xor esi, esi
cmp qword [rbx + 0x318], rsi
mov dword [rsp + 0x60], esi
je 0x14017a8a9
mov rcx, qword [rbx + 0x320]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x318]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14017a890
cmp dword [rsp + 0x60], 0x103
jne 0x14017a890
mov rcx, qword [rbx + 0x318]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x318]
test rcx, rcx
je 0x14017a8a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x318], rsi
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401ab590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
mov r12, r9
call fcn.14022ec70
call fcn.1401f2234
lea r8, str.WAVE
mov rcx, qword [rax + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rbx, rbx
mov rbp, rax
je 0x1401ab7b9
test rax, rax
je 0x1401ab7b9
mov qword [rsp + 0xa0], rdi
call fcn.1401f2234
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
call fcn.1401f2234
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [rsp + 0x20]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x24], 0x204d454d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WINMM.dll_mmioOpenW]
lea rdx, [rsi + 0x260]
mov r9d, 0x20
xor r8d, r8d
mov rcx, rax
mov rbx, rax
mov dword [rsi + 0x268], 0x45564157
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401ab7aa
lea r9d, [rax + 0x10]
lea r8, [rsi + 0x260]
lea rdx, [rsi + 0x24c]
mov rcx, rbx
mov dword [rsi + 0x24c], 0x20746d66
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401ab7aa
lea rdx, [rsi + 0x24c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
lea r8, [rsi + 0x260]
lea rdx, [rsi + 0x238]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
mov dword [rsi + 0x238], 0x61746164
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401ab7aa
lea rdx, [rsi + 0x238]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x258]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x250]
lea rdx, [rsi + 0x210]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x250], eax
jne 0x1401ab7aa
cmp word [rsi + 0x212], 1
jne 0x1401ab7aa
cmp word [rsi + 0x21e], 0x10
jne 0x1401ab7aa
mov eax, dword [rsi + 0x23c]
mov rdx, r12
mov rcx, rsi
mov dword [rsi + 0xd4], eax
call fcn.1401ab7c0
test eax, eax
jne 0x1401ab791
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
mov rcx, rsi
call fcn.1401abce0
xor eax, eax
mov rdi, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov dword [rsi + 0xd0], 1
mov dword [rsi + 0xdc], 0
mov rax, rbx
jmp 0x1401ab76f
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x1401ab76f
xor eax, eax
jmp 0x1401ab777
Function at 0x1401ab7c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
lea rdx, [rcx + 0x10]
lea rcx, [0x1401abb90]
call sub.DSOUND.dll_DirectSoundEnumerateW
mov r11, qword [rsi + 0x10]
test r11, r11
je 0x1401ab81f
nop
mov rdx, qword [r11]
cmp rdx, qword [rsi + 0x288]
jne 0x1401ab80d
mov rdx, qword [r11 + 8]
cmp rdx, qword [rsi + 0x290]
jne 0x1401ab80d
xor eax, eax
jmp 0x1401ab812
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1401ab831
mov r11, qword [r11 + 0x18]
test r11, r11
jne 0x1401ab7f0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
mov rcx, rsi
mov qword [rsi + 0x18], r11
call fcn.1401ab8e0
test eax, eax
je 0x1401ab81f
xor ebx, ebx
lea rdi, [rsi + 0x68]
nop
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rdi], rax
je 0x1401ab81f
add rbx, 1
add rdi, 8
cmp rbx, 4
jl 0x1401ab850
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x60], rax
je 0x1401ab81f
lea rax, [rsi + 0x90]
lea r8, [0x1401abaa0]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rsi + 0x88], rax
je 0x1401ab81f
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1401ae3d0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x58], 0
lea rax, [0x1402a6520]
mov rbx, rcx
mov qword [rcx], rax
je 0x1401ae429
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x58]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1401ae417
mov rcx, qword [rbx + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbx + 0x58], 0
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1401ae440
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], 0
mov rcx, qword [rbx + 0x60]
mov dword [rbx + 8], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401ae471
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x20
pop rbx
ret
Function at 0x1401ae480
Capabilities:
Check mutex on windows
Terminate thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
cmp qword [rcx + 0x58], rdi
mov r12, rdx
mov rbx, rcx
je 0x1401ae4db
