joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014e170
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.140174f60
cmp qword [rbx + 0x350], 0
jle 0x14014e23e
cmp qword [rbx + 0x378], 0
jne 0x14014e1b3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x378], rax
test edi, edi
mov qword [rsp + 0x60], rsi
je 0x14014e249
xor esi, esi
lea rcx, [0x14014dcb0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
mov qword [rsp + 0x58], rbp
call fcn.1401fbf18
test rax, rax
mov rbp, rax
je 0x14014e234
lea rdi, [rbx + 0x370]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
mov r9, rdi
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor esi, esi
cmp qword [rbx + 0x370], rsi
mov dword [rsp + 0x50], esi
je 0x14014e239
mov rcx, qword [rbx + 0x378]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x370]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14014e295
cmp dword [rsp + 0x50], 0x103
jne 0x14014e295
mov rcx, qword [rbx + 0x370]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x370]
test rcx, rcx
je 0x14014e239
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x370], rsi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140174f60
Capabilities:
Resume thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov esi, edx
mov rbx, rcx
call fcn.1401f339c
cmp dword [rbx + 0xf8], 0
jne 0x140174f91
test esi, esi
je 0x140174f91
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x2c8]
mov dword [rbx + 0xf8], eax
lea rax, [rbx + 0x200]
test rax, rax
je 0x140175009
cmp qword [rax + 0x40], 0
je 0x140175009
movsd xmm0, qword [0x140319478]
mov rcx, qword [rbx + 0x240]
xor r8d, r8d
mov edx, 0x418
mulsd xmm0, qword [0x1402b3fa8]
cvttsd2si eax, xmm0
movsxd r9, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x240]
xor r9d, r9d
lea r8d, [r9 + 2]
mov edx, 0x415
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x240]
mov edx, 0x403
add ax, 0xbb8
mov r8d, 2
movzx r9d, ax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rbx + 0x100]
mov qword [rsp + 0x68], rbp
test rdi, rdi
je 0x1401750ad
cmp dword [rbx + 0x1b0], 0
ja 0x140175030
cmp dword [rbx + 0x18c], 0
je 0x1401750ad
test esi, esi
je 0x140175049
lea rdx, [rbx + 0x160]
lea rcx, [rdi + 0x1a10]
call fcn.140149100
jmp 0x1401750ad
lea rbp, [rbx + 0x160]
test rbp, rbp
je 0x1401750ad
cmp qword [rdi + 0x1a50], 0
je 0x1401750ad
lea rcx, [rdi + 0x1a58]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
call fcn.1401f857c
test rax, rax
mov r13, rax
je 0x1401750a3
mov rcx, qword [rdi + 0x1a50]
mov rdx, rbp
mov r8, qword [rcx]
call qword [r8 + 0x38]
lea rcx, [rdi + 0x1a58]
mov rdx, r13
call fcn.1401f8510
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
cmp qword [rbx + 0x2f8], 0
jle 0x1401751c9
cmp qword [rbx + 0x320], 0
jne 0x1401750dc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x320], rax
test esi, esi
je 0x140175164
xor esi, esi
lea rcx, [0x140175820]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
call fcn.1401fbf18
test rax, rax
mov rbp, rax
je 0x1401751c9
lea rdi, [rbx + 0x318]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
mov r9, rdi
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ResumeThread]
xor esi, esi
cmp qword [rbx + 0x318], rsi
mov dword [rsp + 0x60], esi
je 0x1401751c9
mov rcx, qword [rbx + 0x320]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x318]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1401751b0
cmp dword [rsp + 0x60], 0x103
jne 0x1401751b0
mov rcx, qword [rbx + 0x318]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x318]
test rcx, rcx
je 0x1401751c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x318], rsi
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14017c200
Capabilities:
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x40], r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
call fcn.1401f7fd8
nop
lea rax, [0x1402994d8]
mov qword [rbx], rax
lea rax, [0x140299588]
mov qword [rbx + 0x40], rax
call fcn.1401fa4b0
mov rcx, rax
xor esi, esi
mov eax, esi
test rcx, rcx
setne al
test eax, eax
jne 0x14017c26d
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x48], rax
lea r12, [rbx + 0x60]
mov qword [r12], rsi
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x78], rsi
lea rdi, [rbx + 0x80]
mov esi, 4
nop
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
add rdi, 8
sub rsi, 1
jne 0x14017c2a0
test rbp, rbp
jne 0x14017c2c6
xor ecx, ecx
jmp 0x14017c2d9
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rbx + 0x48]
call fcn.140007880
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
mov dword [rbx + 0x50], eax
mov eax, dword [rcx + 4]
mov dword [rbx + 0x54], eax
mov eax, dword [rcx + 8]
mov dword [rbx + 0x58], eax
mov eax, dword [rcx + 0xc]
mov dword [rbx + 0x5c], eax
mov qword [rsp + 0x20], r12
lea r9, [0x14026dec8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14026de78]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14017c3d5
mov rcx, qword [r12]
mov rax, qword [rcx]
lea rdx, [rbx + 0x40]
call qword [rax + 0x30]
test eax, eax
js 0x14017c3d5
xor ebp, ebp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x14017ca70]
call fcn.1401fbf18
mov rsi, rax
test rax, rax
je 0x14017c3d5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
lea r9, [rbx + 0x78]
mov r8, rdi
mov rdx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call fcn.14017c950
test eax, eax
je 0x14017c3d5
mov rcx, rbx
call fcn.14017c950
test eax, eax
je 0x14017c3d5
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14017c3d5
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov rax, rbx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401a5200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
mov r12, r9
call fcn.14022a8c0
call fcn.1401ed45c
lea r8, str.WAVE
mov rcx, qword [rax + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rbx, rbx
mov rbp, rax
je 0x1401a5429
test rax, rax
je 0x1401a5429
mov qword [rsp + 0xa0], rdi
call fcn.1401ed45c
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
call fcn.1401ed45c
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [rsp + 0x20]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x24], 0x204d454d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WINMM.dll_mmioOpenW]
lea rdx, [rsi + 0x260]
mov r9d, 0x20
xor r8d, r8d
mov rcx, rax
mov rbx, rax
mov dword [rsi + 0x268], 0x45564157
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401a541a
lea r9d, [rax + 0x10]
lea r8, [rsi + 0x260]
lea rdx, [rsi + 0x24c]
mov rcx, rbx
mov dword [rsi + 0x24c], 0x20746d66
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401a541a
lea rdx, [rsi + 0x24c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
lea r8, [rsi + 0x260]
lea rdx, [rsi + 0x238]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
mov dword [rsi + 0x238], 0x61746164
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401a541a
lea rdx, [rsi + 0x238]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x258]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x250]
lea rdx, [rsi + 0x210]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x250], eax
jne 0x1401a541a
cmp word [rsi + 0x212], 1
jne 0x1401a541a
cmp word [rsi + 0x21e], 0x10
jne 0x1401a541a
mov eax, dword [rsi + 0x23c]
mov rdx, r12
mov rcx, rsi
mov dword [rsi + 0xd4], eax
call fcn.1401a5430
test eax, eax
jne 0x1401a5401
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
mov rcx, rsi
call fcn.1401a5950
xor eax, eax
mov rdi, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov dword [rsi + 0xd0], 1
mov dword [rsi + 0xdc], 0
mov rax, rbx
jmp 0x1401a53df
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x1401a53df
xor eax, eax
jmp 0x1401a53e7
Function at 0x1401a5430
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
lea rdx, [rcx + 0x10]
lea rcx, [0x1401a5800]
call sub.DSOUND.dll_DirectSoundEnumerateW
mov r11, qword [rsi + 0x10]
test r11, r11
je 0x1401a548f
nop
mov rdx, qword [r11]
cmp rdx, qword [rsi + 0x288]
jne 0x1401a547d
mov rdx, qword [r11 + 8]
cmp rdx, qword [rsi + 0x290]
jne 0x1401a547d
xor eax, eax
jmp 0x1401a5482
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1401a54a1
mov r11, qword [r11 + 0x18]
test r11, r11
jne 0x1401a5460
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
mov rcx, rsi
mov qword [rsi + 0x18], r11
call fcn.1401a5550
test eax, eax
je 0x1401a548f
xor ebx, ebx
lea rdi, [rsi + 0x68]
nop
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rdi], rax
je 0x1401a548f
add rbx, 1
add rdi, 8
cmp rbx, 4
jl 0x1401a54c0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x60], rax
je 0x1401a548f
lea rax, [rsi + 0x90]
lea r8, [0x1401a5710]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rsi + 0x88], rax
je 0x1401a548f
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1401a8040
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x58], 0
lea rax, [0x14029e3c0]
mov rbx, rcx
mov qword [rcx], rax
je 0x1401a8099
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x58]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1401a8087
mov rcx, qword [rbx + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbx + 0x58], 0
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1401a80b0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], 0
mov rcx, qword [rbx + 0x60]
mov dword [rbx + 8], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401a80e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x20
pop rbx
ret
Function at 0x1401a80f0
Capabilities:
Check mutex on windows
Terminate thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
cmp qword [rcx + 0x58], rdi
mov r12, rdx
mov rbx, rcx
je 0x1401a814b
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x58]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1401a813d
mov rcx, qword [rbx + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbx + 0x58], rdi
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1401a815e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], rdi
mov dword [rbx + 8], edi
mov rdx, qword [r12]
mov rbp, qword [rbx + 0x10]
lea rcx, [rdx - 0x18]
sub rbp, 0x18
cmp rcx, rbp
je 0x1401a81ca
cmp dword [rbp + 0x10], edi
jl 0x1401a81bd
mov rax, qword [rbp]
cmp qword [rcx], rax
jne 0x1401a81bd
mov qword [rsp + 0x68], r13
call fcn.1400074a0
or ecx, 0xffffffff
mov r13, rax
lock xadd dword [rbp + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x1401a81ae
mov rcx, qword [rbp]
mov rdx, rbp
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r13 + 0x18]
mov r13, qword [rsp + 0x68]
mov qword [rbx + 0x10], rax
jmp 0x1401a81ca
mov r8d, dword [rdx - 0x10]
lea rcx, [rbx + 0x10]
call fcn.140007880
mov eax, dword [r12 + 8]
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x18], eax
mov rax, qword [r12 + 0x10]
mov qword [rbx + 0x20], rax
mov rax, qword [r12 + 0x18]
mov r12, qword [rsp + 0x60]
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x20], rdi
jne 0x1401a8214
mov r8, qword [rbx + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
mov qword [rbx + 0x68], rax
setne al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov r8, qword [rbx + 0x10]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
jne 0x1401a823b
cmp eax, 5
je 0x1401a8244
lea ecx, [rsi + 3]
jmp 0x1401a8249
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 2
cmp ecx, dword [rbx + 8]
jne 0x1401a8255
mov ecx, 1
jmp 0x1401a8258
mov dword [rbx + 8], ecx
mov r8, qword [rbx + 0x20]
test r8, r8
je 0x1401a827f
sub ecx, 2
je 0x1401a8276
cmp ecx, 1
jne 0x1401a827f
mov rdx, qword [rbx + 0x28]
xor ecx, ecx
call r8
jmp 0x1401a827f
mov rdx, qword [rbx + 0x28]
mov cl, 1
call r8
cmp qword [rbx + 0x60], rdi
jne 0x1401a829b
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x60], rax
cmp qword [rbx + 0x58], rdi
jne 0x1401a82d0
cmp qword [rbx + 0x60], rdi
je 0x1401a82d0
lea rax, [rsp + 0x50]
lea r8, [0x1401a82e0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x50], edi
call fcn.140229ec0
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x58], rdi
setne al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401b4a00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x140325e90]
xor r13d, r13d
xor edx, edx
mov rbx, r13
call fcn.140245774
lea ebp, [r13 + 1]
test rax, rax
mov rsi, rax
je 0x1401b4b06
nop
test rbx, rbx
jne 0x1401b4b06
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rdi, rax
jne 0x1401b4a73
mov rbx, r13
jmp 0x1401b4ae9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1401b4a89
mov rbx, r13
jmp 0x1401b4ae4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x1401b4a9f
mov rbx, r13
jmp 0x1401b4ae4
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x1401b4ad2
nop
nop
cmp rbx, r11
jae 0x1401b4ad7
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1401b4ac0
cmp rbx, r11
jb 0x1401b4adc
mov rbx, r13
jmp 0x1401b4ae4
cmp word [rbx], r13w
cmove rbx, r13
test rbx, rbx
jne 0x1401b4b21
lea rcx, [0x140325e90]
mov edx, ebp
call fcn.140245774
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x1401b4a40
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x1401b4b08
Function at 0x1401c4e10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov ebx, r9d
mov qword [rsp + 0x40], 0
mov rdx, r8
lea rcx, [rsp + 0x38]
call fcn.14003c380
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWARESRS_LabsAPO
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c4f1b
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1401c4ee2
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401c4ece
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401c4ede
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1401c4f3f
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401c4f04
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401c4f14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1401c4f3f
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401c4f3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x1401e4f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rsi, rcx
lea r8d, [rdx + 0x64]
lea rcx, [rsp + 0x20]
call fcn.14022a8c0
call fcn.1401ed45c
lea r8, str.WAVE
mov rcx, qword [rax + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rbx, rbx
mov rbp, rax
je 0x1401e5159
test rax, rax
je 0x1401e5159
mov qword [rsp + 0xa0], rdi
call fcn.1401ed45c
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
call fcn.1401ed45c
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [rsp + 0x20]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x24], 0x204d454d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WINMM.dll_mmioOpenW]
lea rdx, [rsi + 0x94]
mov r9d, 0x20
xor r8d, r8d
mov rcx, rax
mov rbx, rax
mov dword [rsi + 0x9c], 0x45564157
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401e514a
lea r9d, [rax + 0x10]
lea r8, [rsi + 0x94]
lea rdx, [rsi + 0x80]
mov rcx, rbx
mov dword [rsi + 0x80], 0x20746d66
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401e514a
lea rdx, [rsi + 0x80]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
lea r8, [rsi + 0x94]
lea rdx, [rsi + 0x6c]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
mov dword [rsi + 0x6c], 0x61746164
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x1401e514a
lea rdx, [rsi + 0x6c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x8c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x84]
lea rdx, [rsi + 0x44]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x84], eax
jne 0x1401e514a
cmp word [rsi + 0x46], 1
jne 0x1401e514a
cmp word [rsi + 0x52], 0x10
jne 0x1401e514a
mov dword [rsi + 0xe8], 0
mov rax, rbx
mov rdi, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x1401e512d
xor eax, eax
jmp 0x1401e5135
Function at 0x1401e5ad0
Capabilities:
Get file size
Read .ini file

Disassembly:
push rsi
sub rsp, 0x50
test rdx, rdx
mov rsi, rcx
jne 0x1401e5ae6
xor eax, eax
add rsp, 0x50
pop rsi
ret
mov qword [rcx + 8], rdx
mov rcx, qword [0x14032ded8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rdi
xor edi, edi
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1401e5c80
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
setne dil
test edi, edi
je 0x1401e5c80
mov eax, 2
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov r13, 0xffffffffffffffff
mul rbp
cmovo rax, r13
mov rcx, rax
call fcn.1401ebdc8
test rax, rax
mov r12, rax
jne 0x1401e5ba0
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
mov word [rax], 0
mov rax, qword [0x14032ded8]
lea r8, [0x140273028]
mov qword [rsp + 0x28], rax
mov r9, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r8, str.SetCount
lea rdx, str.DefLevel
lea rcx, [0x14032a360]
xor r9d, r9d
call fcn.1401ffa54
mov rbx, r12
mov dword [rsi + 0x10], eax
cmp word [r12], 0
je 0x1401e5c16
mov rdx, rbx
mov rcx, rsi
call fcn.1401e5f90
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], ax
jne 0x1401e5bf4
cmp dword [rsi + 0x18], 0
je 0x1401e5c3e
add dword [rsi + 0x10], 1
mov r9d, dword [rsi + 0x10]
lea r8, str.SetCount
lea rdx, str.DefLevel
lea rcx, [0x14032a360]
call fcn.1401ffaf4
cmp dword [rsi + 0x14], 0
jne 0x1401e5c6e
lea r8, str.Finished
lea rdx, str.DefLevel
lea rcx, [0x14032a360]
mov r9d, 1
call fcn.1401ffaf4
mov dword [0x140326334], 1
mov rcx, r12
call fcn.1401ebdc0
mov eax, 1
jmp 0x1401e5b81
xor eax, eax
jmp 0x1401e5b8b