joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d81a0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rcx
cmp qword [rcx + 0x20], 0
jne 0x1400d81ea
lea r8, str.SpkSettingUI.cpp
mov edx, 0x19d
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.140055180
call fcn.1400d5c70
xor edx, edx
lea r9, [0x1403de640]
mov rcx, r9
lea r8, [0x1403de6e8]
cmp dword [rcx], eax
je 0x1400d8215
inc edx
add rcx, 0x18
cmp rcx, r8
jl 0x1400d8202
xor esi, esi
jmp 0x1400d8222
movsxd rax, edx
lea rcx, [rax + rax*2]
movzx esi, word [r9 + rcx*8 + 4]
mov rdi, qword [rbx + 0x20]
cmp dword [rdi + 0x428], 0
jne 0x1400d8322
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0x64
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x1403465a8]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1403465c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400d82ac
mov edx, 0x715
mov r9d, eax
lea r8, str.AudioDevice.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_ERROR:_Line___d__File___s__hr__0x_X_n
call fcn.140055180
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400d8397
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
xor r8d, r8d
cmp dword [rdi + 0x168], r8d
sete r8b
mov rdx, qword [rdi + 0x118]
call qword [rax + 0x38]
test eax, eax
jns 0x1400d82d7
mov edx, 0x717
jmp 0x1400d8271
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea r8, [rdi + 0x304]
lea r9, [rsp + 0x50]
mov edx, 3
call qword [rax + 0x40]
test eax, eax
jns 0x1400d8301
mov edx, 0x719
jmp 0x1400d8271
mov rcx, rdi
call fcn.1400191f0
mov rcx, rdi
call fcn.140019540
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400d8322
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edx, 0x4000
cmp esi, 6
jb 0x1400d8358
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 0x308]
test cl, cl
jns 0x1400d8358
bt ecx, 0x11
jb 0x1400d8358
mov rax, qword [rbx + 0xf8]
test dword [rax + 0x4c], edx
je 0x1400d8351
cmp esi, 6
je 0x1400d8358
mov eax, 0x2000
jmp 0x1400d835a
xor eax, eax
mov ecx, dword [rbx + 0x100]
btr ecx, 0xd
or ecx, eax
mov dword [rbx + 0x100], ecx
cmp esi, 6
jb 0x1400d8389
mov rax, qword [rbx + 0x20]
mov r8d, dword [rax + 0x308]
test r8b, 0x20
je 0x1400d8389
bt r8d, 0xf
jae 0x1400d838b
xor edx, edx
btr ecx, 0xe
or ecx, edx
mov dword [rbx + 0x100], ecx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d83b0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rcx
mov rdi, qword [rcx + 0x20]
test rdi, rdi
jne 0x1400d83fc
lea r8, str.SpkSettingUI.cpp
mov edx, 0x1c9
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.140055180
cmp dword [rdi + 0x428], 0
jne 0x1400d84f6
xor esi, esi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], 0x64
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x1403465a8]
xor edx, edx
lea r8d, [rsi + 0x17]
lea rcx, [0x1403465c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400d8480
mov edx, 0x715
mov r9d, eax
lea r8, str.AudioDevice.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_ERROR:_Line___d__File___s__hr__0x_X_n
call fcn.140055180
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400d8582
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
cmp dword [rdi + 0x168], 0
sete sil
mov r8d, esi
mov rdx, qword [rdi + 0x118]
call qword [rax + 0x38]
test eax, eax
jns 0x1400d84ab
mov edx, 0x717
jmp 0x1400d8445
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea r8, [rdi + 0x304]
lea r9, [rsp + 0x50]
mov edx, 3
call qword [rax + 0x40]
test eax, eax
jns 0x1400d84d5
mov edx, 0x719
jmp 0x1400d8445
mov rcx, rdi
call fcn.1400191f0
mov rcx, rdi
call fcn.140019540
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400d84f6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call fcn.1400d6d80
mov r8d, eax
mov dword [rbx + 0x10c], eax
cmp eax, 4
je 0x1400d8582
mov edx, eax
test eax, eax
je 0x1400d8548
sub edx, 1
je 0x1400d853b
sub edx, 1
je 0x1400d852e
cmp edx, 1
jne 0x1400d8562
mov rax, qword [rbx + 0x20]
test byte [rax + 0x310], 0x20
jmp 0x1400d8556
mov rax, qword [rbx + 0x20]
test byte [rax + 0x310], 0x40
jmp 0x1400d8556
mov rax, qword [rbx + 0x20]
test byte [rax + 0x310], 0x10
jmp 0x1400d8556
mov rax, qword [rbx + 0x20]
test dword [rax + 0x308], 0x40000
je 0x1400d8562
mov dword [rbx + 0x10c], 4
mov rax, qword [rbx + 0xf8]
test dword [rax + 0x2c], 0x10000
je 0x1400d8582
cmp r8d, 1
ja 0x1400d8582
mov dword [rbx + 0x10c], 4
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d91e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, qword [rsp + 0xf0]
mov rbp, rdx
xor edx, edx
mov rbx, r8
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
call fcn.14029ff20
lea r8, [0x14034d7c0]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rbx, rbx
je 0x1400d92c1
test rax, rax
je 0x1400d92c1
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r8d, r8d
mov dword [rsp + 0x24], 0x204d454d
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov dword [rsp + 0x3c], edi
call qword [sym.imp.WINMM.dll_mmioOpenW]
mov r9d, 0x20
mov dword [rsi + 0x268], 0x45564157
mov rcx, rax
lea rdx, [rsi + 0x260]
xor r8d, r8d
mov rbx, rax
call qword [sym.imp.WINMM.dll_mmioDescend]
mov rcx, rbx
test eax, eax
je 0x1400d92c8
xor edx, edx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x1400d93f4
mov qword [rsp + 0xe8], r15
lea r8, [rsi + 0x260]
mov r15d, 0x10
mov dword [rsi + 0x24c], 0x20746d66
mov r9d, r15d
lea rdx, [rsi + 0x24c]
call qword [sym.imp.WINMM.dll_mmioDescend]
mov rcx, rbx
test eax, eax
jne 0x1400d93e2
xor r8d, r8d
lea rdx, [rsi + 0x24c]
call qword [sym.imp.WINMM.dll_mmioAscend]
mov r9d, r15d
mov dword [rsi + 0x238], 0x61746164
lea r8, [rsi + 0x260]
mov rcx, rbx
lea rdx, [rsi + 0x238]
call qword [sym.imp.WINMM.dll_mmioDescend]
mov rcx, rbx
test eax, eax
jne 0x1400d93e2
xor r8d, r8d
lea rdx, [rsi + 0x238]
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x258]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x250]
lea rdx, [rsi + 0x210]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x250], eax
jne 0x1400d93df
mov edi, 1
cmp di, word [rsi + 0x212]
jne 0x1400d93df
cmp r15w, word [rsi + 0x21e]
jne 0x1400d93df
mov eax, dword [rsi + 0x23c]
mov rdx, r14
mov rcx, rsi
mov dword [rsi + 0xd4], eax
call fcn.1400d9420
test eax, eax
jne 0x1400d93ca
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
mov rcx, rsi
call fcn.1400d98c0
jmp 0x1400d93ea
mov dword [rsi + 0xd0], edi
mov rax, rbx
mov dword [rsi + 0xdc], 0
jmp 0x1400d93ec
mov rcx, rbx
xor edx, edx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
mov r15, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14029d880
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400da6c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x180]
xor edi, edi
mov rbx, rcx
test rax, rax
je 0x1400da718
cmp dword [rax + 0xdc], edi
je 0x1400da6fb
mov rcx, qword [rax + 0x20]
mov dword [rax + 0xdc], edi
test rcx, rcx
je 0x1400da6fb
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rbx + 0x180]
test rcx, rcx
je 0x1400da718
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x180], rdi
mov edx, 1
mov rcx, rbx
call fcn.1400da950
mov rcx, qword [0x1403ff420]
mov qword [rbx + 0x198], rdi
mov dword [rbx + 0x1bc], 1
test rcx, rcx
jne 0x1400da764
lea r8, str.AudioObjectUI.cpp
mov edx, 0x9b
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140055180
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x21000400
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x60]
Function at 0x1400da950
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor eax, eax
mov rdi, rcx
test edx, edx
mov esi, edx
sete al
mov dword [rcx + 0x1ac], eax
mov rcx, qword [0x1403ff420]
test rcx, rcx
jne 0x1400da992
lea r8, str.AudioObjectUI.cpp
mov edx, 0x9b
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x1400da9a0
mov rax, qword [rcx]
mov r8d, esi
mov edx, 0x21000415
call qword [rax + 0x60]
test esi, esi
je 0x1400da9e2
mov rcx, qword [0x1403ff420]
mov dword [rdi + 0x1c0], 0
test rcx, rcx
jne 0x1400da9d4
lea r8, str.AudioObjectUI.cpp
mov edx, 0x9b
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x1400da9e2
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x21000413
call qword [rax + 0x60]
mov rcx, qword [rdi + 0x190]
test rcx, rcx
jne 0x1400daa10
lea r8, str.SpkTestMgr.cpp
mov edx, 0x175
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140055180
mov edx, 1
mov qword [rsp + 0x40], rbx
call fcn.1400c0350
lea r9, vtable.type_info.0
mov dword [rsp + 0x20], 0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rax
call fcn.1402c2cf4
mov rbx, rax
test rax, rax
je 0x1400daac3
mov rcx, rax
test esi, esi
jne 0x1400daa95
call fcn.1400cc3a0
mov rcx, rbx
mov dword [rdi + 0x1a0], eax
call fcn.1400ccbc0
lea r9d, [rsi + 1]
mov dword [rdi + 0x1a8], eax
xor r8d, r8d
lea rdx, [0x140342930]
mov rcx, rbx
call fcn.14000f4d0
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, [0x140342900]
mov rcx, rbx
call fcn.14000f4d0
jmp 0x1400daac3
xor r8d, r8d
lea rdx, [0x140342930]
cmp dword [rdi + 0x1a0], r8d
mov r9d, 1
setne r8b
call fcn.14000f4d0
mov edx, dword [rdi + 0x1a8]
mov rcx, rbx
call fcn.1400cccc0
mov rcx, qword [rdi + 0x188]
test rcx, rcx
je 0x1400dab09
test esi, esi
jne 0x1400daafe
call fcn.1400d6c30
mov dword [rdi + 0x1a4], eax
test eax, eax
je 0x1400dab09
mov rcx, qword [rdi + 0x188]
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, [0x140342810]
call fcn.14000f4d0
jmp 0x1400dab09
mov edx, dword [rdi + 0x1a4]
call fcn.1400d6d30
mov rax, qword [rdi + 0x178]
test rax, rax
je 0x1400dab5d
mov rcx, qword [rdi + 0x190]
test rcx, rcx
je 0x1400dab5d
test dword [rax + 0xdc], 0x40000
je 0x1400dab5d
mov rax, qword [rcx + 0x1e8]
test rax, rax
je 0x1400dab5d
nop dword [rax]
mov rbx, rax
test rax, rax
je 0x1400dabb3
mov rbx, qword [rbx + 0x10]
mov rax, qword [rax]
cmp dword [rbx + 0xe0], 0
jne 0x1400dab6d
test rax, rax
jne 0x1400dab40
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp dword [rbx + 0x24], 0
je 0x1400dab5d
mov rax, qword [rbx]
lea rdx, [rdi + 0x1b0]
mov r8d, 1
mov rcx, rbx
test esi, esi
jne 0x1400daba0
mov dword [rsp + 0x48], esi
call qword [rax + 0x30]
mov rax, qword [rbx]
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [rax + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call fcn.1400f91a0
int3
Function at 0x1400daff0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x190]
test rax, rax
jne 0x1400db01c
lea r8, str.SpkTestMgr.cpp
mov edx, 0x1fd
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
add rsp, 0x28
jmp fcn.140055180
mov rax, qword [rax + 0x1e8]
test rax, rax
je 0x1400db0aa
mov qword [rsp + 0x38], rbx
mov rbx, rax
test rax, rax
je 0x1400db0c8
mov rbx, qword [rbx + 0x10]
mov rax, qword [rax]
cmp dword [rbx + 0xe8], 0
jne 0x1400db05c
test rax, rax
jne 0x1400db031
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
cmp dword [rbx + 0x24], 0
je 0x1400db0a5
mov qword [rsp + 0x20], rdi
lea rdi, [rcx + 0x1b4]
test edx, edx
je 0x1400db0af
mov rax, qword [rbx]
mov r8d, 1
mov rdx, rdi
mov dword [rsp + 0x30], 0
mov rcx, rbx
call qword [rax + 0x30]
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, rbx
call qword [rax + 0x38]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx]
mov r8d, 1
mov rdx, rdi
jmp 0x1400db09a
call fcn.1400f91a0
int3
Function at 0x1400db0d0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push rdi
mov eax, 0x2090
call fcn.14029e430
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x20a8], rbx
mov qword [rsp + 0x20b0], rsi
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rsp + 0x2080], rax
lea rdi, [rcx + 0x1c8]
mov rax, qword [rdi]
or rbx, 0xffffffffffffffff
cmp dword [rax - 0x10], 0
jne 0x1400db1ab
lea rdx, [rsp + 0x80]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x80]
mov rax, rbx
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400db140
cmp word [rsp + rax*2 + 0x7e], 0x5c
jne 0x1400db171
lea rax, [rax*2 - 2]
cmp rax, 0x2000
jae 0x1400db295
xor ecx, ecx
mov word [rsp + rax + 0x80], cx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400db194
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [rsp + 0x80]
lea rdx, str._sDemoMusic.mp3
mov rcx, rdi
call fcn.14000dfa0
lea rcx, [rsp + 0x40]
call fcn.1401083fc
nop
xor r8d, r8d
mov rdx, qword [rdi]
lea rcx, [rsp + 0x40]
call fcn.140108794
test eax, eax
jne 0x1400db256
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rax
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x1400db28a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rsi, [0x14034d7c0]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140015a40
test al, al
jne 0x1400db22b
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400db210
mov r8d, ebx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400105e0
nop
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.140015740
add rax, 0x18
mov qword [rsp + 0x28], rax
mov r8d, 0x65
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140027410
nop
lea rcx, [rsp + 0x40]
call fcn.14010866c
mov eax, 1
mov rcx, qword [rsp + 0x2080]
xor rcx, rsp
call fcn.14029d880
lea r11, [rsp + 0x2090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000de90
nop
call fcn.14029dc94
int3
Function at 0x1400db860
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
call fcn.1400db990
mov rdx, rdi
lea rcx, [rsi + 0x10]
call fcn.1400157c0
mov eax, dword [rdi + 8]
xor edx, edx
mov dword [rsi + 0x18], eax
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x20], rax
mov rax, qword [rdi + 0x18]
mov qword [rsi + 0x28], rax
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x20], rdx
jne 0x1400db8b9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 0x68], rax
jmp 0x1400db96e
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
jne 0x1400db8dc
cmp eax, 5
je 0x1400db8e5
lea ecx, [rbx + 3]
jmp 0x1400db8ea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 2
cmp ecx, dword [rsi + 8]
jne 0x1400db8f6
mov ecx, 1
jmp 0x1400db8f9
mov dword [rsi + 8], ecx
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x1400db919
sub ecx, 2
je 0x1400db910
cmp ecx, 1
jne 0x1400db919
xor ecx, ecx
jmp 0x1400db912
mov cl, 1
mov rdx, qword [rsi + 0x28]
call r8
cmp qword [rsi + 0x60], 0
jne 0x1400db936
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x60], rax
mov rax, qword [rsi + 0x58]
test rax, rax
jne 0x1400db971
cmp qword [rsi + 0x60], rax
je 0x1400db96e
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400dbaa0]
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r9, rsi
xor edx, edx
call fcn.1402a87b8
mov qword [rsi + 0x58], rax
test rax, rax
mov rbx, qword [rsp + 0x48]
setne al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400db990
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x58], rdi
je 0x1400db9e0
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x58]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400db9d2
mov rcx, qword [rbx + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbx + 0x58], rdi
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1400db9f3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], rdi
mov dword [rbx + 8], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400df6a0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbx, rcx
mov dword [rsp + 0x78], 0
mov edi, 1
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x70], edi
lea rdx, [rsp + 0x78]
call fcn.1400dcd50
test eax, eax
jne 0x1400df6fc
lea r8, str.SrsPremiumSetting.cpp
mov edx, 0x690
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.140055180
lea r8, [rsp + 0x68]
lea rdx, [0x140341478]
mov rcx, qword [rbx + 0x40]
call fcn.1400c0780
mov r8d, dword [rsp + 0x68]
test eax, eax
cmove r8d, edi
mov dword [rsp + 0x68], r8d
lea r9, [rsp + 0x70]
mov edx, dword [rsp + 0x78]
mov rcx, rbx
call fcn.1400df5a0
test eax, eax
jne 0x1400df758
lea r8, str.SrsPremiumSetting.cpp
mov edx, 0x694
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.140055180
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400dea10
nop
lea rcx, [rbx + 0x68]
mov rdx, rax
call fcn.1400157c0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400df799
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x78]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400deba0
nop
lea rcx, [rbx + 0x50]
mov rdx, rax
call fcn.1400157c0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400df7e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x78]
lea rdx, [rsp + 0x40]
call fcn.1400dec70
nop
lea rcx, [rbx + 0x48]
mov rdx, rax
call fcn.1400157c0
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400df82a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400e3810
Capabilities:
Set registry value

Disassembly:
cmp dword [rcx + 0x3c], 0
je 0x1400e3825
mov r9d, edx
lea r8, [0x1403421c8]
jmp fcn.1400e4b90
mov r8d, edx
mov r9d, 1
lea rdx, [0x140342540]
jmp fcn.14000f4d0

Function at 0x1400e4a40
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, r9
test r9, r9
jne 0x1400e4a94
lea r8, str.SrsSetting.cpp
mov edx, 0x20e
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor esi, esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov rdx, r8
lea rcx, [rsp + 0x38]
call fcn.1400c12f0
nop
mov dword [rsp + 0x78], esi
mov ebx, 1
mov r9d, ebx
lea r8, str.SOFTWARESRS_LabsAPO
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140015610
test eax, eax
je 0x1400e4b39
lea r8, str.SrsSetting.cpp
mov edx, 0x217
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
mov ebx, esi
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e4b15
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400e4b25
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e4af2
cmp dword [rsp + 0x30], 4
jne 0x1400e4af2
mov eax, dword [rsp + 0x78]
mov dword [rdi], eax
jmp 0x1400e4af4
Function at 0x1400e4b90
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov edi, r9d
xor ebx, ebx
mov qword [rax - 0x20], rbx
mov dword [rax - 0x18], ebx
mov qword [rax - 0x10], rbx
mov rdx, r8
lea rcx, [rax + 8]
call fcn.1400c12f0
nop
lea r9d, [rbx + 2]
lea r8, str.SOFTWARESRS_LabsAPO
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140015610
test eax, eax
je 0x1400e4bf0
mov edx, 0x22e
jmp 0x1400e4c28
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400e4c3d
mov edx, 0x232
lea r8, str.SrsSetting.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x1400e4c42
mov ebx, 1
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e4c63
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400e4c73
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400e6f70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rsi, r8
mov rdi, rcx
test r8, r8
jne 0x1400e6fb2
lea r8, str.TextCtrl.cpp
lea edx, [rsi + 0x39]
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140055180
mov qword [rsp + 0x30], r14
lea r14, [rcx + rbx*8]
mov rcx, qword [rcx + rbx*8 + 0x40]
test rcx, rcx
jne 0x1400e6fe6
mov ecx, 8
call fcn.1400f8110
test rax, rax
je 0x1400e6fe0
mov rcx, qword [rsi]
mov qword [rax], rcx
mov qword [r14 + 0x40], rax
jmp 0x1400e6fec
mov qword [r14 + 0x40], rax
jmp 0x1400e6fec
mov rax, qword [r8]
mov qword [rcx], rax
mov r14, qword [rsp + 0x30]
test ebx, ebx
jne 0x1400e7028
lea rbx, [rdi + 0x40]
mov edi, 6
nop
cmp qword [rbx], 0
jne 0x1400e701e
mov ecx, 8
call fcn.1400f8110
test rax, rax
je 0x1400e701b
mov rcx, qword [rsi]
mov qword [rax], rcx
mov qword [rbx], rax
add rbx, 8
sub rdi, 1
jne 0x1400e7000
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret