joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fa619
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa78f
mov r11, rsp
push r12
push r13
push r15
sub rsp, 0xa0
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0xf8], 0
mov r12d, r8d
mov r13, rdx
mov r15, rcx
je 0x1400fa775
mov rcx, qword [rcx + 0x40]
lea r9, [r11 - 0x58]
mov qword [r11 + 0x18], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x20], rbp
xor r8d, r8d
mov qword [r11 - 0x28], rsi
mov edx, 0x419
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x38], r14
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsp + 0x60]
mov edx, dword [r15 + 0x1c4]
mov r8d, dword [rsp + 0x64]
mov eax, dword [r15 + 0x1c0]
mov r10d, dword [rsp + 0x6c]
mov r14d, dword [r15 + 0x1b0]
mov ebp, dword [r15 + 0x1b4]
lea r9d, [rdx + r8]
mov r11d, dword [rsp + 0x68]
lea edi, [rax + rcx]
sub r11d, dword [r15 + 0x1c8]
mov esi, dword [r15 + 0x108]
sub r11d, eax
mov eax, dword [r15 + 0x1cc]
sub r11d, ecx
sub esi, dword [r15 + 0x1b8]
mov ecx, r10d
mov ebx, dword [r15 + 0x10c]
sub ecx, eax
sub ebx, dword [r15 + 0x1bc]
sub r10d, eax
sub ecx, edx
mov byte [rsp + 0x58], 0
sub r10d, edx
sub ecx, r8d
mov rdx, qword [r13 + 8]
sub ebx, ebp
sub r10d, r8d
sub esi, r14d
cmp ebx, ecx
mov eax, 0xff
mov ecx, 0x80
mov r8d, edi
cmovle r10d, ebx
test r12d, r12d
cmovne eax, ecx
lea rcx, [r15 + 0xf0]
mov byte [rsp + 0x50], al
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.1400134c0
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xa0
pop r15
pop r13
pop r12
ret
Function at 0x14010dcb0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.140157e30
cmp dword [rbx + 0x140], 0
jne 0x14010dce3
test edi, edi
je 0x14010dce3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x328]
mov dword [rbx + 0x140], eax
lea rax, [rbx + 0x250]
test rax, rax
je 0x14010dd5f
cmp qword [rax + 0x40], 0
je 0x14010dd5f
movsd xmm0, qword [0x140450f90]
xor r8d, r8d
mulsd xmm0, qword [0x1403d2a38]
mov edx, 0x418
mov rcx, qword [rbx + 0x290]
cvttsd2si eax, xmm0
movsxd r9, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x290]
xor r9d, r9d
mov edx, 0x415
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0xbb8
mov edx, 0x403
add ax, cx
mov r8d, 2
mov rcx, qword [rbx + 0x290]
movzx r9d, ax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rbx + 0x148]
test rax, rax
je 0x14010dd9b
cmp dword [rbx + 0x200], 0
ja 0x14010dd7d
cmp dword [rbx + 0x1dc], 0
je 0x14010dd9b
lea rdx, [rbx + 0x1b0]
lea rcx, [rax + 0x1ac8]
test edi, edi
je 0x14010dd96
call fcn.1400f20c0
jmp 0x14010dd9b
call fcn.1400f2170
cmp qword [rbx + 0x388], 0
jle 0x14010de55
cmp qword [rbx + 0x3b0], 0
jne 0x14010ddca
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x3b0], rax
mov qword [rsp + 0x60], rsi
xor esi, esi
test edi, edi
je 0x14010de60
mov qword [rsp + 0x28], rsi
lea rcx, [0x14010e1b0]
xor r9d, r9d
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x58], rbp
mov rdx, rbx
call fcn.140164718
mov rbp, rax
test rax, rax
je 0x14010de4b
lea rdi, [rbx + 0x3a8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov r9, rdi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], esi
mov r8, rbx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov dword [rsp + 0x50], esi
cmp qword [rbx + 0x3a8], rsi
je 0x14010de50
mov rcx, qword [rbx + 0x3b0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x3a8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14010deac
cmp dword [rsp + 0x50], 0x103
jne 0x14010deac
mov rcx, qword [rbx + 0x3a8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x3a8]
test rcx, rcx
je 0x14010de50
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x3a8], rsi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14010e880
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rsi, rdx
mov rbx, rcx
mov rdx, qword [rdx]
movzx eax, word [rdx]
cmp ax, word [0x140393240]
jne 0x14010e8da
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14010e8d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14010ea2e
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x14010ea41
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rbp, [0x1403931fc]
mov rdx, rbp
lea rcx, [rsp + 0xd0]
call fcn.1400168b0
mov rdi, 0xffffffffffffffff
test al, al
jne 0x14010e941
mov rax, rdi
inc rax
cmp word [rbp + rax*2], 0
jne 0x14010e922
mov r8d, eax
mov rdx, rbp
lea rcx, [rsp + 0xd0]
call fcn.140016ad0
nop
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.140012250
add rax, 0x18
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x20]
call fcn.14003d360
nop
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140016d50
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14010e99b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1402ef020
mov dword [rsp + 0x30], VarBstrFromDisp
test rbx, rbx
jne 0x14010e9bf
mov qword [rsp + 0x38], rbx
jmp 0x14010e9c8
mov rax, qword [rbx + 0x40]
mov qword [rsp + 0x38], rax
lea rax, str.open
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x60], 3
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14010ea0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14010ea29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140012800
int3
Function at 0x140112cc0
Capabilities:
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbp, rdx
mov rdi, rcx
call fcn.140161dfc
nop
lea rax, vtable.CSilencePlayer.0
mov qword [rdi], rax
lea rax, vtable.CSilencePlayer::XNotifyClient.0
mov qword [rdi + 0x40], rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140112e94
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x48], rax
lea r15, [rdi + 0x60]
xor ecx, ecx
mov qword [r15], rcx
mov qword [rdi + 0x68], rcx
mov qword [rdi + 0x70], rcx
mov qword [rdi + 0x78], rcx
lea rbx, [rdi + 0x80]
lea esi, [rcx + 4]
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140112d50
test rbp, rbp
jne 0x140112d76
xor eax, eax
jmp 0x140112d8b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x140112d80
mov r8d, eax
mov rdx, rbp
lea rcx, [rdi + 0x48]
call fcn.140016ad0
mov rax, qword [rsp + 0xa0]
movaps xmm0, xmmword [rax]
movups xmmword [rdi + 0x50], xmm0
mov qword [rsp + 0x20], r15
lea r9, [0x1403920b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140392100]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140112e79
mov rcx, qword [r15]
mov rax, qword [rcx]
lea rdx, [rdi + 0x40]
call qword [rax + 0x30]
test eax, eax
js 0x140112e79
xor ebp, ebp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [0x1401133c0]
call fcn.140164718
mov rsi, rax
test rax, rax
je 0x140112e79
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
lea r9, [rdi + 0x78]
mov r8, rbx
mov rdx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call fcn.140113290
test eax, eax
je 0x140112e79
mov rcx, rdi
call fcn.140113290
test eax, eax
je 0x140112e79
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x140112e79
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140012800
int3
Function at 0x14011a480
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
xor edi, edi
mov dword [rsp + 0x50], edi
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x14011a648
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rsi, [0x140393240]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400168b0
lea rbx, [rdi - 1]
test al, al
jne 0x14011a4f1
mov rax, rbx
inc rax
cmp word [rsi + rax*2], 0
jne 0x14011a4d6
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140016ad0
nop
mov qword [rsp + 0x68], rdi
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x14011a63d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1400168b0
test al, al
jne 0x14011a54b
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x14011a530
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140016ad0
nop
mov dword [rsp + 0x50], 1
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140385d30]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14011a58c
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14011a580
mov edi, eax
mov r8d, edi
lea rcx, [rsp + 0x58]
call fcn.140016ad0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140016d50
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011a5d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.SonicFocusSFConfig.dat
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14011a5e0
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.140016630
mov rdi, qword [rsp + 0x60]
lea rcx, [rdi - 0x18]
call fcn.140012250
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.14003fd40
mov esi, eax
lock xadd dword [rdi - 8], ebx
sub ebx, 1
jg 0x14011a633
mov rcx, qword [rdi - 0x18]
mov r8, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.140012800
nop
mov ecx, 0x80004005
call fcn.140012800
int3
Function at 0x14012b670
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [0x1404657e0], 0
mov rbx, rcx
je 0x14012b6a0
mov rax, qword [rcx + 0x150]
mov edx, dword [0x140450fa4]
cmp dword [rax + 0x64], 0
cmovge edx, dword [0x140450fa0]
jmp 0x14012b6a6
mov edx, dword [0x140450fa8]
movzx edi, dx
call fcn.140155310
lea rcx, [rbx + 0x11e0]
cmp edi, 5
ja case.default.0x14012b6d0
mov r9, qword [rax + 0x10]
lea r8, [0x140000000]
mov edx, dword [r8 + rdi*4 + 0x12b74c]
add rdx, r8
jmp rdx
mov r8d, 0x35a
mov rdx, r9
jmp 0x14012b718
mov r8d, 0x35b
mov rdx, r9
jmp 0x14012b718
mov r8d, 0x35c
mov rdx, r9
jmp 0x14012b718
mov r8d, 0x35d
mov rdx, r9
jmp 0x14012b718
mov r8d, 0x35e
mov rdx, r9
jmp 0x14012b718
mov rdx, r9
jmp 0x14012b712
mov rdx, qword [rax + 0x10]
mov r8d, 0x359
mov dword [rsp + 0x20], 1
call fcn.140098820
mov rcx, qword [rbx + 0x40]
mov r9d, 0x105
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140128f20
Function at 0x14012b8c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0xa8
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r14, r9
lea r8d, [rdx + 0x64]
call fcn.1402ef020
call fcn.140155310
lea r8, str.WAVE
mov rdx, rbx
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rbx, rbx
je 0x14012bb07
test rax, rax
je 0x14012bb07
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xa0], r15
call fcn.140155310
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
call fcn.140155310
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r8d, r8d
mov dword [rsp + 0x24], 0x204d454d
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WINMM.dll_mmioOpenW]
mov r9d, 0x20
mov dword [rsi + 0x268], 0x45564157
mov rcx, rax
lea rdx, [rsi + 0x260]
xor r8d, r8d
mov rbx, rax
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x14012bafa
mov r15d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [rsi + 0x24c], 0x20746d66
mov r9d, r15d
lea r8, [rsi + 0x260]
lea rdx, [rsi + 0x24c]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x14012bafa
xor r8d, r8d
lea rdx, [rsi + 0x24c]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov r9d, r15d
mov dword [rsi + 0x238], 0x61746164
lea r8, [rsi + 0x260]
mov rcx, rbx
lea rdx, [rsi + 0x238]
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x14012bafa
xor r8d, r8d
lea rdx, [rsi + 0x238]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x258]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x250]
lea rdx, [rsi + 0x210]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x250], eax
jne 0x14012bafa
mov edi, 1
cmp di, word [rsi + 0x212]
jne 0x14012bafa
cmp r15w, word [rsi + 0x21e]
jne 0x14012bafa
mov eax, dword [rsi + 0x23c]
mov rdx, r14
mov rcx, rsi
mov dword [rsi + 0xd4], eax
call fcn.14012bb10
test eax, eax
jne 0x14012bae5
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
mov rcx, rsi
call fcn.14012bf80
xor eax, eax
mov rdi, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xa8
pop r14
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0xd0], edi
mov rax, rbx
mov dword [rsi + 0xdc], 0
jmp 0x14012bab8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x14012bab6
xor eax, eax
jmp 0x14012bac8
Function at 0x14012dd10
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x58], rdi
je 0x14012dd62
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x58]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14012dd54
mov rcx, qword [rbx + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbx + 0x58], rdi
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x14012dd75
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], rdi
mov dword [rbx + 8], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140134150
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, 1
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x38], edi
mov rbx, rcx
call fcn.1401317e0
test eax, eax
jne 0x140134187
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [0x140394980]
call fcn.140040050
mov r8d, dword [rsp + 0x38]
test eax, eax
mov edx, dword [rsp + 0x40]
mov rcx, rbx
cmove r8d, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401341c0
Function at 0x14013d9d0
Capabilities:
Set registry value

Disassembly:
cmp dword [rcx + 0x4c], 0
je 0x14013d9e5
mov r9d, edx
lea r8, [0x1403955b0]
jmp fcn.14013ebf0
mov r8d, edx
mov r9d, 1
lea rdx, [0x140395880]
jmp fcn.140101d60

Function at 0x14013eae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rdi, r9
test r9, r9
jne 0x14013eb1b
xor eax, eax
lea r11, [r11 - 8]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor esi, esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov rdx, r8
lea rcx, [rsp + 0x38]
call fcn.14003bcd0
mov dword [rsp + 0x78], esi
mov ebx, 1
mov r9d, ebx
lea r8, str.SOFTWARESRS_LabsAPO
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140024490
test eax, eax
jne 0x14013eba7
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14013eba7
cmp dword [rsp + 0x30], 4
jne 0x14013eba7
mov eax, dword [rsp + 0x78]
mov dword [rdi], eax
jmp 0x14013eba9
mov ebx, esi
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013ebcc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14013ebdc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14013ebf0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov edi, r9d
xor ebx, ebx
mov qword [rax - 0x20], rbx
mov dword [rax - 0x18], ebx
mov qword [rax - 0x10], rbx
mov rdx, r8
lea rcx, [rax + 8]
call fcn.14003bcd0
lea r9d, [rbx + 2]
lea r8, str.SOFTWARESRS_LabsAPO
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140024490
test eax, eax
jne 0x14013ec7c
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14013ec7c
lea ebx, [rax + 1]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013ec9f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14013ecaf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140152630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0xa0
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
call fcn.1402ef020
call fcn.140155310
lea r8, str.WAVE
mov rdx, rbx
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rbx, rbx
je 0x140152824
test rax, rax
je 0x140152824
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], r14
call fcn.140155310
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
call fcn.140155310
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r8d, r8d
mov dword [rsp + 0x24], 0x204d454d
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WINMM.dll_mmioOpenW]
mov r9d, 0x20
mov dword [rsi + 0x9c], 0x45564157
mov rcx, rax
lea rdx, [rsi + 0x94]
xor r8d, r8d
mov rbx, rax
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x140152815
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [rsi + 0x80], 0x20746d66
mov r9d, r14d
lea r8, [rsi + 0x94]
lea rdx, [rsi + 0x80]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x140152815
xor r8d, r8d
lea rdx, [rsi + 0x80]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov r9d, r14d
mov dword [rsi + 0x6c], 0x61746164
lea r8, [rsi + 0x94]
mov rcx, rbx
lea rdx, [rsi + 0x6c]
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x140152815
xor r8d, r8d
lea rdx, [rsi + 0x6c]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x8c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x84]
lea rdx, [rsi + 0x44]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x84], eax
jne 0x140152815
mov eax, 1
cmp ax, word [rsi + 0x46]
jne 0x140152815
cmp r14w, word [rsi + 0x52]
jne 0x140152815
mov dword [rsi + 0xe8], 0
mov rax, rbx
mov rdi, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xa0
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x1401527ea
xor eax, eax
jmp 0x1401527fa