joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d62c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov edx, 6
add ax, 1
mov rcx, rbp
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov r12, rax
je 0x1400d6422
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400d6422
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400d6422
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400d6366
nop
cmp rdi, r11
jae 0x1400d6422
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400d6350
cmp rdi, r11
jae 0x1400d6422
movzx eax, word [rdi]
test ax, ax
je 0x1400d6422
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1400d639c
mov edx, ebx
mov rcx, rsi
call fcn.140003d40
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1400d63b9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.1402279d0
test eax, eax
je 0x1400d63f8
cmp eax, 0xc
je 0x1400d63f2
cmp eax, 0x16
je 0x1400d63ec
cmp eax, 0x22
je 0x1400d63ec
cmp eax, 0x50
je 0x1400d63f8
call fcn.1401f8920
int3
call fcn.1401f8920
int3
call fcn.1401f88d8
int3
test ebx, ebx
js 0x1400d6417
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1400d6417
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x1400d6424
mov ecx, 0x80070057
call fcn.140003d20
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400e4c90
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov word [rcx + 0xe], 0x409
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
je 0x1400e4cb9
movzx edx, ax
mov rcx, rbx
call fcn.1400e4d10
mov word [rbx + 0xe], ax
movzx eax, word [rbx + 0xe]
lea r8, str.Language
lea rdx, str.General
lea rcx, [0x14032a360]
xor r9d, r9d
mov dword [rbx + 8], 1
mov word [rbx + 0xc], ax
call fcn.1401ffa54
test ax, ax
je 0x1400e4d00
movzx edx, ax
mov rcx, rbx
call fcn.1400e4d10
mov dword [rbx + 8], 0
mov word [rbx + 0xc], ax
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400f6360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1400f64c9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400f64c9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400f64c9
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400f63fa
cmp rdi, r11
jae 0x1400f64c9
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400f63e4
cmp rdi, r11
jae 0x1400f64c9
movzx eax, word [rdi]
test ax, ax
je 0x1400f64c9
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x140317660]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x1400f646a
mov edx, esi
mov rcx, rbp
call fcn.1400f64e0
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x140317660]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x1400f64be
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x1400f64be
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x1400f64cb
mov ecx, 0x80070057
call fcn.140003d20
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400f6640
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x1403260fc], 0
je 0x1400f6657
mov eax, 1
add rsp, 0x28
ret
lea rcx, str.MaxxAudioAPOShell64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [0x140326228], rax
je 0x1400f6841
lea rdx, str.WavesFX_Initialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_Uninitialize
mov qword [0x140326230], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_SetParameter
mov qword [0x140326238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_GetParameter
mov qword [0x140326240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_GetParametersArray
mov qword [0x140326248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_SetParametersArray
mov qword [0x140326250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_SetProperty
mov qword [0x140326258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_GetProperty
mov qword [0x140326260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_Preset_RegisterChangeNotification
mov qword [0x140326268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_CreatePluginWindow
mov qword [0x140326270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_DetachPluginWindow
mov qword [0x140326278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_Preset_SaveDefault
mov qword [0x140326280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_Preset_SetActive
mov qword [0x140326288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_RegisterChangeNotification
mov qword [0x140326290], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_VendorSpecific
mov qword [0x140326298], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140326228]
lea rdx, str.WavesFX_Preset_GetCount
mov qword [0x1403262a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140326230], 0
mov qword [0x1403262b0], rax
mov eax, dword [0x1403260fc]
mov ecx, 1
cmovne eax, ecx
mov dword [0x1403260fc], eax
add rsp, 0x28
ret
mov eax, dword [0x1403260fc]
add rsp, 0x28
ret
Function at 0x14011d0d0
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10040
call fcn.140248980
sub rsp, rax
mov rax, qword [0x140315d90]
xor rax, rsp
mov qword [rsp + 0x10020], rax
mov r8, qword [rcx + 0x118]
mov rbx, rcx
test r8, r8
jne 0x14011d104
xor eax, eax
jmp 0x14011d176
mov r8, qword [r8 + 0x1a20]
mov r10, qword [rcx + 0x110]
mov qword [rsp + 0x10068], rdi
test r8, r8
je 0x14011d16c
nop
test r8, r8
mov r9, r8
je 0x14011d343
mov r9, qword [r9 + 0x10]
mov r8, qword [r8]
test r9, r9
je 0x14011d167
test r10, r10
je 0x14011d338
mov rax, qword [r9 + 0x28]
mov rdi, r10
sub rdi, rax
nop
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x14011d163
add rax, 2
test ecx, ecx
jne 0x14011d150
test edx, edx
je 0x14011d18f
test r8, r8
jne 0x14011d120
xor eax, eax
mov rdi, qword [rsp + 0x10068]
mov rcx, qword [rsp + 0x10020]
xor rcx, rsp
call fcn.1402272f0
add rsp, 0x10040
pop rbx
ret
lea rdx, [rbx + 0x4c8]
lea rcx, [r9 + 0xa8]
xor r8d, r8d
call sub.DSOUND.dll_DirectSoundCaptureCreate
test eax, eax
js 0x14011d16c
mov eax, dword [rbx + 0x674]
mov qword [rsp + 0x10058], rbp
mov qword [rsp + 0x10060], rsi
mov qword [rsp + 0x10038], r12
mov ebp, 1
shl eax, 2
mov qword [rsp + 0x10030], r13
mov word [rbx + 0x670], 1
mov word [rbx + 0x67e], 0x10
mov dword [rbx + 0x678], eax
mov word [rbx + 0x672], 2
mov word [rbx + 0x67c], 4
lea r12, [rbx + 0x5e0]
lea rsi, [rbx + 0x4e0]
lea r13d, [rbp + 0xf]
nop
nop
nop
nop
mov edi, dword [rbx + 0x678]
xor edx, edx
xor r9d, r9d
shl edi, 3
xor r8d, r8d
shr edi, 4
imul edi, ebp
add edi, 0xffffffff
mov dword [rsi], edi
movzx ecx, word [rbx + 0x67c]
mov eax, dword [rbx + 0x678]
shl eax, 3
shr eax, 4
div ecx
xor ecx, ecx
sub edi, edx
xor edx, edx
mov dword [rsi], edi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
add rsi, 0x10
mov qword [r12], rax
mov qword [rsi - 8], rax
add ebp, 1
add r12, 8
sub r13, 1
jne 0x14011d220
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rdx, [rsp + 0x20]
mov ecx, 0x7fff
mov qword [rbx + 0x660], rax
mov dword [rbx + 0x5d0], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov r13, qword [rsp + 0x10030]
mov r12, qword [rsp + 0x10038]
mov rsi, qword [rsp + 0x10060]
mov rbp, qword [rsp + 0x10058]
je 0x14011d16c
add eax, 0xffffffff
cmp word [rsp + rax*2 + 0x20], 0x5c
je 0x14011d2f2
lea r8, [0x1402729f8]
lea rcx, [rsp + 0x20]
mov edx, 0x7fff
call fcn.140228690
lea r8, str.MicCal.wav
lea rcx, [rsp + 0x20]
mov edx, 0x7fff
call fcn.140228690
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rbx + 0x690]
call fcn.140007880
mov eax, 1
jmp 0x14011d16e
mov ecx, 0x80004005
call fcn.140003d20
int3
call fcn.1401f8920
int3
Function at 0x14011d350
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x70
cmp qword [rcx + 0x4c8], 0
mov rdi, rcx
jne 0x14011d36b
xor eax, eax
add rsp, 0x70
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rsi
xor esi, esi
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.14011d5b0
mov ecx, 0xc8
call fcn.1401ebd7c
test rax, rax
mov rbx, rax
je 0x14011d3d7
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0xc0], rsi
mov dword [rax + 0x38], esi
mov dword [rax + 0xa4], esi
jmp 0x14011d3da
mov rbx, rsi
test rbx, rbx
mov qword [rdi + 0x668], rbx
jne 0x14011d3ed
xor eax, eax
jmp 0x14011d53d
mov rcx, qword [rdi + 0x690]
xor edx, edx
mov r8d, 0x11002
mov qword [rsp + 0x88], rbp
mov dword [rbx + 0xa0], 2
mov dword [rbx + 0xa4], esi
call qword [sym.imp.WINMM.dll_mmioOpenW]
test rax, rax
mov qword [rbx + 8], rax
je 0x14011d445
lea rbp, [rdi + 0x670]
mov rcx, rbx
mov rdx, rbp
call fcn.1401e4d70
test eax, eax
jns 0x14011d44c
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x14011d535
mov rcx, rbx
call fcn.1401e4b10
test eax, eax
js 0x14011d445
mov eax, dword [rdi + 0x678]
mov rcx, qword [rdi + 0x4c8]
mov dword [rsp + 0x40], 0x28
shl eax, 3
mov qword [rsp + 0x50], rbp
lea r8, [rdi + 0x4d0]
mov dword [rsp + 0x48], eax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x98], r12
