joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1008
call fcn.140180a70
sub rsp, rax
mov rax, qword [0x14020e318]
xor rax, rsp
mov qword [rsp + 0xff0], rax
cmp dword [0x14022c128], 0
je 0x140001c51
lea rcx, [0x14022c0c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rsp + 0x1010]
lea r8, [rsp + 0x1018]
lea rcx, [rsp + 0x820]
call fcn.14015b780
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x4a]
movzx r11d, word [rsp + 0x4e]
movzx eax, word [rsp + 0x4c]
movzx r9d, word [rsp + 0x48]
lea rdx, [rsp + 0x820]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r8, str._02d:_02d:_02d:_03d___s_n
lea rcx, [rsp + 0x50]
mov edx, 0x3e6
call fcn.14015bca0
cmp dword [reloc.DSOUND.dll_DirectSoundCreate], 0
je 0x140001c39
mov rdx, qword [0x14022c120]
test rdx, rdx
jne 0x140001c21
call fcn.1400019c0
mov rdx, qword [0x14022c120]
test rdx, rdx
je 0x140001c51
lea rcx, [rsp + 0x50]
call fcn.14015bd00
mov rcx, qword [0x14022c120]
call fcn.14015c0a0
jmp 0x140001c44
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x14022c0c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xff0]
xor rcx, rsp
call fcn.14015b6f0
add rsp, 0x1008
ret
Function at 0x140005140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1400052a2
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400052a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400052a2
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400051e6
nop
cmp rdi, r11
jae 0x1400052a2
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400051d0
cmp rdi, r11
jae 0x1400052a2
movzx eax, word [rdi]
test ax, ax
je 0x1400052a2
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x14000521c
mov edx, ebx
mov rcx, rsi
call fcn.140001c90
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x140005239
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.14015c410
test eax, eax
je 0x140005278
cmp eax, 0xc
je 0x140005272
cmp eax, 0x16
je 0x14000526c
cmp eax, 0x22
je 0x14000526c
cmp eax, 0x50
je 0x140005278
call fcn.14013de24
int3
call fcn.14013de24
int3
call fcn.14013dddc
int3
test ebx, ebx
js 0x140005297
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140005297
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x1400052a4
mov ecx, 0x80070057
call fcn.140001c70
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x1400052c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400052f3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x140005337
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140005332
cmp rbx, r11
jae 0x140005337
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140005320
cmp rbx, r11
jb 0x14000533b
xor eax, eax
jmp 0x140005347
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140006c20
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 0x10
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
cmp ebx, 1
mov ecx, eax
jne 0x140006ccf
add ecx, 0xfffffff4
cmp ecx, 0xe8
ja case.0x140006c6d.13
lea rdx, [0x140000000]
movsxd rax, ecx
movzx eax, byte [rdx + rax + 0x6db4]
mov ecx, dword [rdx + rax*4 + 0x6dac]
add rcx, rdx
jmp rcx
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.UA_65945523_4
repne scasw ax, word [rdi]
lea rdx, str.UA_65945523_4
not rcx
lea r8d, [rcx - 1]
lea rcx, [0x14022d410]
call fcn.1400038f0
lea rax, [0x1402166a0]
lea rdx, [0x140216678]
mov qword [0x14022c340], rax
mov eax, 9
mov qword [0x14022c338], rdx
mov dword [0x14022c348], eax
mov dword [0x14022c34c], 4
jmp 0x140006d52
cmp ebx, 2
jne 0x140006d4c
sub ecx, 0x2d
je case.0x140006c6d.13
sub ecx, 0x31
je case.0x140006c6d.13
cmp ecx, 0x28
je case.0x140006c6d.13
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.UA_65945523_11
repne scasw ax, word [rdi]
lea rdx, str.UA_65945523_11
not rcx
lea r8d, [rcx - 1]
lea rcx, [0x14022d410]
call fcn.1400038f0
lea rax, [0x1402166d0]
lea rdx, [0x1402166b0]
mov qword [0x14022c340], rax
mov eax, 6
mov qword [0x14022c338], rdx
mov dword [0x14022c348], eax
mov dword [0x14022c34c], 0x10
jmp 0x140006d52
mov eax, dword [0x14022c348]
lea rcx, [0x14022d3c0]
mov edx, eax
mov r8d, eax
mov dword [reloc.DSOUND.dll_DirectSoundCreate], ebx
call fcn.14014f9d4
mov edx, dword [0x14022c34c]
lea rcx, [0x14022d3e8]
mov r8, rdx
call fcn.14014e338
call fcn.140006ea0
mov edx, 0x28
lea rcx, [0x14022d428]
mov r8d, edx
call fcn.1401553f0
mov dword [0x14022c328], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007140
Capabilities:
Get file version info

Disassembly:
push rdi
push r12
push r13
mov eax, 0x10070
call fcn.140180a70
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x10098], rbx
mov qword [rsp + 0x100a0], rbp
mov qword [rsp + 0x100a8], rsi
mov rax, qword [0x14020e318]
xor rax, rsp
mov qword [rsp + 0x10060], rax
mov r13, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
mov dword [rsp + 0x3c], edi
mov word [rsp + 0x60], di
xor edx, edx
mov r8d, 0xfffc
lea rcx, [rsp + 0x62]
call fcn.1401601f0
mov r8d, 0x7fff
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x38], eax
test eax, eax
je 0x140007248
mov ecx, eax
call fcn.14013c75c
mov rbx, rax
test rax, rax
je 0x140007248
mov r9, rax
mov r8d, dword [rsp + 0x38]
xor edx, edx
lea rcx, [rsp + 0x60]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140007240
mov qword [rsp + 0x40], rdi
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [0x14019d8a0]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140007240
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140007240
mov eax, dword [rcx + 8]
mov dword [rsp + 0x34], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x30], eax
mov rcx, rbx
call fcn.14013c754
jmp 0x140007248
mov rcx, rbx
call fcn.14013c754
mov ebx, dword [rsp + 0x34]
shr ebx, 0x10
movzx ebp, word [rsp + 0x34]
mov esi, dword [rsp + 0x30]
shr esi, 0x10
movzx r12d, word [rsp + 0x30]
call fcn.14013e120
test rax, rax
setne dil
test edi, edi
jne 0x14000727c
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [r13], rax
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
mov r9d, ebp
mov r8d, ebx
lea rdx, str._d._d._d._d
mov rcx, r13
call fcn.140001df0
mov rax, r13
mov rcx, qword [rsp + 0x10060]
xor rcx, rsp
call fcn.14015b6f0
lea r11, [rsp + 0x10070]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140014910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rax, r8
mov rbp, rdx
mov rdi, rcx
xor r13d, r13d
lea r8, [0x1401a5b50]
mov rdx, rax
mov rcx, rbp
mov rbx, r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140014aaf
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov esi, eax
je 0x140014aaf
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r12, rax
je 0x140014aaf
lea ecx, [r13 + 2]
mov rdx, rsi
mov rbp, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x140014aaf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [rsp + 0x70]
test rax, rax
je 0x140014a3e
mov r8, rbp
mov rdx, r12
mov rcx, rax
call fcn.1401604f0
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x140014aaf
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call fcn.1400158c0
test eax, eax
js 0x140014aaf
call fcn.140040480
test eax, eax
je 0x140014a2a
test esi, esi
je 0x140014a1b
mov rcx, qword [rsp + 0x20]
xor edx, edx
call fcn.140015850
jmp 0x140014a26
mov rcx, qword [rdi + 8]
xor edx, edx
call fcn.1400157e0
mov qword [rdi + 0x48], rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x140014a53
mov rcx, rdi
call fcn.140014b00
movss xmm1, dword [0x1401b8f78]
movss xmm0, dword [0x1402101fc]
ucomiss xmm0, xmm1
jp 0x140014a79
jne 0x140014a79
movss xmm0, dword [0x1402102b4]
ucomiss xmm0, xmm1
jp 0x140014a79
je 0x140014aa8
mov edx, 3
mov eax, 7
test esi, esi
cmovne edx, eax
mov rcx, rdi
call fcn.140014cf0
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140014aa8
mov r8, qword [rcx]
mov edx, 1
call qword [r8]
mov qword [rdi + 0x48], r13
mov eax, 1
jmp 0x140014add
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140014ac4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x20], r13
test rbx, rbx
je 0x140014adb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x14001c5a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
lea r8, [0x1401a5b50]
xor ebx, ebx
mov rbp, rcx
mov qword [rsp + 0x58], rbx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x14001c6b4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov esi, eax
je 0x14001c6b4
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbp, rax
je 0x14001c6b4
lea ecx, [rbx + 2]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x14001c6b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14001c688
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1401604f0
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x14001c6b4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001c6cd
xor edx, edx
call fcn.140015850
test rax, rax
mov rdi, rax
je 0x14001c6b4
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rdi
call fcn.14001c0e0
test rdi, rdi
mov rbx, rax
je 0x14001c6af
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
mov rax, rbx
jmp 0x14001c6e6
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001c6cd
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x58], 0
test rbx, rbx
je 0x14001c6e4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140037cb0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140037d39
mov ecx, 0x114
mov ebx, 1
call fcn.14015ddd0
test rax, rax
mov rdi, rax
je 0x140037dae
xor edx, edx
mov r8d, 0x114
mov rcx, rax
call fcn.1401601f0
mov rcx, rdi
mov dword [rdi], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rdi + 4]
cmp r11d, 4
jne 0x140037d14
lea ebx, [r11 + 1]
jmp 0x140037da6
cmp r11d, 5
jne 0x140037da6
cmp dword [rdi + 8], 0
jne 0x140037d2a
lea ebx, [r11 + 1]
jmp 0x140037da6
cmp r11d, 5
jne 0x140037da6
cmp dword [rdi + 8], ebx
lea eax, [r11 + 2]
jmp 0x140037da3
cmp al, 4
jae 0x140037d4a
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x114
mov ebx, 2
call fcn.14015ddd0
test rax, rax
mov rdi, rax
je 0x140037dae
xor edx, edx
mov r8d, 0x114
mov rcx, rax
call fcn.1401601f0
mov rcx, rdi
mov dword [rdi], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rdi + 4]
cmp r11d, 4
jne 0x140037da6
cmp dword [rdi + 8], 0xa
jne 0x140037d96
lea ebx, [r11 - 1]
jmp 0x140037da6
cmp r11d, 4
jne 0x140037da6
cmp dword [rdi + 8], 0x5a
mov eax, r11d
cmove ebx, eax
mov rcx, rdi
call fcn.14015dea0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003f5b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x2a8
mov rax, qword [0x14020e318]
xor rax, rsp
mov qword [rsp + 0x290], rax
cmp dword [0x14022de30], 0
jne 0x14003f70e
lea rax, [rsp + 0x38]
mov qword [rsp + 0x2a0], rdi
lea rdx, str.SoftwareMicrosoftPlus_ThemesCurrent
mov edi, 1
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [0x14022de30], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003f706
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 0x104
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003f6fb
mov rax, qword [str.Windows_Classic.theme]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x2b0], rbx
mov qword [rcx], rax
mov rax, qword [0x1401a52e8]
mov qword [rcx + 8], rax
mov rax, qword [0x1401a52f0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401a52f8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401a5300]
mov qword [rcx + 0x20], rax
mov eax, dword [0x1401a5308]
mov dword [rcx + 0x28], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x40]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, eax
jl 0x14003f6f3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x40]
movsxd rcx, eax
mov rax, rbx
sub rax, rcx
lea rcx, [rsp + rax*2 + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [0x14022de2c]
test eax, eax
cmove ecx, edi
mov dword [0x14022de2c], ecx
mov rbx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x2a0]
mov eax, dword [0x14022de2c]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14015b6f0
add rsp, 0x2a8
ret
Function at 0x1400404b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov edi, ecx
mov ecx, 0x10
mov ebx, edx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x11
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp esi, edi
jge 0x1400404f5
cvtsi2ss xmm1, esi
cvtsi2ss xmm0, edi
divss xmm1, xmm0
movss dword [0x14021034c], xmm1
jmp 0x1400404fd
movss xmm1, dword [0x14021034c]
cmp eax, ebx
jge 0x140040517
cvtsi2ss xmm2, eax
cvtsi2ss xmm0, ebx
divss xmm2, xmm0
movss dword [0x140210404], xmm2
jmp 0x14004051f
movss xmm2, dword [0x140210404]
comiss xmm1, xmm2
jbe 0x140040531
movss dword [0x14021034c], xmm2
movaps xmm1, xmm2
jmp 0x140040541
comiss xmm2, xmm1
jbe 0x140040541
movss dword [0x140210404], xmm1
movaps xmm2, xmm1
movss xmm0, dword [0x1401b8f78]
comiss xmm0, xmm2
jbe 0x1400405dc
comiss xmm2, dword [0x1401c2178]
ja 0x1400405c1
cmp eax, 0x258
jle 0x1400405c1
comiss xmm2, dword [0x1401c2174]
jbe 0x140040575
movss xmm2, dword [0x1401c2170]
jmp 0x1400405c9
comiss xmm2, dword [0x1401c216c]
jbe 0x140040588
movss xmm2, dword [0x1401c2168]
jmp 0x1400405c9
comiss xmm2, dword [0x1401c2164]
jbe 0x14004059b
movss xmm2, dword [0x1401c2160]
jmp 0x1400405c9
comiss xmm2, dword [0x1401b91a8]
jbe 0x1400405ae
movss xmm2, dword [0x1401b8fa0]
jmp 0x1400405c9
comiss xmm2, dword [0x1401c215c]
jbe 0x1400405d1
movss xmm2, dword [0x1401c2158]
jmp 0x1400405c9
movss xmm2, dword [0x1401c02c8]
movss dword [0x140210404], xmm2
movss dword [0x14021034c], xmm2
movaps xmm1, xmm2
movss xmm0, dword [0x1402101fc]
lea rcx, str.CDpiScaler::InitUIScaleFactor:_FullScreen__d_X__d__RealWindowSize__d_X__d__DPI__.2f__UIScale__.2f
mov r9d, edi
mov r8d, eax
mov edx, esi
mulss xmm0, xmm1
movss xmm1, dword [0x1402102b4]
mulss xmm1, xmm2
movss dword [0x1402101fc], xmm0
cvtss2sd xmm0, xmm2
movsd qword [rsp + 0x30], xmm0
movss dword [0x1402102b4], xmm1
cvtss2sd xmm1, xmm1
movsd qword [rsp + 0x28], xmm1
mov dword [rsp + 0x20], ebx
call fcn.140001b40
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATION
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400406c3
movss xmm0, dword [0x140210404]
mov rbx, qword [rsp + 0x60]
lea rdx, str.CplScalingFactor
addss xmm0, dword [0x1401b8f7c]
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 4
mulss xmm0, dword [0x1401b8f40]
cvttss2si rax, xmm0
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400406c3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140041080
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1400410dc
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 8]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400410ca
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400410f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140041108
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140050470
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, rcx
mov word [rcx + 0xf0], 0x409
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebp, 0x404
xor ebx, ebx
test ax, ax
movzx r11d, ax
lea rdi, [0x140215208]
lea r13, str.Arabic
lea r14d, [rbp + 0x12]
mov r12d, 0x804
je 0x14005056f
movzx r9d, ax
mov r8w, 0x409
mov ecx, ebx
and r9w, 0x3ff
mov rdx, rdi
movzx eax, word [rdx]
and ax, 0x3ff
cmp r9w, ax
je 0x1400504fb
add ecx, 1
add rdx, 0x10
cmp ecx, 0x21
jb 0x1400504e0
jmp 0x140050508
movsxd rax, ecx
shl rax, 4
mov r8w, word [rax + r13 + 8]
mov ax, r11w
and eax, 0x3ff
cmp eax, 4
je 0x140050553
cmp eax, 0x16
je 0x14005053a
cmp eax, 0x1a
jne 0x140050567
shr r11w, 0xa
cmp r11w, 2
je 0x140050533
cmp r11w, 9
jne 0x140050567
mov r8w, 0x81a
jmp 0x140050567
and r11w, 0xfc00
mov r8d, 0x816
cmp r11w, 0x400
cmove r8w, r14w
jmp 0x140050567
and r11w, 0xfc00
mov r8d, ebp
cmp r11w, 0x800
cmove r8w, r12w
mov word [rsi + 0xf0], r8w
movzx eax, word [rsi + 0xf0]
lea r8, str.Language
lea rdx, str.General
lea rcx, [0x14022c580]
xor r9d, r9d
mov dword [rsi + 8], 1
mov word [rsi + 0xc], ax
call fcn.14014cc50
test ax, ax
mov r11d, eax
je 0x140050651
movzx r9d, ax
mov r8w, 0x409
mov edx, ebx
and r9w, 0x3ff
mov rax, rdi
nop
movzx ecx, word [rax]
and cx, 0x3ff
cmp r9w, cx
je 0x1400505dc
add edx, 1
add rax, 0x10
cmp edx, 0x21
jb 0x1400505c0
jmp 0x1400505e9
movsxd rax, edx
shl rax, 4
mov r8w, word [rax + r13 + 8]
mov ax, r11w
and eax, 0x3ff
cmp eax, 4
je 0x140050634
cmp eax, 0x16
je 0x14005061b
cmp eax, 0x1a
jne 0x140050649
shr r11w, 0xa
cmp r11w, 2
je 0x140050614
cmp r11w, 9
jne 0x140050649
mov r8w, 0x81a
jmp 0x140050649
and r11w, 0xfc00
mov r8d, 0x816
cmp r11w, 0x400
cmove r8w, r14w
jmp 0x140050649
and r11w, 0xfc00
cmp r11w, 0x800
cmove bp, r12w
mov r8w, bp
mov word [rsi + 0xc], r8w
mov dword [rsi + 8], ebx
cmp dword [rsi + 8], ebx
je 0x140050662
mov dword [rsi + 0xf4], 0x20
jmp 0x14005067f
movzx eax, word [rsi + 0xc]
cmp word [rdi], ax
je 0x140050679
add ebx, 1
add rdi, 0x10
cmp ebx, 0x21
jb 0x140050666
jmp 0x14005067f
mov dword [rsi + 0xf4], ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x140051bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov edx, 6
add ax, 1
mov rcx, rbp
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov r12, rax
je 0x140051d32
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140051d32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140051d32
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140051c76
nop
cmp rdi, r11
jae 0x140051d32
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140051c60
cmp rdi, r11
jae 0x140051d32
movzx eax, word [rdi]
test ax, ax
je 0x140051d32
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x140051cac
mov edx, ebx
mov rcx, rsi
call fcn.140001c90
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x140051cc9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.14015c410
test eax, eax
je 0x140051d08
cmp eax, 0xc
je 0x140051d02
cmp eax, 0x16
je 0x140051cfc
cmp eax, 0x22
je 0x140051cfc
cmp eax, 0x50
je 0x140051d08
call fcn.14013de24
int3
call fcn.14013de24
int3
call fcn.14013dddc
int3
test ebx, ebx
js 0x140051d27
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140051d27
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140051d34
mov ecx, 0x80070057
call fcn.140001c70
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret