joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f0f90
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x14031101c], 0
je 0x1400f0fa7
mov eax, 1
add rsp, 0x28
ret
lea rcx, str.MaxxAudioAPOShell64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [0x140311148], rax
je 0x1400f1191
lea rdx, str.WavesFX_Initialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_Uninitialize
mov qword [0x140311150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_SetParameter
mov qword [0x140311158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_GetParameter
mov qword [0x140311160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_GetParametersArray
mov qword [0x140311168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_SetParametersArray
mov qword [0x140311170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_SetProperty
mov qword [0x140311178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_GetProperty
mov qword [0x140311180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_Preset_RegisterChangeNotification
mov qword [0x140311188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_CreatePluginWindow
mov qword [0x140311190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_DetachPluginWindow
mov qword [0x140311198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_Preset_SaveDefault
mov qword [0x1403111a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_Preset_SetActive
mov qword [0x1403111a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_RegisterChangeNotification
mov qword [0x1403111b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_VendorSpecific
mov qword [0x1403111b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140311148]
lea rdx, str.WavesFX_Preset_GetCount
mov qword [0x1403111c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140311150], 0
mov qword [0x1403111d0], rax
mov eax, dword [0x14031101c]
mov ecx, 1
cmovne eax, ecx
mov dword [0x14031101c], eax
add rsp, 0x28
ret
mov eax, dword [0x14031101c]
add rsp, 0x28
ret
Function at 0x14010c3f0
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10040
call fcn.140237890
sub rsp, rax
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x10020], rax
mov r8, qword [rcx + 0x118]
mov rbx, rcx
test r8, r8
jne 0x14010c424
xor eax, eax
jmp 0x14010c496
mov r8, qword [r8 + 0x1a20]
mov r10, qword [rcx + 0x110]
mov qword [rsp + 0x10068], rdi
test r8, r8
je 0x14010c48c
nop
test r8, r8
mov r9, r8
je 0x14010c663
mov r9, qword [r9 + 0x10]
mov r8, qword [r8]
test r9, r9
je 0x14010c487
test r10, r10
je 0x14010c658
mov rax, qword [r9 + 0x28]
mov rdi, r10
sub rdi, rax
nop
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x14010c483
add rax, 2
test ecx, ecx
jne 0x14010c470
test edx, edx
je 0x14010c4af
test r8, r8
jne 0x14010c440
xor eax, eax
mov rdi, qword [rsp + 0x10068]
mov rcx, qword [rsp + 0x10020]
xor rcx, rsp
call fcn.140216200
add rsp, 0x10040
pop rbx
ret
lea rdx, [rbx + 0x4c8]
lea rcx, [r9 + 0xa8]
xor r8d, r8d
call sub.DSOUND.dll_DirectSoundCaptureCreate
test eax, eax
js 0x14010c48c
mov eax, dword [rbx + 0x674]
mov qword [rsp + 0x10058], rbp
mov qword [rsp + 0x10060], rsi
mov qword [rsp + 0x10038], r12
mov ebp, 1
shl eax, 2
mov qword [rsp + 0x10030], r13
mov word [rbx + 0x670], 1
mov word [rbx + 0x67e], 0x10
mov dword [rbx + 0x678], eax
mov word [rbx + 0x672], 2
mov word [rbx + 0x67c], 4
lea r12, [rbx + 0x5e0]
lea rsi, [rbx + 0x4e0]
lea r13d, [rbp + 0xf]
nop
nop
nop
nop
mov edi, dword [rbx + 0x678]
xor edx, edx
xor r9d, r9d
shl edi, 3
xor r8d, r8d
shr edi, 4
imul edi, ebp
add edi, 0xffffffff
mov dword [rsi], edi
movzx ecx, word [rbx + 0x67c]
mov eax, dword [rbx + 0x678]
shl eax, 3
shr eax, 4
div ecx
xor ecx, ecx
sub edi, edx
xor edx, edx
mov dword [rsi], edi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
add rsi, 0x10
mov qword [r12], rax
mov qword [rsi - 8], rax
add ebp, 1
add r12, 8
sub r13, 1
jne 0x14010c540
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rdx, [rsp + 0x20]
mov ecx, 0x7fff
mov qword [rbx + 0x660], rax
mov dword [rbx + 0x5d0], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov r13, qword [rsp + 0x10030]
mov r12, qword [rsp + 0x10038]
mov rsi, qword [rsp + 0x10060]
mov rbp, qword [rsp + 0x10058]
je 0x14010c48c
add eax, 0xffffffff
cmp word [rsp + rax*2 + 0x20], 0x5c
je 0x14010c612
lea r8, [0x1402604d8]
lea rcx, [rsp + 0x20]
mov edx, 0x7fff
call fcn.1402175a0
lea r8, str.MicCal.wav
lea rcx, [rsp + 0x20]
mov edx, 0x7fff
call fcn.1402175a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rbx + 0x690]
call fcn.140007720
mov eax, 1
jmp 0x14010c48e
mov ecx, 0x80004005
call fcn.140003c70
int3
call fcn.1401e7838
int3
Function at 0x14010c670
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x70
cmp qword [rcx + 0x4c8], 0
mov rdi, rcx
jne 0x14010c68b
xor eax, eax
add rsp, 0x70
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rsi
xor esi, esi
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.14010c8d0
mov ecx, 0xc8
call fcn.1401dac8c
test rax, rax
mov rbx, rax
je 0x14010c6f7
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0xc0], rsi
mov dword [rax + 0x38], esi
mov dword [rax + 0xa4], esi
jmp 0x14010c6fa
mov rbx, rsi
test rbx, rbx
mov qword [rdi + 0x668], rbx
jne 0x14010c70d
xor eax, eax
jmp 0x14010c85d
mov rcx, qword [rdi + 0x690]
xor edx, edx
mov r8d, 0x11002
mov qword [rsp + 0x88], rbp
mov dword [rbx + 0xa0], 2
mov dword [rbx + 0xa4], esi
call qword [sym.imp.WINMM.dll_mmioOpenW]
test rax, rax
mov qword [rbx + 8], rax
je 0x14010c765
lea rbp, [rdi + 0x670]
mov rcx, rbx
mov rdx, rbp
call fcn.1401d3c90
test eax, eax
jns 0x14010c76c
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x14010c855
mov rcx, rbx
call fcn.1401d3a30
test eax, eax
js 0x14010c765
mov eax, dword [rdi + 0x678]
mov rcx, qword [rdi + 0x4c8]
mov dword [rsp + 0x40], 0x28
shl eax, 3
mov qword [rsp + 0x50], rbp
lea r8, [rdi + 0x4d0]
mov dword [rsp + 0x48], eax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x98], r12
call qword [rax + 0x18]
test eax, eax
js 0x14010c84b
lea rbx, [rdi + 0x5e0]
mov ebp, 0x11
nop
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x14010c7de
call qword [sym.imp.KERNEL32.dll_ResetEvent]
add rbx, 8
sub rbp, 1
jne 0x14010c7d0
mov rcx, qword [rdi + 0x4d0]
lea r8, [rdi + 0x4d8]
lea rdx, [0x14025ba78]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14010c84b
mov rcx, qword [rdi + 0x4d8]
lea r8, [rdi + 0x4e0]
lea edx, [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x14010c84b
lea rcx, [0x14010ccf0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
call fcn.1401eacc4
test rax, rax
mov rbp, rax
jne 0x14010c873
xor eax, eax
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rdi + 0x688]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rdi + 0x4d0]
xor edx, edx
mov r8, qword [rcx]
call qword [r8 + 0x48]
test eax, eax
setns sil
mov eax, esi
jmp 0x14010c84d
Function at 0x14010c8d0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp qword [rcx + 0x688], rsi
mov dword [rsp + 0x30], esi
je 0x14010c93b
mov rcx, qword [rcx + 0x660]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x688]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14010c92e
cmp dword [rsp + 0x30], 0x103
jne 0x14010c92e
mov rcx, qword [rbx + 0x688]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x688]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x4d8]