call qword [rax + 0x18]
test eax, eax
js 0x14011d52b
lea rbx, [rdi + 0x5e0]
mov ebp, 0x11
nop
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x14011d4be
call qword [sym.imp.KERNEL32.dll_ResetEvent]
add rbx, 8
sub rbp, 1
jne 0x14011d4b0
mov rcx, qword [rdi + 0x4d0]
lea r8, [rdi + 0x4d8]
lea rdx, [0x14026dde8]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14011d52b
mov rcx, qword [rdi + 0x4d8]
lea r8, [rdi + 0x4e0]
lea edx, [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x14011d52b
lea rcx, [0x14011d9d0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
call fcn.1401fbf18
test rax, rax
mov rbp, rax
jne 0x14011d553
xor eax, eax
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rdi + 0x688]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rdi + 0x4d0]
xor edx, edx
mov r8, qword [rcx]
call qword [r8 + 0x48]
test eax, eax
setns sil
mov eax, esi
jmp 0x14011d52d
Function at 0x14011d5b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp qword [rcx + 0x688], rsi
mov dword [rsp + 0x30], esi
je 0x14011d61b
mov rcx, qword [rcx + 0x660]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x688]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14011d60e
cmp dword [rsp + 0x30], 0x103
jne 0x14011d60e
mov rcx, qword [rbx + 0x688]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x688]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x4d8]
mov qword [rbx + 0x688], rsi
test rcx, rcx
je 0x14011d63b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbx + 0x4d8], rsi
mov rcx, qword [rbx + 0x4d0]
test rcx, rcx
je 0x14011d666
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbx + 0x4d0]
test rcx, rcx
je 0x14011d666
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbx + 0x4d0], rsi
mov rdi, qword [rbx + 0x668]
test rdi, rdi
je 0x14011d6a1
mov rcx, rdi
call fcn.1401e4be0
cmp dword [rdi + 0xa4], esi
jne 0x14011d692
mov rcx, qword [rdi]
test rcx, rcx
je 0x14011d692
call fcn.1401ebdc0
mov qword [rdi], rsi
mov rcx, rdi
call fcn.1401ebdc0
mov qword [rbx + 0x668], rsi
mov rax, qword [rbx + 0x690]
lea rdi, [0x140273028]
mov ecx, 1
mov rsi, rax
repe cmpsw word [rsi], word [rdi]
je 0x14011d6c5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x3b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14012ca20
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x80
cmp qword [rcx + 0x90], 0
mov rsi, rcx
jne 0x14012ca41
xor eax, eax
add rsp, 0x80
pop rsi
ret
xor eax, eax
mov qword [rsp + 0x78], r12
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rcx + 0x298], r12
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.14012cc30
mov ecx, dword [rsi + 0x2a0]
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 0x28
lea r8, [rsi + 0x98]
xor r9d, r9d
imul ecx, dword [rsi + 0x240]
mul ecx
mov rcx, qword [rsi + 0x90]
shr edx, 6
lea rax, [rsi + 0x238]
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x18]
test eax, eax
jns 0x14012cae9
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x80
pop rsi
ret
mov eax, dword [rsi + 0x2a4]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
add eax, 1
mov edi, r12d
test eax, eax
jle 0x14012cb32
lea rbx, [rsi + 0x1a8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14012cb1e
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsi + 0x2a4]
add edi, 1
add rbx, 8
add eax, 1
cmp edi, eax
jl 0x14012cb10
mov rcx, qword [rsi + 0x98]
lea r8, [rsi + 0xa0]
lea rdx, [0x14026dde8]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14012cb6e
mov rcx, qword [rsi + 0xa0]
mov edx, dword [rsi + 0x2a4]
lea r8, [rsi + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jns 0x14012cb75
xor eax, eax
jmp 0x14012cc0a
lea rcx, [0x14012cd30]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x98], rbp
mov dword [rsp + 0x20], 4
call fcn.1401fbf18
test rax, rax
mov rbp, rax
je 0x14012cc02
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x250]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsi + 0x98]
xor edx, edx
mov r8, qword [rcx]
call qword [r8 + 0x48]
test eax, eax
setns r12b
mov eax, r12d
mov rbp, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
add rsp, 0x80
pop rsi
ret
Function at 0x14012fcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rbx, rdx
mov rbp, rcx
call fcn.1401ed45c
mov rdi, qword [rax + 8]
lea r12, str.IntMicRange
lea rsi, str.ExtMicRange
test rdi, rdi
je 0x14012fd43
mov rcx, qword [rbp + 0x30]
call fcn.140017b20
mov r8, rsi
lea rdx, str.RtkPreset
test eax, eax
mov rcx, rdi
cmovne r8, r12
xor r9d, r9d
call fcn.1401ffa54
mov dword [rbx], eax
xor ecx, ecx
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareRealtekCOMPreset
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov dword [rbx], ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0xa0], 4
mov dword [rsp + 0x98], 4
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14012fdef
mov rcx, qword [rbp + 0x30]
call fcn.140017b20
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0xa0]
test eax, eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
cmovne rsi, r12
lea rax, [rsp + 0xa8]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14012fdef
mov eax, dword [rsp + 0xa8]
mov dword [rbx], eax
mov eax, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14012fe00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
call fcn.1401ed45c
lea rdi, str.IntMicRange
mov rbx, qword [rax + 8]
lea rbp, str.ExtMicRange
test rbx, rbx
je 0x14012fe55
mov rcx, qword [rsi + 0x30]
call fcn.140017b20
mov r9d, dword [rsp + 0x78]
mov r8, rbp
test eax, eax
lea rdx, str.RtkPreset
mov rcx, rbx
cmovne r8, rdi
call fcn.1401ffaf4
lea rax, [rsp + 0x80]
xor ebx, ebx
lea rdx, str.SoftwareRealtekCOMPreset
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14012fee3
mov rcx, qword [rsi + 0x30]
call fcn.140017b20
mov rcx, qword [rsp + 0x88]
lea r9d, [rbx + 4]
test eax, eax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
cmove rdi, rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140139cd0
Capabilities:
Get graphical window text

Disassembly:
push rbx
mov eax, 0x10f0
call fcn.140248980
sub rsp, rax
mov rax, qword [0x140315d90]
xor rax, rsp
mov qword [rsp + 0x10e0], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x2c70]
test rcx, rcx
je 0x140139f25
cmp qword [rbx + 0x100], 0
je 0x140139f25
mov rax, qword [rcx]
mov qword [rsp + 0x1108], rbp
mov qword [rsp + 0x1110], rsi
mov qword [rsp + 0x1118], rdi
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x140139de2
mov rcx, qword [rbx + 0x2c70]
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
je 0x140139de2
cmp dword [rbx + 0x17e8], 0
jne 0x140139d69
cmp dword [rbx + 0x16b8], 0
jne 0x140139d69
xor edx, edx
jmp 0x140139d6e
mov edx, 1
mov rcx, qword [rbx + 0x2c70]
xor eax, eax
cmp dword [rbx + 0x16b8], 1
sete al
lea rdi, [rbx + 0x40c]
mov dword [rbx + 0x410], eax
mov dword [rdi], edx
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
jne 0x140139daa
mov rcx, qword [rbx + 0x2c70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x70]
cmp dword [rdi], 0
je 0x140139e18
mov rcx, qword [rbx + 0x2c70]
mov edx, dword [rbx + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
jne 0x140139e18
mov rcx, qword [rbx + 0x2c70]
lea rdx, [rbx + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x80]
jmp 0x140139e18
mov rcx, qword [rbx + 0x2c70]
xor edx, edx
cmp dword [rbx + 0x17e8], 1
sete dl
lea rdi, [rbx + 0x40c]
mov dword [rdi], edx
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
jne 0x140139e18
mov rcx, qword [rbx + 0x2c70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rbx + 0x378]
mov r9d, 0x105
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [rdi]
lea r9, [rsp + 0x20]
neg eax
mov edx, 0x702
mov dword [rsp + 0x20], 3
sbb ecx, ecx
xor r8d, r8d
mov dword [rsp + 0x24], 0
and ecx, 2
mov dword [rsp + 0x2c], 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 0x26d0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rdi]
lea rcx, [rbx + 0x2690]
call fcn.1401ed86c
mov rbp, qword [rbx + 0x100]
bt dword [rbp + 0xc], 0xd
jae 0x140139ec6
mov rsi, qword [rbx + 0x108]
lea rcx, [rbp + 0x540]
mov rdx, rsi
call fcn.1400db010
test eax, eax
je 0x140139ec6
lea rcx, [rbp + 0x540]
mov rdx, rsi
call fcn.1400db0b0
test eax, eax
jne 0x140139ec6
mov edx, dword [rdi]
mov rcx, qword [rbx + 0x2c70]
call fcn.14012ac10
cmp dword [rbx + 0x2c84], 0
mov rsi, qword [rsp + 0x1110]
mov rbp, qword [rsp + 0x1108]
jne 0x140139f01
cmp dword [rdi], 0
je 0x140139f01
lea r8, str.MicCalExecuted
lea rdx, str.General
lea rcx, [0x14032a360]
xor r9d, r9d
call fcn.1401ffa54
cmp dword [rdi], 0
mov rdi, qword [rsp + 0x1118]
je 0x140139f25
cmp dword [rbx + 0x45c], 0
je 0x140139f25
mov rcx, qword [rbx + 0x2c70]
xor edx, edx
call fcn.14012d090
mov rcx, qword [rsp + 0x10e0]
xor rcx, rsp
call fcn.1402272f0
add rsp, 0x10f0
pop rbx
ret