joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1400141a9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400141a9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400141a9
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400140da
cmp rdi, r11
jae 0x1400141a9
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400140c4
cmp rdi, r11
jae 0x1400141a9
movzx eax, word [rdi]
test ax, ax
je 0x1400141a9
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x1400cc4a0]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x14001414a
mov edx, esi
mov rcx, rbp
call fcn.1400141c0
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x1400cc4a0]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x14001419e
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x14001419e
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x1400141ab
mov ecx, 0x80070057
call fcn.140010c90
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14001a2c0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov r13, rcx
call fcn.1400472fc
mov rcx, rax
xor ebx, ebx
mov edx, ebx
test rax, rax
setne dl
test edx, edx
jne 0x14001a302
mov ecx, 0x80004005
call fcn.140010c90
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rbx
lea r9, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400a3f48]
call sub.SHELL32.dll_SHGetKnownFolderPath
or rsi, 0xffffffffffffffff
test eax, eax
js 0x14001a48d
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001a35c
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea ebx, [rcx - 1]
mov r8d, ebx
lea rcx, [rsp + 0x78]
call fcn.1400109b0
xor eax, eax
mov rcx, rsi
lea r12, str.driversDTSU2PParamEQ.DAT
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov rbp, r12
mov rdi, qword [rsp + 0x78]
sub rbp, rdi
sar rbp, 1
mov r14d, dword [rdi - 0x10]
lea ebx, [r14 + rcx - 1]
mov edx, 1
sub edx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, edx
jge 0x14001a3bb
mov edx, ebx
lea rcx, [rsp + 0x78]
call fcn.140010630
mov rdi, qword [rsp + 0x78]
cmp rbp, r14
ja 0x14001a3c4
lea r12, [rdi + rbp*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rdi + r14*2]
mov r9, rdx
mov r8, r12
call fcn.140071c20
test ebx, ebx
js 0x14001a482
cmp ebx, dword [rdi - 0xc]
jg 0x14001a482
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
mov word [rdi + rax*2], 0
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14001a41f
cmp rax, qword [rdi - 0x18]
jne 0x14001a41f
lea rbp, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rdi, qword [rsp + 0x78]
jmp 0x14001a45d
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbp, rax
test rax, rax
jne 0x14001a43b
call fcn.140014030
int3
mov eax, dword [rdi - 0x10]
mov dword [rbp + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbp + 0x18]
call fcn.140071c20
lea rax, [rbp + 0x18]
mov qword [rsp + 0x88], rax
lea r8, [rsp + 0x88]
lea rdx, [0x1400a4bb8]
mov rcx, r13
call fcn.140012000
jmp 0x14001a48d
mov ecx, 0x80070057
call fcn.140010c90
int3
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14001a4a1
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14001a4ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140021440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov rbp, rdx
movzx edx, r8w
mov rsi, rcx
lea r8, [0x1400a7510]
xor ebx, ebx
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x14002154f
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov edi, eax
je 0x14002154f
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbp, rax
je 0x14002154f
lea ecx, [rbx + 2]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x14002154f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140021530
mov r8, rdi
mov rdx, rbp
mov rcx, rax
call fcn.140075b90
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x14002154f
mov rdx, qword [rsp + 0x20]
mov rcx, rsi
call fcn.140020d30
test eax, eax
js 0x14002154f
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x60], 0
je 0x140021548
mov rcx, rsi
call fcn.1400215a0
mov eax, 1
jmp 0x140021581
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140021568
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsp + 0x20], 0
test rbx, rbx
je 0x14002157f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x1400222f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov edx, 6
add ax, 1
mov rcx, rbp
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov r12, rax
je 0x140022452
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140022452
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140022452
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140022396
nop
cmp rdi, r11
jae 0x140022452
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140022380
cmp rdi, r11
jae 0x140022452
movzx eax, word [rdi]
test ax, ax
je 0x140022452
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1400223cc
mov edx, ebx
mov rcx, rsi
call fcn.140010630
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1400223e9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.140071c20
test eax, eax
je 0x140022428
cmp eax, 0xc
je 0x140022422
cmp eax, 0x16
je 0x14002241c
cmp eax, 0x22
je 0x14002241c
cmp eax, 0x50
je 0x140022428
call fcn.140046214
int3
call fcn.140046214
int3
call fcn.1400461cc
int3
test ebx, ebx
js 0x140022447
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140022447
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140022454
mov ecx, 0x80070057
call fcn.140010c90
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140023980
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1400caba8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.1400472fc
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x1400239e1
mov ecx, 0x80004005
call fcn.140010c90
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x1400a5bd0]
test rdx, 0xffffffffffff0000
jne 0x140023a1d
movzx edi, dx
mov ecx, edi
call fcn.140047108
test rax, rax
je 0x140023a39
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140010410
jmp 0x140023a39
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.1400109b0
nop
mov r12d, 1
mov dword [rsp + 0x20], r12d
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400109b0
cmp dword [0x1400d4ae0], 0
je 0x140023b16
xor eax, eax
or rcx, 0xffffffffffffffff
lea rbp, str.Drivers_rtwavesmaprocap.dat
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
mov rax, qword [rbx]
mov rsi, rbp
sub rsi, rax
sar rsi, 1
mov r13d, dword [rax - 0x10]
lea edi, [r13 + rcx - 1]
sub r12d, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, r12d
jge 0x140023aca
mov edx, edi
mov rcx, rbx
call fcn.140010630
mov rax, qword [rbx]
cmp rsi, r13
ja 0x140023ad6
lea rbp, [rax + rsi*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rax + r13*2]
mov r9, rdx
mov r8, rbp
call fcn.140071c20
test edi, edi
js 0x140023b0b
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x140023b0b
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbx]
mov word [rax + rcx*2], 0
jmp 0x140023b99
mov ecx, 0x80070057
call fcn.140010c90
int3
xor eax, eax
or rcx, 0xffffffffffffffff
lea rbp, str.Drivers_rtwavesvpcap.dat
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
mov rax, qword [rbx]
mov rsi, rbp
sub rsi, rax
sar rsi, 1
mov r13d, dword [rax - 0x10]
lea edi, [r13 + rcx - 1]
sub r12d, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, r12d
jge 0x140023b5d
mov edx, edi
mov rcx, rbx
call fcn.140010630
mov rax, qword [rbx]
cmp rsi, r13
ja 0x140023b69
lea rbp, [rax + rsi*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rax + r13*2]
mov r9, rdx
mov r8, rbp
call fcn.140071c20
test edi, edi
js 0x140023b9e
mov rcx, qword [rbx]
cmp edi, dword [rcx - 0xc]
jg 0x140023b9e
mov dword [rcx - 0x10], edi
movsxd rdx, edi
mov rcx, qword [rbx]
mov word [rcx + rdx*2], 0
mov rax, rbx
jmp 0x140023ba9
mov ecx, 0x80070057
call fcn.140010c90
nop
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140072370
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140023c30
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1400caba8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.1400472fc
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x140023c91
mov ecx, 0x80004005
call fcn.140010c90
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1400a5bd0]
test rdx, 0xffffffffffff0000
jne 0x140023ccd
movzx edi, dx
mov ecx, edi
call fcn.140047108
test rax, rax
je 0x140023ce9
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.140010410
jmp 0x140023ce9
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.1400109b0
nop
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400109b0
xor eax, eax
or rcx, 0xffffffffffffffff
lea r12, str.Drivers_rtwavesskdy.dat
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
mov rax, qword [rsi]
mov rbp, r12
sub rbp, rax
sar rbp, 1
mov r13d, dword [rax - 0x10]
lea edi, [r13 + rcx - 1]
sub ebx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ebx
jge 0x140023d69
mov edx, edi
mov rcx, rsi
call fcn.140010630
mov rax, qword [rsi]
cmp rbp, r13
ja 0x140023d75
lea r12, [rax + rbp*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rax + r13*2]
mov r9, rdx
mov r8, r12
call fcn.140071c20
test edi, edi
js 0x140023daa
mov rax, qword [rsi]
cmp edi, dword [rax - 0xc]
jg 0x140023daa
mov dword [rax - 0x10], edi
movsxd rdx, edi
mov rcx, qword [rsi]
mov word [rcx + rdx*2], 0
mov rax, rsi
jmp 0x140023db5
mov ecx, 0x80070057
call fcn.140010c90
nop
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140072370
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400245a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x58
xor edi, edi
lea rax, [rax - 0x58]
mov r12, rcx
mov dword [rax + 0x68], edi
mov dword [rax + 0x60], edi
mov qword [rax], rdi
lea rdx, str.SoftwareRealtekSBCoexist
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rbx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, eax
jne 0x1400245f3
mov rbx, qword [rsp + 0x30]
mov esi, edi
test esi, esi
mov r13d, SafeArrayGetDim
jne 0x140024651
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
lea rdx, str.ExclusiveEnable
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0xa0], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov esi, eax
jne 0x140024651
cmp dword [rsp + 0xa8], 4
mov esi, edi
cmovne esi, r13d
test rbx, rbx
je 0x140024662
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
test esi, esi
mov ebp, edi
sete bpl
test rbx, rbx
je 0x140024678
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareRealtekSBCoexist
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rbx, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, eax
jne 0x1400246b4
mov rbx, qword [rsp + 0x30]
mov esi, edi
test esi, esi
jne 0x14002470c
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
lea rdx, str.Technology
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0xa0], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov esi, eax
jne 0x14002470c
cmp dword [rsp + 0xa8], 4
mov esi, edi
cmovne esi, r13d
test rbx, rbx
je 0x14002471d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
test esi, esi
sete dil
test rbx, rbx
je 0x140024731
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [r12 + 8]
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x3c], ebp
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], eax
call fcn.140025570
test eax, eax
je 0x1400247a5
mov rax, qword [0x1400d3c80]
test rax, rax
je 0x1400247a5
mov edx, 1
lea r9, [rsp + 0x38]
mov rcx, rbx
mov r8d, edx
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call rax
movzx eax, al
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor al, al
movzx eax, al
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140025570
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x1400d3904], 0
je 0x140025587
mov eax, 1
add rsp, 0x28
ret
lea rcx, str.MaxxAudioAPOShell64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [0x1400d3c08], rax
je 0x1400257a7
lea rdx, str.WavesFX_Initialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_Uninitialize
mov qword [0x1400d3c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_SetParameter
mov qword [0x1400d3c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_GetParameter
mov qword [0x1400d3c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_GetParametersArray
mov qword [0x1400d3c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_SetParametersArray
mov qword [0x1400d3c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_SetProperty
mov qword [0x1400d3c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_GetProperty
mov qword [0x1400d3c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_Preset_RegisterChangeNotification
mov qword [0x1400d3c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_CreatePluginWindow
mov qword [0x1400d3c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_DetachPluginWindow
mov qword [0x1400d3c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_Preset_SaveDefault
mov qword [0x1400d3c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_Preset_SetActive
mov qword [0x1400d3c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_RegisterChangeNotification
mov qword [0x1400d3c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_VendorSpecific
mov qword [0x1400d3c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str._WavesFX_Preset_SetParameter
mov qword [0x1400d3c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_Preset_RegisterFile
mov qword [0x1400d3c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d3c08]
lea rdx, str.WavesFX_Preset_RegisterMem
mov qword [0x1400d3c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400d3c10], 0
mov qword [0x1400d3c98], rax
mov eax, dword [0x1400d3904]
mov ecx, 1
cmovne eax, ecx
mov dword [0x1400d3904], eax
add rsp, 0x28
ret
mov eax, dword [0x1400d3904]
add rsp, 0x28
ret
Function at 0x140036f50
Capabilities:
Resume thread

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rsi, rcx
call fcn.1400371a0
mov rcx, rsi
call fcn.140031350
lea rcx, [rsi + 0x868]
call fcn.140027410
mov r12, qword [rsi + 0x848]
xor edi, edi
test r12d, r12d
je 0x140037089
nop
nop
cmp edi, dword [rsi + 0x848]
jae 0x140037070
mov edx, edi
lea rcx, [rsi + 0x830]
call fcn.1400463b0
test rax, rax
je 0x140037083
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140037070
lea rdx, [rsp + 0x70]
call fcn.1400043c0
nop
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140037004
cmp rax, qword [rbx - 0x18]
jne 0x140037004
lea rbp, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x14003703c
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rbp, rax
test rax, rax
je 0x14003707d
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140071c20
lea rax, [rbp + 0x18]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140038230
nop
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037070
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add edi, 1
cmp edi, r12d
jae 0x140037089
jmp 0x140036fa0
call fcn.140014030
nop
call fcn.140046214
int3
lea rcx, [rsi + 0x868]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov qword [rsi + 0xcb8], rsi
cmp qword [rsi + 0xca0], 0
jne 0x1400370be
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xca0], rax
cmp qword [rsi + 0xca8], 0
jne 0x1400370df
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xca8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsi + 0xc60]
lea rcx, [0x1400297c0]
call fcn.140054140
mov rbp, rax
test rax, rax
je 0x140037163
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsi + 0xc98]
mov r8, rbx
mov rdx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsi + 0xcb0], 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14003c3e0
Capabilities:
Log keystrokes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
lea rdx, [rax + 0x10]
xor edi, edi
add rcx, 0x8a0
mov dword [rax + 8], edi
call fcn.140043390
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140015cd0
test eax, eax
jne 0x14003c417
add rsp, 0x70
pop rdi
ret
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0x80]
xor edx, edx
movzx ecx, bl
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, bl
mov r8d, 0x28
mov word [rsp + 0x28], cx
mov word [rsp + 0x50], cx
lea rdx, [rsp + 0x20]
lea ecx, [r8 - 0x26]
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x48], 1
mov word [rsp + 0x2a], di
mov word [rsp + 0x52], di
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x54], 2
call qword [sym.imp.USER32.dll_SendInput]
mov rbx, qword [rsp + 0x90]
mov eax, 1
add rsp, 0x70
pop rdi
ret