mov qword [rbx + 0x688], rsi
test rcx, rcx
je 0x14010c95b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbx + 0x4d8], rsi
mov rcx, qword [rbx + 0x4d0]
test rcx, rcx
je 0x14010c986
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbx + 0x4d0]
test rcx, rcx
je 0x14010c986
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbx + 0x4d0], rsi
mov rdi, qword [rbx + 0x668]
test rdi, rdi
je 0x14010c9c1
mov rcx, rdi
call fcn.1401d3b00
cmp dword [rdi + 0xa4], esi
jne 0x14010c9b2
mov rcx, qword [rdi]
test rcx, rcx
je 0x14010c9b2
call fcn.1401dacd8
mov qword [rdi], rsi
mov rcx, rdi
call fcn.1401dacd8
mov qword [rbx + 0x668], rsi
mov rax, qword [rbx + 0x690]
lea rdi, [0x140260b08]
mov ecx, 1
mov rsi, rax
repe cmpsw word [rsi], word [rdi]
je 0x14010c9e5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x3b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14011bd10
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x80
cmp qword [rcx + 0x90], 0
mov rsi, rcx
jne 0x14011bd31
xor eax, eax
add rsp, 0x80
pop rsi
ret
xor eax, eax
mov qword [rsp + 0x78], r12
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rcx + 0x298], r12
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.14011bf20
mov ecx, dword [rsi + 0x2a0]
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 0x28
lea r8, [rsi + 0x98]
xor r9d, r9d
imul ecx, dword [rsi + 0x240]
mul ecx
mov rcx, qword [rsi + 0x90]
shr edx, 6
lea rax, [rsi + 0x238]
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x18]
test eax, eax
jns 0x14011bdd9
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x80
pop rsi
ret
mov eax, dword [rsi + 0x2a4]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
add eax, 1
mov edi, r12d
test eax, eax
jle 0x14011be22
lea rbx, [rsi + 0x1a8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14011be0e
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsi + 0x2a4]
add edi, 1
add rbx, 8
add eax, 1
cmp edi, eax
jl 0x14011be00
mov rcx, qword [rsi + 0x98]
lea r8, [rsi + 0xa0]
lea rdx, [0x14025ba78]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14011be5e
mov rcx, qword [rsi + 0xa0]
mov edx, dword [rsi + 0x2a4]
lea r8, [rsi + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jns 0x14011be65
xor eax, eax
jmp 0x14011befa
lea rcx, [0x14011c020]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x98], rbp
mov dword [rsp + 0x20], 4
call fcn.1401eacc4
test rax, rax
mov rbp, rax
je 0x14011bef2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x250]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsi + 0x98]
xor edx, edx
mov r8, qword [rcx]
call qword [r8 + 0x48]
test eax, eax
setns r12b
mov eax, r12d
mov rbp, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
add rsp, 0x80
pop rsi
ret
Function at 0x14011efe0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rbx, rdx
mov rbp, rcx
call fcn.1401dc36c
mov rdi, qword [rax + 8]
lea r12, str.IntMicRange
lea rsi, str.ExtMicRange
test rdi, rdi
je 0x14011f033
mov rcx, qword [rbp + 0x30]
call fcn.1400178f0
mov r8, rsi
lea rdx, str.RtkPreset
test eax, eax
mov rcx, rdi
cmovne r8, r12
xor r9d, r9d
call fcn.1401ee9b4
mov dword [rbx], eax
xor ecx, ecx
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareRealtekCOMPreset
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov dword [rbx], ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0xa0], 4
mov dword [rsp + 0x98], 4
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14011f0df
mov rcx, qword [rbp + 0x30]
call fcn.1400178f0
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0xa0]
test eax, eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
cmovne rsi, r12
lea rax, [rsp + 0xa8]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14011f0df
mov eax, dword [rsp + 0xa8]
mov dword [rbx], eax
mov eax, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14011f0f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
call fcn.1401dc36c
lea rdi, str.IntMicRange
mov rbx, qword [rax + 8]
lea rbp, str.ExtMicRange
test rbx, rbx
je 0x14011f145
mov rcx, qword [rsi + 0x30]
call fcn.1400178f0
mov r9d, dword [rsp + 0x78]
mov r8, rbp
test eax, eax
lea rdx, str.RtkPreset
mov rcx, rbx
cmovne r8, rdi
call fcn.1401eea54
lea rax, [rsp + 0x80]
xor ebx, ebx
lea rdx, str.SoftwareRealtekCOMPreset
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14011f1d3
mov rcx, qword [rsi + 0x30]
call fcn.1400178f0
mov rcx, qword [rsp + 0x88]
lea r9d, [rbx + 4]
test eax, eax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
cmove rdi, rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140128fc0
Capabilities:
Get graphical window text

Disassembly:
push rbx
mov eax, 0x10f0
call fcn.140237890
sub rsp, rax
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x10e0], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x2c70]
test rcx, rcx
je 0x140129215
cmp qword [rbx + 0x100], 0
je 0x140129215
mov rax, qword [rcx]
mov qword [rsp + 0x1108], rbp
mov qword [rsp + 0x1110], rsi
mov qword [rsp + 0x1118], rdi
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x1401290d2
mov rcx, qword [rbx + 0x2c70]
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
je 0x1401290d2
cmp dword [rbx + 0x17e8], 0
jne 0x140129059
cmp dword [rbx + 0x16b8], 0
jne 0x140129059
xor edx, edx
jmp 0x14012905e
mov edx, 1
mov rcx, qword [rbx + 0x2c70]
xor eax, eax
cmp dword [rbx + 0x16b8], 1
sete al
lea rdi, [rbx + 0x40c]
mov dword [rbx + 0x410], eax
mov dword [rdi], edx
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
jne 0x14012909a
mov rcx, qword [rbx + 0x2c70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x70]
cmp dword [rdi], 0
je 0x140129108
mov rcx, qword [rbx + 0x2c70]
mov edx, dword [rbx + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
jne 0x140129108
mov rcx, qword [rbx + 0x2c70]
lea rdx, [rbx + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x80]
jmp 0x140129108
mov rcx, qword [rbx + 0x2c70]
xor edx, edx
cmp dword [rbx + 0x17e8], 1
sete dl
lea rdi, [rbx + 0x40c]
mov dword [rdi], edx
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
jne 0x140129108
mov rcx, qword [rbx + 0x2c70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rbx + 0x378]
mov r9d, 0x105
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [rdi]
lea r9, [rsp + 0x20]
neg eax
mov edx, 0x702
mov dword [rsp + 0x20], 3
sbb ecx, ecx
xor r8d, r8d
mov dword [rsp + 0x24], 0
and ecx, 2
mov dword [rsp + 0x2c], 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 0x26d0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rdi]
lea rcx, [rbx + 0x2690]
call fcn.1401dc77c
mov rbp, qword [rbx + 0x100]
bt dword [rbp + 0xc], 0xd
jae 0x1401291b6
mov rsi, qword [rbx + 0x108]
lea rcx, [rbp + 0x540]
mov rdx, rsi
call fcn.1400d5ac0
test eax, eax
je 0x1401291b6
lea rcx, [rbp + 0x540]
mov rdx, rsi
call fcn.1400d5b60
test eax, eax
jne 0x1401291b6
mov edx, dword [rdi]
mov rcx, qword [rbx + 0x2c70]
call fcn.140119f00
cmp dword [rbx + 0x2c84], 0
mov rsi, qword [rsp + 0x1110]
mov rbp, qword [rsp + 0x1108]
jne 0x1401291f1
cmp dword [rdi], 0
je 0x1401291f1
lea r8, str.MicCalExecuted
lea rdx, str.General
lea rcx, [0x1403149a0]
xor r9d, r9d
call fcn.1401ee9b4
cmp dword [rdi], 0
mov rdi, qword [rsp + 0x1118]
je 0x140129215
cmp dword [rbx + 0x45c], 0
je 0x140129215
mov rcx, qword [rbx + 0x2c70]
xor edx, edx
call fcn.14011c380
mov rcx, qword [rsp + 0x10e0]
xor rcx, rsp
call fcn.140216200
add rsp, 0x10f0
pop rbx
ret
Function at 0x14013d500
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.140164050
cmp qword [rbx + 0x350], 0
jle 0x14013d5ce
cmp qword [rbx + 0x378], 0
jne 0x14013d543
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x378], rax
test edi, edi
mov qword [rsp + 0x60], rsi
je 0x14013d5d9
xor esi, esi
lea rcx, [0x14013d040]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
mov qword [rsp + 0x58], rbp
call fcn.1401eacc4
test rax, rax
mov rbp, rax
je 0x14013d5c4
lea rdi, [rbx + 0x370]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
mov r9, rdi
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor esi, esi
cmp qword [rbx + 0x370], rsi
mov dword [rsp + 0x50], esi
je 0x14013d5c9
mov rcx, qword [rbx + 0x378]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x370]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14013d625
cmp dword [rsp + 0x50], 0x103
jne 0x14013d625
mov rcx, qword [rbx + 0x370]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x370]
test rcx, rcx
je 0x14013d5c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x370], rsi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140164050
Capabilities:
Resume thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov esi, edx
mov rbx, rcx
call fcn.1401e22b4
cmp dword [rbx + 0xf8], 0
jne 0x140164081
test esi, esi
je 0x140164081
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x2c8]
mov dword [rbx + 0xf8], eax
lea rax, [rbx + 0x200]
test rax, rax
je 0x1401640f9
cmp qword [rax + 0x40], 0
je 0x1401640f9
movsd xmm0, qword [0x140304428]
mov rcx, qword [rbx + 0x240]
xor r8d, r8d
mov edx, 0x418
mulsd xmm0, qword [0x14029fdf0]
cvttsd2si eax, xmm0
movsxd r9, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x240]
xor r9d, r9d
lea r8d, [r9 + 2]
mov edx, 0x415
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x240]
mov edx, 0x403
add ax, 0xbb8
mov r8d, 2
movzx r9d, ax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rbx + 0x100]
mov qword [rsp + 0x68], rbp
test rdi, rdi
je 0x14016419d
cmp dword [rbx + 0x1b0], 0
ja 0x140164120
cmp dword [rbx + 0x18c], 0
je 0x14016419d
test esi, esi
je 0x140164139
lea rdx, [rbx + 0x160]
lea rcx, [rdi + 0x1a10]
call fcn.1401382e0
jmp 0x14016419d
lea rbp, [rbx + 0x160]
test rbp, rbp
je 0x14016419d
cmp qword [rdi + 0x1a50], 0
je 0x14016419d
lea rcx, [rdi + 0x1a58]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
call fcn.1401e7494
test rax, rax
mov r13, rax
je 0x140164193
mov rcx, qword [rdi + 0x1a50]
mov rdx, rbp
mov r8, qword [rcx]
call qword [r8 + 0x38]
lea rcx, [rdi + 0x1a58]
mov rdx, r13
call fcn.1401e7428
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
cmp qword [rbx + 0x2f8], 0
jle 0x1401642b9
cmp qword [rbx + 0x320], 0
jne 0x1401641cc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x320], rax
test esi, esi
je 0x140164254
xor esi, esi
lea rcx, [0x1401648c0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
call fcn.1401eacc4
test rax, rax
mov rbp, rax
je 0x1401642b9
lea rdi, [rbx + 0x318]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
mov r9, rdi
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ResumeThread]
xor esi, esi
cmp qword [rbx + 0x318], rsi
mov dword [rsp + 0x60], esi
je 0x1401642b9
mov rcx, qword [rbx + 0x320]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x318]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1401642a0
cmp dword [rsp + 0x60], 0x103
jne 0x1401642a0
mov rcx, qword [rbx + 0x318]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x318]
test rcx, rcx
je 0x1401642b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x318], rsi
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret