joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042620
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x10080
call fcn.140237890
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x100b8], rbx
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x10070], rax
mov r13, r9
mov r12, r8
mov rbp, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x60], r9
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov qword [rsp + 0x48], rbx
call fcn.1401e9268
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14004269a
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, [0x140260b08]
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400426db
movzx edi, dx
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x1400426f6
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call fcn.1400074b0
jmp 0x1400426f6
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.140007720
nop
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400427be
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], 0xfffe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r13]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400427be
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x14004277c
cmp eax, 2
jne 0x1400427be
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140042795
test al, 1
jne 0x1400427be
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x14004279c
jmp 0x1400427be
mov word [rsp + 0x70], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.140007720
nop
test rbx, rbx
je 0x1400427cd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400427ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14004280a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbp
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140216200
mov rbx, qword [rsp + 0x100b8]
add rsp, 0x10080
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140043ca0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rdi
mov eax, 0x10060
call fcn.140237890
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x10078], rbx
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x10050], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
call fcn.1401e9268
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x140043cfe
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x140260b08]
test rdx, 0xffffffffffff0000
jne 0x140043d3a
movzx edi, dx
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x140043d56
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.1400074b0
jmp 0x140043d56
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.140007720
nop
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x50]
call fcn.1402197d0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140043dce
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x4c], 0x5c
jne 0x140043dae
mov word [rsp + rcx*2 + 0x4c], ax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140007720
mov rax, rbx
mov rcx, qword [rsp + 0x10050]
xor rcx, rsp
call fcn.140216200
mov rbx, qword [rsp + 0x10078]
add rsp, 0x10060
pop rdi
ret
Function at 0x140043e50
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rdi
mov eax, 0x10060
call fcn.140237890
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x10078], rbx
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x10050], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
call fcn.1401e9268
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x140043eae
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x140260b08]
test rdx, 0xffffffffffff0000
jne 0x140043eea
movzx edi, dx
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x140043f06
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.1400074b0
jmp 0x140043f06
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.140007720
nop
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x50]
call fcn.1402197d0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140043f7e
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x4c], 0x5c
jne 0x140043f5e
mov word [rsp + rcx*2 + 0x4c], ax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140007720
mov rax, rbx
mov rcx, qword [rsp + 0x10050]
xor rcx, rsp
call fcn.140216200
mov rbx, qword [rsp + 0x10078]
add rsp, 0x10060
pop rdi
ret

Function at 0x140044000
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
call fcn.1401e9268
mov rcx, rax
mov edx, ebx
test rax, rax
setne dl
test edx, edx
jne 0x140044042
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x140260b08]
test rdx, 0xffffffffffff0000
jne 0x14004407e
movzx edi, dx
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x14004409a
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.1400074b0
jmp 0x14004409a
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.140007720
nop
mov dword [rsp + 0x58], 1
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140259f08]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x1400440d4
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea ebx, [rcx - 1]
mov r8d, ebx
mov rcx, rsi
call fcn.140007720
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140045050
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140311024]
test eax, eax
jne 0x14004507b
lea rcx, [0x140311020]
mov dword [0x140311020], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x140311024]
cmp eax, 6
jne 0x140045093
cmp dword [0x140311028], 2
jne 0x140045093
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400450a0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140311024]
test eax, eax
jne 0x1400450cb
lea rcx, [0x140311020]
mov dword [0x140311020], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x140311024]
cmp eax, 6
jne 0x1400450e3
cmp dword [0x140311028], 3
jne 0x1400450e3
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400469d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x70
xor edi, edi
xor bp, bp
sub r8d, 3
movaps xmmword [rax - 0x28], xmm6
xorps xmm6, xmm6
mov r13, r9
mov dword [rax + 0x18], edi
mov ebx, edi
mov r10, rdx
mov r12, rcx
je 0x140046c26
sub r8d, 1
je 0x140046b6f
sub r8d, 7
je 0x140046abb
cmp r8d, 8
jne 0x140046cd1
cmp qword [rcx], rbx
mov qword [rax - 0x50], rdi
lea esi, [rdi + 1]
je 0x140046a94
lea rdx, [rax - 0x50]
mov rcx, r10
call fcn.140046810
test eax, eax
js 0x140046a94
mov rdi, qword [rsp + 0x38]
mov rcx, qword [r12]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140046a8b
cmp dword [rsp + 0x34], 4
cmove ebx, esi
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, 4
call fcn.1402176d0
test rax, rax
mov qword [r13], rax
je 0x140046cd1
mov ecx, dword [rsp + 0xa0]
mov dword [rax], ecx
mov eax, esi
jmp 0x140046cd3
xor eax, eax
mov qword [rsp + 0x38], rdi
cmp qword [rcx], rax
lea esi, [rax + 1]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
je 0x140046b4e
lea rdx, [rsp + 0x38]
mov rcx, r10
invalid
Function at 0x140048680
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rdi
sub rsp, 0x88
mov rcx, qword [rcx + 0x4c8]
mov qword [rsp + 0x80], rsi
test rcx, rcx
jne 0x1400486aa
xor esi, esi
mov edi, esi
jmp 0x1400487d7
mov rax, qword [0x14025e3f8]
xor esi, esi
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov rax, qword [0x14025e400]
mov qword [rsp + 0x30], rsi
mov qword [rdx + 8], rax
xor eax, eax
lea r8d, [rsi + 3]
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x60], esi
mov dword [rsp + 0xa0], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x14004871a
mov edi, esi
jmp 0x1400487d7
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rsi
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov r9d, 0x18
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov rcx, rdi
mov qword [rdx + 8], rax
lea rax, [rsp + 0xa0]
mov edx, 0x2f0003
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x74], 2
mov dword [rsp + 0x70], 0x2b
mov dword [rsp + 0xa0], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1400487d2
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.14003bed0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400487ce
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, esi
jmp 0x1400487d7
mov edi, 1
lea rax, [rsp + 0xb8]
lea rdx, str.SOFTWAREDolbyDolbyDigitalPlusStaticKeys
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rsi, qword [rsp + 0x80]
test eax, eax
jne 0x140048867
mov ecx, dword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb8]
lea rax, [rsp + 0xb0]
mov dword [rsp + 0xb0], ecx
lea rdx, str.DD0DF94B_53A2_4A92_854E_91F42E28FD7B_999
mov r9d, 4
mov rcx, rbx
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140048867
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x88
pop rdi
pop rbx
ret
Function at 0x140048a10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREReal_Sound_LabCONEQAPOSettings
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140048ae7
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.DisableSpeakerModeMonitoring
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov edi, eax
jne 0x140048aa6
cmp dword [rsp + 0x68], 4
mov eax, SafeArrayDestroy
cmovne edi, eax
test rbx, rbx
je 0x140048ab6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
jne 0x140048ad9
test rbx, rbx
mov edi, dword [rsp + 0x58]
je 0x140048acc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x140048ae7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140049c60
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov qword [rsp + 0x48], rdx
xor ebx, ebx
mov dword [rsp + 0x3c], ebx
mov qword [rsp + 0x40], rbx
call fcn.1401e9268
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x140049cc0
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x140260b08]
test rdx, 0xffffffffffff0000
jne 0x140049cfc
movzx edi, dx
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x140049d18
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.1400074b0
jmp 0x140049d18
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.140007720
nop
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAudCtr.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140049de4
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
mov eax, dword [rsp + 0x30]
add eax, eax
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140049de4
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x140049da1
cmp eax, 2
jne 0x140049de4
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140049dba
test al, 1
jne 0x140049de4
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], 0
je 0x140049dc1
jmp 0x140049de4
mov word [rsp + 0x60], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140007720
nop
test rbx, rbx
je 0x140049df2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140216200
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c1c80
Capabilities:
Check os version

Disassembly:
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0x30]
mov r13, r9
mov r14d, r8d
test rax, rax
mov r11d, edx
mov r15, rcx
jne 0x1400c1cac
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r13
ret
mov r8, qword [rax + 0x208]
test r8, r8
je 0x1400c1c9f
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
xor r12d, r12d
lea rbp, [0x140303390]
lea rbx, [0x140303438]
lea rsi, [0x140303438]
mov r10d, r12d
mov r9, r12
lea rdi, str.AutoSelectChannelByJackConf
test r11d, r11d
je 0x1400c1d59
mov edx, dword [r8]
mov rcx, r12
mov rax, rbp
cmp dword [rax], edx
je 0x1400c1d40
add rax, 0x18
add rcx, 1
cmp rax, rbx
jl 0x1400c1d04
mov rcx, r12
mov rax, rsi
nop
nop
cmp dword [rax], edx
je 0x1400c1d36
add rax, 0x18
add rcx, 1
cmp rax, rdi
jl 0x1400c1d20
mov eax, r12d
jmp 0x1400c1d48
lea rax, [rcx + rcx*2]
mov eax, dword [rsi + rax*8 + 8]
jmp 0x1400c1d48
lea rax, [rcx + rcx*2]
mov eax, dword [rbp + rax*8 + 8]
cmp eax, r11d
jne 0x1400c1d5f
test r10d, r10d
jns 0x1400c1d78
xor eax, eax
jmp 0x1400c1e29
cmp dword [r8 + 4], r12d
jne 0x1400c1d4d
add r9, 1
add r10d, 1
add r8, 8
cmp r9, 7
jl 0x1400c1cf6
xor eax, eax
jmp 0x1400c1e29
mov edx, dword [0x140311024]
xor di, di
mov esi, r12d
movsxd rbp, r10d
lea rbx, reloc.OLEAUT32.dll_VariantClear
nop
test edx, edx
jne 0x1400c1db1
lea rcx, [0x140311020]
mov dword [0x140311020], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [0x140311024]
cmp edx, 6
jne 0x1400c1dc4
cmp dword [0x140311028], 0
jne 0x1400c1dc4
lea eax, [rdx + 0x12]
jmp 0x1400c1dc9
mov eax, 0x1b
cmp esi, eax
jge 0x1400c1e1c
mov rax, qword [r15 + 0x30]
mov rcx, qword [rax + 0x208]
mov eax, dword [rcx + rbp*8 + 4]
test dword [rbx - 8], eax
je 0x1400c1dff
cmp dword [rbx - 4], r14d
jne 0x1400c1dff
test di, di
mov r12d, 1
jne 0x1400c1df5
movzx edi, word [rbx]
movzx eax, word [r13]
cmp word [rbx], ax
je 0x1400c1e08
add esi, 1
add rbx, 0x14
jmp 0x1400c1d90
movsxd rax, esi
lea rcx, [rax + rax*4]
lea rax, reloc.OLEAUT32.dll_VariantClear
mov di, word [rax + rcx*4]
jmp 0x1400c1e21
test r12d, r12d
je 0x1400c1e26
mov word [r13], di
mov eax, r12d
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x1400d0d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov edx, 6
add ax, 1
mov rcx, rbp
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov r12, rax
je 0x1400d0ed2
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400d0ed2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400d0ed2
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400d0e16
nop
cmp rdi, r11
jae 0x1400d0ed2
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400d0e00
cmp rdi, r11
jae 0x1400d0ed2
movzx eax, word [rdi]
test ax, ax
je 0x1400d0ed2
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1400d0e4c
mov edx, ebx
mov rcx, rsi
call fcn.140003c90
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1400d0e69
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.140216220
test eax, eax
je 0x1400d0ea8
cmp eax, 0xc
je 0x1400d0ea2
cmp eax, 0x16
je 0x1400d0e9c
cmp eax, 0x22
je 0x1400d0e9c
cmp eax, 0x50
je 0x1400d0ea8
call fcn.1401e7838
int3
call fcn.1401e7838
int3
call fcn.1401e77f0
int3
test ebx, ebx
js 0x1400d0ec7
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1400d0ec7
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x1400d0ed4
mov ecx, 0x80070057
call fcn.140003c70
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400df590
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov word [rcx + 0xe], 0x409
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
je 0x1400df5b9
movzx edx, ax
mov rcx, rbx
call fcn.1400df610
mov word [rbx + 0xe], ax
movzx eax, word [rbx + 0xe]
lea r8, str.Language
lea rdx, str.General
lea rcx, [0x1403149a0]
xor r9d, r9d
mov dword [rbx + 8], 1
mov word [rbx + 0xc], ax
call fcn.1401ee9b4
test ax, ax
je 0x1400df600
movzx edx, ax
mov rcx, rbx
call fcn.1400df610
mov dword [rbx + 8], 0
mov word [rbx + 0xc], ax
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400f0cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1400f0e19
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400f0e19
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400f0e19
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400f0d4a
cmp rdi, r11
jae 0x1400f0e19
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400f0d34
cmp rdi, r11
jae 0x1400f0e19
movzx eax, word [rdi]
test ax, ax
je 0x1400f0e19
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x140302670]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x1400f0dba
mov edx, esi
mov rcx, rbp
call fcn.1400f0e30
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x140302670]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x1400f0e0e
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x1400f0e0e
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x1400f0e1b
mov ecx, 0x80070057
call fcn.140003c70
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret