joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073fa0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x10060
call fcn.140167340
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x10098], rbx
mov qword [rsp + 0x100a0], rbp
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x10050], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
call fcn.14012a060
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x14007400d
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x14017f438]
test rdx, 0xffffffffffff0000
jne 0x140074049
movzx edi, dx
mov ecx, edi
call fcn.140138f84
test rax, rax
je 0x140074065
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140004c30
jmp 0x140074065
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.140003210
nop
mov r12d, 1
mov dword [rsp + 0x30], r12d
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x50]
call fcn.140148fe0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 0x25]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140074175
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x4c], 0x5c
jne 0x1400740c5
mov word [rsp + rcx*2 + 0x4c], ax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003210
xor eax, eax
or rcx, 0xffffffffffffffff
lea rbp, str.RealtekAudioHDA_
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
mov rax, qword [rbx]
mov rsi, rbp
sub rsi, rax
sar rsi, 1
mov r13d, dword [rax - 0x10]
lea edi, [r13 + rcx - 1]
sub r12d, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, r12d
jge 0x14007412c
mov edx, edi
mov rcx, rbx
call fcn.140002cd0
mov rax, qword [rbx]
cmp rsi, r13
ja 0x140074138
lea rbp, [rax + rsi*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rax + r13*2]
mov r9, rdx
mov r8, rbp
call fcn.140144ee0
test edi, edi
js 0x14007416a
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x14007416a
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbx]
mov word [rax + rcx*2], 0
jmp 0x140074175
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov rax, rbx
mov rcx, qword [rsp + 0x10050]
xor rcx, rsp
call fcn.140144dc0
lea r11, [rsp + 0x10060]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140078520
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x860
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.Sound_Blaster
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.Sound_Blaster
mov rcx, rsi
call fcn.140003210
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareCreative_TechSB_Plugin_for_Dell_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140078654
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x30], 0x800
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.TabName
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140078644
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x140078602
cmp eax, 2
jne 0x140078644
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14007861b
test al, 1
jne 0x140078644
shr rax, 1
cmp word [rsp + rax*2 + 0x4e], 0
je 0x140078622
jmp 0x140078644
mov word [rsp + 0x50], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140003210
test rbx, rbx
je 0x140078654
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test rbx, rbx
je 0x140078662
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140144dc0
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140079ef0
Capabilities:
Get file size
Read .ini file

Disassembly:
push rsi
sub rsp, 0x50
test rdx, rdx
mov rsi, rcx
jne 0x140079f06
xor eax, eax
add rsp, 0x50
pop rsi
ret
mov qword [rcx + 8], rdx
mov rcx, qword [0x140207df8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rdi
xor edi, edi
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x14007a0a0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
setne dil
test edi, edi
je 0x14007a0a0
mov eax, 2
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov r13, 0xffffffffffffffff
mul rbp
cmovo rax, r13
mov rcx, rax
call fcn.1401287fc
test rax, rax
mov r12, rax
jne 0x140079fc0
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
mov word [rax], 0
mov rax, qword [0x140207df8]
lea r8, [0x14017f438]
mov qword [rsp + 0x28], rax
mov r9, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r8, str.SetCount
lea rdx, str.DefLevel
lea rcx, [0x140206e90]
xor r9d, r9d
call fcn.1401386a8
mov rbx, r12
mov dword [rsi + 0x10], eax
cmp word [r12], 0
je 0x14007a036
mov rdx, rbx
mov rcx, rsi
call fcn.14007a3b0
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], ax
jne 0x14007a014
cmp dword [rsi + 0x18], 0
je 0x14007a05e
add dword [rsi + 0x10], 1
mov r9d, dword [rsi + 0x10]
lea r8, str.SetCount
lea rdx, str.DefLevel
lea rcx, [0x140206e90]
call fcn.140138748
cmp dword [rsi + 0x14], 0
jne 0x14007a08e
lea r8, str.Finished
lea rdx, str.DefLevel
lea rcx, [0x140206e90]
mov r9d, 1
call fcn.140138748
mov dword [0x140206cd4], 1
mov rcx, r12
call fcn.1401287f4
mov eax, 1
jmp 0x140079fa1
xor eax, eax
jmp 0x140079fab
Function at 0x140083bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rdx, rdx
mov rdi, rdx
mov rbx, rcx
je 0x140083c43
mov rcx, qword [rcx + 0x18]
cmp rdx, rcx
je 0x140083c43
test rcx, rcx
je 0x140083beb
mov edx, dword [rbx + 0xc]
add rcx, 0x58
call fcn.14006db30
cmp dword [rbx + 0x10], 0
mov qword [rbx + 0x18], rdi
je 0x140083c43
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x140083c43
mov r10, qword [rdi + 0x60]
mov r9d, r8d
shr r9d, 4
test r10, r10
je 0x140083c34
xor edx, edx
mov eax, r9d
div dword [rdi + 0x68]
mov rax, qword [r10 + rdx*8]
test rax, rax
je 0x140083c34
nop
cmp dword [rax + 0x18], r9d
jne 0x140083c2b
cmp dword [rax], r8d
je 0x140083c43
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140083c20
lea rcx, [rdi + 0x58]
mov edx, r8d
call fcn.140040580
mov qword [rax], rbx
mov rax, qword [rdi + 0x90]
test rax, rax
je 0x140083c56
mov qword [rbx + 0x90], rax
cmp qword [rbx + 0x18], 0
jne 0x140083c64
xor eax, eax
jmp 0x140083dc2
mov qword [rsp + 0x88], rsi
mov rsi, qword [rbx + 0x3a0]
xor edi, edi
test rsi, rsi
je 0x140083c91
mov rcx, rsi
call fcn.1400830f0
mov rcx, rsi
call fcn.1401287f4
mov qword [rbx + 0x3a0], rdi
mov rsi, qword [rbx + 0x398]
test rsi, rsi
je 0x140083cb4
mov rcx, rsi
call fcn.1400830f0
mov rcx, rsi
call fcn.1401287f4
mov qword [rbx + 0x398], rdi
mov rcx, qword [rbx + 0x268]
add rbx, 0xffffffffffffff58
test rcx, rcx
je 0x140083ccd
call qword [sym.imp.USER32.dll_UnregisterDeviceNotification]
test rbx, rbx
mov eax, dword [0x140190fd8]
lea rcx, [rsp + 0x2c]
mov dword [rsp + 0x20], 0x20
mov dword [rsp + 0x24], 5
mov dword [rsp + 0x28], edi
mov dword [rcx], eax
mov eax, dword [0x140190fdc]
mov dword [rcx + 4], eax
mov eax, dword [0x140190fe0]
mov dword [rcx + 8], eax
mov eax, dword [0x140190fe4]
mov dword [rcx + 0xc], eax
mov word [rsp + 0x3c], di
je 0x140083d17
mov rdi, qword [rbx + 0x40]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov qword [rbx + 0x310], rax
mov rsi, qword [rbx + 0x138]
test rsi, rsi
je 0x140083da5
lea rdi, [rbx + 0x328]
test rdi, rdi
je 0x140083da5
cmp qword [rsi + 0x1bd0], 0
je 0x140083da5
lea rcx, [rsi + 0x1bd8]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], r12
call fcn.14013a11c
test rax, rax
mov r12, rax
je 0x140083d98
mov rcx, qword [rsi + 0x1bd0]
mov rdx, rdi
mov r8, qword [rcx]
call qword [r8 + 0x38]
lea rcx, [rsi + 0x1bd8]
mov rdx, r12
call fcn.14013a0b0
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140085630
mov rcx, rbx
call fcn.140083f40
mov rsi, qword [rsp + 0x88]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140144dc0
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140084060
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, rcx
lea rbx, [rcx + 0x158]
mov edi, 0x20
nop
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
add rbx, 8
sub rdi, 1
mov qword [rbx - 8], rax
jne 0x140084090
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsi + 0x258], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r12d, r12d
lea rcx, [0x1400845f0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsi + 0x260], rax
mov dword [rsp + 0x20], 4
call fcn.1401360c0
test rax, rax
mov rbp, rax
je 0x140084288
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x268]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsi + 0x270], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [0x140084720]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsi + 0x278], rax
mov dword [rsp + 0x20], 4
call fcn.1401360c0
test rax, rax
mov rbp, rax
je 0x140084288
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x280]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsi + 0x2f8], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [0x1400847c0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsi + 0x300], rax
mov dword [rsp + 0x20], 4
call fcn.1401360c0
test rax, rax
mov rbp, rax
je 0x140084288
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x308]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x14008a250
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test edx, edx
mov rbx, rcx
mov edi, edx
lea rcx, str._RTK__DTS_set_enable_true_r_n
jne 0x14008a271
lea rcx, str._RTK__DTS_set_enable_false_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 0x198], 0
jne 0x14008a28d
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x88]
mov edx, edi
mov rax, qword [rcx]
call qword [rax + 0x38]
lea rcx, str._RTK__pSRSOperatingModeCurr__put_APOEnable_OK_r_n
test eax, eax
je 0x14008a2ae
lea rcx, str._RTK__pSRSOperatingModeCurr__put_APOEnable_FAIL_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 0x38], 0
je 0x14008a310
mov rcx, qword [rbx + 0x50]
mov rdx, qword [rbx + 0x88]
xor r9d, r9d
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x30]
lea rcx, [0x140191920]
test eax, eax
je 0x14008a2e3
lea rcx, [0x1401919a0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbx + 0x50]
xor r8d, r8d
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0x38]
lea rcx, str._RTK__controller__put_APOEnable_OK_r_n
test eax, eax
je 0x14008a30a
lea rcx, str._RTK__controller__put_APOEnable_FAIL_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a98c0
Capabilities:
Check os version

Disassembly:
push r13
push r14
push r15
sub rsp, 0x30
mov r14d, r8d
mov r8, qword [rcx + 0x20]
mov r13, r9
test r8, r8
mov r11d, edx
mov r15, rcx
jne 0x1400a98ec
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r13
ret
mov r8, qword [r8 + 0x390]
test r8, r8
je 0x1400a98df
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
xor ebp, ebp
mov qword [rsp + 0x28], rdi
lea rbx, str.SonicFocus3Api.cpp:
mov r10d, ebp
mov r9, rbp
lea rdi, [0x1401ec900]
nop
test r11d, r11d
je 0x1400a995e
mov edx, dword [r8]
mov rcx, rbp
mov rax, rdi
nop
cmp dword [rax], edx
je 0x1400a9945
add rax, 0x18
add rcx, 1
cmp rax, rbx
jl 0x1400a9930
mov eax, ebp
jmp 0x1400a994d
lea rax, [rcx + rcx*2]
mov eax, dword [rdi + rax*8 + 8]
cmp eax, r11d
jne 0x1400a9964
test r10d, r10d
jns 0x1400a997d
xor eax, eax
jmp 0x1400a9a41
cmp dword [r8 + 4], ebp
jne 0x1400a9952
add r9, 1
add r10d, 1
add r8, 8
cmp r9, 7
jl 0x1400a9920
xor eax, eax
jmp 0x1400a9a41
mov edx, dword [0x140206d04]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x20], r12
movsxd r12, r10d
xor di, di
mov esi, ebp
lea rbx, reloc.OLEAUT32.dll_VariantClear
nop
test edx, edx
jne 0x1400a99c1
lea rcx, [0x140206d00]
mov dword [0x140206d00], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [0x140206d04]
cmp edx, 6
jne 0x1400a99d4
cmp dword [0x140206d08], 0
jne 0x1400a99d4
lea eax, [rdx + 0x12]
jmp 0x1400a99d9
mov eax, 0x1b
cmp esi, eax
jge 0x1400a9a2c
mov rax, qword [r15 + 0x20]
mov rcx, qword [rax + 0x390]
mov eax, dword [rcx + r12*8 + 4]
test dword [rbx - 8], eax
je 0x1400a9a0f
cmp dword [rbx - 4], r14d
jne 0x1400a9a0f
test di, di
mov ebp, 1
jne 0x1400a9a05
movzx edi, word [rbx]
movzx eax, word [r13]
cmp word [rbx], ax
je 0x1400a9a18
add esi, 1
add rbx, 0x14
jmp 0x1400a99a0
movsxd rax, esi
lea rcx, [rax + rax*4]
lea rax, reloc.OLEAUT32.dll_VariantClear
mov di, word [rax + rcx*4]
jmp 0x1400a9a30
test ebp, ebp
je 0x1400a9a35
mov word [r13], di
mov r12, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x28]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x1400b7880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1400b79e9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400b79e9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400b79e9
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400b791a
cmp rdi, r11
jae 0x1400b79e9
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400b7904
cmp rdi, r11
jae 0x1400b79e9
movzx eax, word [rdi]
test ax, ax
je 0x1400b79e9
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x1401eba40]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x1400b798a
mov edx, esi
mov rcx, rbp
call fcn.1400b7a00
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x1401eba40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x1400b79de
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x1400b79de
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x1400b79eb
mov ecx, 0x80070057
call fcn.140002cb0
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c83b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp qword [rcx + 0x330], rbp
mov dword [rsp + 0x30], ebp
je 0x1400c8420
mov rcx, qword [rcx + 0x308]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x330]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400c8413
cmp dword [rsp + 0x30], 0x103
jne 0x1400c8413
mov rcx, qword [rbx + 0x330]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x330]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x180]
mov qword [rbx + 0x330], rbp
test rcx, rcx
je 0x1400c8440
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x180], rbp
mov rcx, qword [rbx + 0x178]
test rcx, rcx
je 0x1400c846b
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbx + 0x178]
test rcx, rcx
je 0x1400c846b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x178], rbp
mov rdi, qword [rbx + 0x310]
test rdi, rdi
je 0x1400c84a6
mov rcx, rdi
call fcn.14010fbe0
cmp dword [rdi + 0xa4], ebp
jne 0x1400c8497
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400c8497
call fcn.1401287f4
mov qword [rdi], rbp
mov rcx, rdi
call fcn.1401287f4
mov qword [rbx + 0x310], rbp
mov rax, qword [rbx + 0x338]
lea rdi, [0x14017f438]
mov ecx, 1
mov rsi, rax
repe cmpsw word [rsi], word [rdi]
je 0x1400c84ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x140206cc0]
mov dword [rbx + 0x16c], ebp
test rcx, rcx
je 0x1400c84ea
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x21020223
call qword [rax + 0x58]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400cf7f0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
cmp qword [rcx + 0x40], 0
mov rsi, rcx
jne 0x1400cf818
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x40], rax
cmp qword [rsi + 0x48], 0
jne 0x1400cf833
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x48], rax
lea rcx, [0x1400cf420]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call fcn.1401360c0
test rax, rax
mov rbp, rax
je 0x1400cf8c1
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x38]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov dword [rsi + 0x50], 1
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x1400da590
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, r8
mov rdi, rcx
test r8, r8
jne 0x1400da5b6
xor eax, eax
jmp 0x1400da6f2
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x40]
call fcn.1400db3f0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400da6ce
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400da698
cmp dword [rsp + 0x30], 4
jne 0x1400da698
mov eax, dword [rsp + 0x80]
mov dword [rbx], eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400da681
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400da691
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400da6f2
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400da6ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400da6ca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400da6f2
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400da6f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret