joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b6c50
Capabilities:
Check os version

Disassembly:
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0x30]
mov r13, r9
mov r14d, r8d
test rax, rax
mov r11d, edx
mov r15, rcx
jne 0x1400b6c7c
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r13
ret
mov r8, qword [rax + 0x258]
test r8, r8
je 0x1400b6c6f
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
xor r12d, r12d
lea rbp, [0x1403214a0]
lea rbx, [0x140321548]
lea rsi, [0x140321548]
mov r10d, r12d
mov r9, r12
lea rdi, str.AutoSelectChannelByJackConf
test r11d, r11d
je 0x1400b6d29
mov edx, dword [r8]
mov rcx, r12
mov rax, rbp
cmp dword [rax], edx
je 0x1400b6d10
add rax, 0x18
add rcx, 1
cmp rax, rbx
jl 0x1400b6cd4
mov rcx, r12
mov rax, rsi
nop
nop
cmp dword [rax], edx
je 0x1400b6d06
add rax, 0x18
add rcx, 1
cmp rax, rdi
jl 0x1400b6cf0
mov eax, r12d
jmp 0x1400b6d18
lea rax, [rcx + rcx*2]
mov eax, dword [rsi + rax*8 + 8]
jmp 0x1400b6d18
lea rax, [rcx + rcx*2]
mov eax, dword [rbp + rax*8 + 8]
cmp eax, r11d
jne 0x1400b6d2f
test r10d, r10d
jns 0x1400b6d48
xor eax, eax
jmp 0x1400b6df9
cmp dword [r8 + 4], r12d
jne 0x1400b6d1d
add r9, 1
add r10d, 1
add r8, 8
cmp r9, 7
jl 0x1400b6cc6
xor eax, eax
jmp 0x1400b6df9
mov edx, dword [0x14032f0e4]
xor di, di
mov esi, r12d
movsxd rbp, r10d
lea rbx, reloc.OLEAUT32.dll_VariantClear
nop
test edx, edx
jne 0x1400b6d81
lea rcx, [0x14032f0e0]
mov dword [0x14032f0e0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [0x14032f0e4]
cmp edx, 6
jne 0x1400b6d94
cmp dword [0x14032f0e8], 0
jne 0x1400b6d94
lea eax, [rdx + 0x12]
jmp 0x1400b6d99
mov eax, 0x1b
cmp esi, eax
jge 0x1400b6dec
mov rax, qword [r15 + 0x30]
mov rcx, qword [rax + 0x258]
mov eax, dword [rcx + rbp*8 + 4]
test dword [rbx - 8], eax
je 0x1400b6dcf
cmp dword [rbx - 4], r14d
jne 0x1400b6dcf
test di, di
mov r12d, 1
jne 0x1400b6dc5
movzx edi, word [rbx]
movzx eax, word [r13]
cmp word [rbx], ax
je 0x1400b6dd8
add esi, 1
add rbx, 0x14
jmp 0x1400b6d60
movsxd rax, esi
lea rcx, [rax + rax*4]
lea rax, reloc.OLEAUT32.dll_VariantClear
mov di, word [rax + rcx*4]
jmp 0x1400b6df1
test r12d, r12d
je 0x1400b6df6
mov word [r13], di
mov eax, r12d
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x1400c6a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov edx, 6
add ax, 1
mov rcx, rbp
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov r12, rax
je 0x1400c6be2
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400c6be2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400c6be2
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400c6b26
nop
cmp rdi, r11
jae 0x1400c6be2
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400c6b10
cmp rdi, r11
jae 0x1400c6be2
movzx eax, word [rdi]
test ax, ax
je 0x1400c6be2
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1400c6b5c
mov edx, ebx
mov rcx, rsi
call fcn.140002be0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1400c6b79
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.14022ba40
test eax, eax
je 0x1400c6bb8
cmp eax, 0xc
je 0x1400c6bb2
cmp eax, 0x16
je 0x1400c6bac
cmp eax, 0x22
je 0x1400c6bac
cmp eax, 0x50
je 0x1400c6bb8
call fcn.1401fd6b8
int3
call fcn.1401fd6b8
int3
call fcn.1401fd670
int3
test ebx, ebx
js 0x1400c6bd7
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1400c6bd7
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x1400c6be4
mov ecx, 0x80070057
call fcn.140002bc0
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400e7520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1400e7689
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400e7689
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1400e7689
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400e75ba
cmp rdi, r11
jae 0x1400e7689
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1400e75a4
cmp rdi, r11
jae 0x1400e7689
movzx eax, word [rdi]
test ax, ax
je 0x1400e7689
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x140320670]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x1400e762a
mov edx, esi
mov rcx, rbp
call fcn.1400e76a0
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x140320670]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x1400e767e
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x1400e767e
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x1400e768b
mov ecx, 0x80070057
call fcn.140002bc0
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400e7800
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x14032f1f4], 0
je 0x1400e7817
mov eax, 1
add rsp, 0x28
ret
lea rcx, str.MaxxAudioAPOShell64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [0x14032f200], rax
je 0x1400e7a01
lea rdx, str.WavesFX_Initialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_Uninitialize
mov qword [0x14032f208], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_SetParameter
mov qword [0x14032f210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_GetParameter
mov qword [0x14032f218], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_GetParametersArray
mov qword [0x14032f220], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_SetParametersArray
mov qword [0x14032f228], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_SetProperty
mov qword [0x14032f230], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_GetProperty
mov qword [0x14032f238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_Preset_RegisterChangeNotification
mov qword [0x14032f240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_CreatePluginWindow
mov qword [0x14032f248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_DetachPluginWindow
mov qword [0x14032f250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_Preset_SaveDefault
mov qword [0x14032f258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_Preset_SetActive
mov qword [0x14032f260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_RegisterChangeNotification
mov qword [0x14032f268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_VendorSpecific
mov qword [0x14032f270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14032f200]
lea rdx, str.WavesFX_Preset_GetCount
mov qword [0x14032f278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14032f208], 0
mov qword [0x14032f288], rax
mov eax, dword [0x14032f1f4]
mov ecx, 1
cmovne eax, ecx
mov dword [0x14032f1f4], eax
add rsp, 0x28
ret
mov eax, dword [0x14032f1f4]
add rsp, 0x28
ret
Function at 0x14011cf30
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10040
call fcn.14024ccf0
sub rsp, rax
mov rax, qword [0x14031eda0]
xor rax, rsp
mov qword [rsp + 0x10020], rax
mov r8, qword [rcx + 0x118]
mov rbx, rcx
test r8, r8
jne 0x14011cf64
xor eax, eax
jmp 0x14011cfd6
mov r8, qword [r8 + 0x1ad0]
mov r10, qword [rcx + 0x110]
mov qword [rsp + 0x10068], rdi
test r8, r8
je 0x14011cfcc
nop
test r8, r8
mov r9, r8
je 0x14011d1a3
mov r9, qword [r9 + 0x10]
mov r8, qword [r8]
test r9, r9
je 0x14011cfc7
test r10, r10
je 0x14011d198
mov rax, qword [r9 + 0x28]
mov rdi, r10
sub rdi, rax
nop
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x14011cfc3
add rax, 2
test ecx, ecx
jne 0x14011cfb0
test edx, edx
je 0x14011cfef
test r8, r8
jne 0x14011cf80
xor eax, eax
mov rdi, qword [rsp + 0x10068]
mov rcx, qword [rsp + 0x10020]
xor rcx, rsp
call fcn.14022b9b0
add rsp, 0x10040
pop rbx
ret
lea rdx, [rbx + 0x4c8]
lea rcx, [r9 + 0xb8]
xor r8d, r8d
call sub.DSOUND.dll_DirectSoundCaptureCreate
test eax, eax
js 0x14011cfcc
mov eax, dword [rbx + 0x674]
mov qword [rsp + 0x10058], rbp
mov qword [rsp + 0x10060], rsi
mov qword [rsp + 0x10038], r12
mov ebp, 1
shl eax, 2
mov qword [rsp + 0x10030], r13
mov word [rbx + 0x670], 1
mov word [rbx + 0x67e], 0x10
mov dword [rbx + 0x678], eax
mov word [rbx + 0x672], 2
mov word [rbx + 0x67c], 4
lea r12, [rbx + 0x5e0]
lea rsi, [rbx + 0x4e0]
lea r13d, [rbp + 0xf]
nop
nop
nop
nop
mov edi, dword [rbx + 0x678]
xor edx, edx
xor r9d, r9d
shl edi, 3
xor r8d, r8d
shr edi, 4
imul edi, ebp
add edi, 0xffffffff
mov dword [rsi], edi
movzx ecx, word [rbx + 0x67c]
mov eax, dword [rbx + 0x678]
shl eax, 3
shr eax, 4
div ecx
xor ecx, ecx
sub edi, edx
xor edx, edx
mov dword [rsi], edi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
add rsi, 0x10
mov qword [r12], rax
mov qword [rsi - 8], rax
add ebp, 1
add r12, 8
sub r13, 1
jne 0x14011d080
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rdx, [rsp + 0x20]
mov ecx, 0x7fff
mov qword [rbx + 0x660], rax
mov dword [rbx + 0x5d0], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov r13, qword [rsp + 0x10030]
mov r12, qword [rsp + 0x10038]
mov rsi, qword [rsp + 0x10060]
mov rbp, qword [rsp + 0x10058]
je 0x14011cfcc
add eax, 0xffffffff
cmp word [rsp + rax*2 + 0x20], 0x5c
je 0x14011d152
lea r8, [0x140279558]
lea rcx, [rsp + 0x20]
mov edx, 0x7fff
call fcn.14022cd70
lea r8, str.MicCal.wav
lea rcx, [rsp + 0x20]
mov edx, 0x7fff
call fcn.14022cd70
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rbx + 0x690]
call fcn.14000b770
mov eax, 1
jmp 0x14011cfce
mov ecx, 0x80004005
call fcn.140002bc0
int3
call fcn.1401fd6b8
int3
Function at 0x14011d1b0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x70
cmp qword [rcx + 0x4c8], 0
mov rdi, rcx
jne 0x14011d1cb
xor eax, eax
add rsp, 0x70
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rsi
xor esi, esi
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.14011d410
mov ecx, 0xc8
call fcn.1401f0b44
test rax, rax
mov rbx, rax
je 0x14011d237
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0xc0], rsi
mov dword [rax + 0x38], esi
mov dword [rax + 0xa4], esi
jmp 0x14011d23a
mov rbx, rsi
test rbx, rbx
mov qword [rdi + 0x668], rbx
jne 0x14011d24d
xor eax, eax
jmp 0x14011d39d
mov rcx, qword [rdi + 0x690]
xor edx, edx
mov r8d, 0x11002
mov qword [rsp + 0x88], rbp
mov dword [rbx + 0xa0], 2
mov dword [rbx + 0xa4], esi
call qword [sym.imp.WINMM.dll_mmioOpenW]
test rax, rax
mov qword [rbx + 8], rax
je 0x14011d2a5
lea rbp, [rdi + 0x670]
mov rcx, rbx
mov rdx, rbp
call fcn.1401eb860
test eax, eax
jns 0x14011d2ac
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x14011d395
mov rcx, rbx
call fcn.1401eb600
test eax, eax
js 0x14011d2a5
mov eax, dword [rdi + 0x678]
mov rcx, qword [rdi + 0x4c8]
mov dword [rsp + 0x40], 0x28
shl eax, 3
mov qword [rsp + 0x50], rbp
lea r8, [rdi + 0x4d0]
mov dword [rsp + 0x48], eax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x98], r12
call qword [rax + 0x18]
test eax, eax
js 0x14011d38b
lea rbx, [rdi + 0x5e0]
mov ebp, 0x11
nop
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x14011d31e
call qword [sym.imp.KERNEL32.dll_ResetEvent]
add rbx, 8
sub rbp, 1
jne 0x14011d310
mov rcx, qword [rdi + 0x4d0]
lea r8, [rdi + 0x4d8]
lea rdx, [0x1402742f8]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14011d38b
mov rcx, qword [rdi + 0x4d8]
lea r8, [rdi + 0x4e0]
lea edx, [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x14011d38b
lea rcx, [0x14011d830]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
call fcn.140200e00
test rax, rax
mov rbp, rax
jne 0x14011d3b3
xor eax, eax
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rdi + 0x688]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rdi + 0x4d0]
xor edx, edx
mov r8, qword [rcx]
call qword [r8 + 0x48]
test eax, eax
setns sil
mov eax, esi
jmp 0x14011d38d
Function at 0x14011d410
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp qword [rcx + 0x688], rsi
mov dword [rsp + 0x30], esi
je 0x14011d47b
mov rcx, qword [rcx + 0x660]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x688]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14011d46e
cmp dword [rsp + 0x30], 0x103
jne 0x14011d46e
mov rcx, qword [rbx + 0x688]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x688]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x4d8]
mov qword [rbx + 0x688], rsi
test rcx, rcx
je 0x14011d49b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbx + 0x4d8], rsi
mov rcx, qword [rbx + 0x4d0]
test rcx, rcx
je 0x14011d4c6
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbx + 0x4d0]
test rcx, rcx
je 0x14011d4c6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbx + 0x4d0], rsi
mov rdi, qword [rbx + 0x668]
test rdi, rdi
je 0x14011d501
mov rcx, rdi
call fcn.1401eb6d0
cmp dword [rdi + 0xa4], esi
jne 0x14011d4f2
mov rcx, qword [rdi]
test rcx, rcx
je 0x14011d4f2
call fcn.1401f0b88
mov qword [rdi], rsi
mov rcx, rdi
call fcn.1401f0b88
mov qword [rbx + 0x668], rsi
mov rax, qword [rbx + 0x690]
lea rdi, [0x140275388]
mov ecx, 1
mov rsi, rax
repe cmpsw word [rsi], word [rdi]
je 0x14011d525
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x3b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401298d0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x58], edi
je 0x1401298f1
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
add rcx, 0x60
mov qword [rsp + 0x48], rsi
call fcn.14012aaf0
test eax, eax
jns 0x14012991a
mov rsi, qword [rsp + 0x48]
mov edi, 0x80004005
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0x98], rax
je 0x1401299ef
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0x88], rax
je 0x1401299ef
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0x90], rax
je 0x1401299ef
lea r8, [0x140129fb0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x80], rax
je 0x1401299ef
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1401299ef
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x90]
call qword [rax + 0x18]
test eax, eax
js 0x1401299ef
mov dword [rbx + 0xa8], 1
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1401299ef
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x88]
call qword [rax + 0x30]
test eax, eax
js 0x1401299ef
mov rcx, rbx
mov dword [rbx + 0xac], 1
call fcn.140129f60
mov rcx, rbx
mov dword [rbx + 0x58], 1
call fcn.140129e40
test eax, eax
jne 0x140129a35
cmp dword [rbx + 0x60], edi
je 0x140129a35
mov rcx, qword [rbx + 0x70]
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x40]
mov r9, qword [rcx]
lea edx, [rax + 1]
call qword [r9 + 0x18]
test eax, eax
js 0x140129a28
cmp dword [rsp + 0x40], edi
je 0x140129a35
lea rcx, str._ZZ__HWKWS::SetDefaultKeywordEnable___fail_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14012a400
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
mov edi, 1
xor esi, esi
cmp dword [rcx + 0x60], esi
je 0x14012a4ac
mov dword [rsp + 0x60], esi
mov rcx, qword [rcx + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
call qword [rax + 0x38]
mov edi, eax
test eax, eax
js 0x14012a443
cmp dword [rsp + 0x60], esi
je 0x14012a4ac
call fcn.1401ff164
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14012a462
mov ecx, 0x80004005
call fcn.140002bc0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov r8d, dword [rsp + 0x60]
lea rdx, str._ZZ__HWKWS::SetUserKeywordEnable__SetUserKeywordEnable_fail__nErrorCode___d_n
lea rcx, [rsp + 0x78]
call fcn.140003090
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14012a4ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x802f
mov rcx, qword [0x14032ef18]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rbx
call fcn.14012a6c0
mov dword [rbx + 0xb0], esi
mov dword [rsp + 0x70], esi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x14012a970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xa0], rax
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140132780
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x80
cmp qword [rcx + 0x90], 0
mov rsi, rcx
jne 0x1401327a1
xor eax, eax
add rsp, 0x80
pop rsi
ret
xor eax, eax
mov qword [rsp + 0x78], r12
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rcx + 0x298], r12
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.140132990
mov ecx, dword [rsi + 0x2a0]
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 0x28
lea r8, [rsi + 0x98]
xor r9d, r9d
imul ecx, dword [rsi + 0x240]
mul ecx
mov rcx, qword [rsi + 0x90]
shr edx, 6
lea rax, [rsi + 0x238]
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x18]
test eax, eax
jns 0x140132849
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x80
pop rsi
ret
mov eax, dword [rsi + 0x2a4]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
add eax, 1
mov edi, r12d
test eax, eax
jle 0x140132892
lea rbx, [rsi + 0x1a8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14013287e
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsi + 0x2a4]
add edi, 1
add rbx, 8
add eax, 1
cmp edi, eax
jl 0x140132870
mov rcx, qword [rsi + 0x98]
lea r8, [rsi + 0xa0]
lea rdx, [0x1402742f8]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x1401328ce
mov rcx, qword [rsi + 0xa0]
mov edx, dword [rsi + 0x2a4]
lea r8, [rsi + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jns 0x1401328d5
xor eax, eax
jmp 0x14013296a
lea rcx, [0x140132a90]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x98], rbp
mov dword [rsp + 0x20], 4
call fcn.140200e00
test rax, rax
mov rbp, rax
je 0x140132962
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x250]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsi + 0x98]
xor edx, edx
mov r8, qword [rcx]
call qword [r8 + 0x48]
test eax, eax
setns r12b
mov eax, r12d
mov rbp, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
add rsp, 0x80
pop rsi
ret