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x58]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1401ae4cd
mov rcx, qword [rbx + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbx + 0x58], rdi
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1401ae4ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], rdi
mov dword [rbx + 8], edi
mov rdx, qword [r12]
mov rbp, qword [rbx + 0x10]
lea rcx, [rdx - 0x18]
sub rbp, 0x18
cmp rcx, rbp
je 0x1401ae55a
cmp dword [rbp + 0x10], edi
jl 0x1401ae54d
mov rax, qword [rbp]
cmp qword [rcx], rax
jne 0x1401ae54d
mov qword [rsp + 0x68], r13
call fcn.140002dd0
or ecx, 0xffffffff
mov r13, rax
lock xadd dword [rbp + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x1401ae53e
mov rcx, qword [rbp]
mov rdx, rbp
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r13 + 0x18]
mov r13, qword [rsp + 0x68]
mov qword [rbx + 0x10], rax
jmp 0x1401ae55a
mov r8d, dword [rdx - 0x10]
lea rcx, [rbx + 0x10]
call fcn.14000b770
mov eax, dword [r12 + 8]
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x18], eax
mov rax, qword [r12 + 0x10]
mov qword [rbx + 0x20], rax
mov rax, qword [r12 + 0x18]
mov r12, qword [rsp + 0x60]
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x20], rdi
jne 0x1401ae5a4
mov r8, qword [rbx + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
mov qword [rbx + 0x68], rax
setne al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov r8, qword [rbx + 0x10]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
jne 0x1401ae5cb
cmp eax, 5
je 0x1401ae5d4
lea ecx, [rsi + 3]
jmp 0x1401ae5d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 2
cmp ecx, dword [rbx + 8]
jne 0x1401ae5e5
mov ecx, 1
jmp 0x1401ae5e8
mov dword [rbx + 8], ecx
mov r8, qword [rbx + 0x20]
test r8, r8
je 0x1401ae60f
sub ecx, 2
je 0x1401ae606
cmp ecx, 1
jne 0x1401ae60f
mov rdx, qword [rbx + 0x28]
xor ecx, ecx
call r8
jmp 0x1401ae60f
mov rdx, qword [rbx + 0x28]
mov cl, 1
call r8
cmp qword [rbx + 0x60], rdi
jne 0x1401ae62b
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x60], rax
cmp qword [rbx + 0x58], rdi
jne 0x1401ae660
cmp qword [rbx + 0x60], rdi
je 0x1401ae660
lea rax, [rsp + 0x50]
lea r8, [0x1401ae670]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x50], edi
call fcn.14022e560
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x58], rdi
setne al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401bacf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1401bae52
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401bae52
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1401bae52
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1401bad96
nop
cmp rdi, r11
jae 0x1401bae52
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1401bad80
cmp rdi, r11
jae 0x1401bae52
movzx eax, word [rdi]
test ax, ax
je 0x1401bae52
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1401badcc
mov edx, ebx
mov rcx, rsi
call fcn.140002be0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1401bade9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.14022ba40
test eax, eax
je 0x1401bae28
cmp eax, 0xc
je 0x1401bae22
cmp eax, 0x16
je 0x1401bae1c
cmp eax, 0x22
je 0x1401bae1c
cmp eax, 0x50
je 0x1401bae28
call fcn.1401fd6b8
int3
call fcn.1401fd6b8
int3
call fcn.1401fd670
int3
test ebx, ebx
js 0x1401bae47
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1401bae47
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x1401bae54
mov ecx, 0x80070057
call fcn.140002bc0
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1401bae70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x14032ee30]
xor r13d, r13d
xor edx, edx
mov rbx, r13
call fcn.140249ae8
lea ebp, [r13 + 1]
test rax, rax
mov rsi, rax
je 0x1401baf76
nop
test rbx, rbx
jne 0x1401baf76
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rdi, rax
jne 0x1401baee3
mov rbx, r13
jmp 0x1401baf59
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1401baef9
mov rbx, r13
jmp 0x1401baf54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x1401baf0f
mov rbx, r13
jmp 0x1401baf54
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x1401baf42
nop
nop
cmp rbx, r11
jae 0x1401baf47
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1401baf30
cmp rbx, r11
jb 0x1401baf4c
mov rbx, r13
jmp 0x1401baf54
cmp word [rbx], r13w
cmove rbx, r13
test rbx, rbx
jne 0x1401baf91
lea rcx, [0x14032ee30]
mov edx, ebp
call fcn.140249ae8
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x1401baeb0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x1401baf78