joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14053f2f8
Capabilities:
Get number of processors

Disassembly:
test di, r10w
not di
mov r10, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x1cf0ab74
movabs rcx, 0x619b4ea469d71706
not rcx
setb r8b
cmp r8w, 0x282d
push r11
not cx
movabs r11, 0x43f61657419111fe
movzx ecx, cl
push r9
not r11
push r15
movabs r9, 0x59ca19364969309c
not dil
push rbx
call fcn.140a568ba

Function at 0x140563f56
Capabilities:
Encrypt data using rc4 prga

Disassembly:
seto byte [rsp + 0x68]
sub rcx, r10
neg dword [rsp + 0x50]
mov word [rsp + 0x40], 0x4108
or byte [rsp + 0x70], 0xea
neg byte [rsp + 0x70]
add r10, qword [rsp + 0x68]
setle byte [rsp + 0x70]
seto r10b

Function at 0x140588dcd
Capabilities:
Get number of processors

Disassembly:
call fcn.140a86ade
not bl
add bx, 0x7b52
jb 0x140ad2957
neg r13
mov bx, 0x3837
jns 0x1405ff84d
mov r13, qword [rsp + 0x28]
add ebx, 0x78394f46
and rbx, 0x339a6c73
call fcn.14053155a
call fcn.14053f350
adc edi, edi
invalid

Function at 0x1405e883f
Capabilities:
Encode data using xor

Disassembly:
push r13
call int.1405c87e4
push r12
push r11
push r10
push rsi
push r12
push 0x48b44e59
push r14
push r14
movabs r10, 0x152d7a6007af7d3b
mov r11, rdx
push rcx
mov r11b, dl
push r9
sete r14b
neg dx
xor r12, r11
neg r10w
seta byte [rsp + 0x10]
mov r10, qword [rsp + 0x30]
call fcn.140a611d7
jl 0x1405e88dd
wait
mov al, 0x94
push rax
jb 0x1405e884c
mov ch, 0xe0
xor al, 0xfc
and byte [rdx - 0x4c], cl
push rcx
ja 0x1405e881f
push 0xffffffffb5c0f448
cmp al, cl
invalid
lea esp, [rax - 0x308d7a92]
push 0x2a
adc al, 0x24
xchg esp, eax
xor dl, ch
invalid

Function at 0x14061c59b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jg 0x140591ae5
xor r9d, r9d
mov bpl, r11b
xor r12w, r11w
lea r11, [r9 + rbp*8 + 0x7d422c0]
xor r11b, 0xde
not r14d
add qword [rsp], 0x5009a2
not r12
cmp bp, 0x4d66
not r9b
ret 8

Function at 0x140621bc7
Capabilities:
Encode data using xor

Disassembly:
push r11
seta r8b
add byte [rsp + 0x38], 0x94
mov edi, 0x330e03c2
neg rdi
or qword [rsp + 0x38], 0x70160bf8
mov r11, qword [rsp + 0x38]
bswap r11d
mov bp, 0x33f9
xor r8d, dword [rsp + 0x38]
and qword [rsp + 0x38], 0x4f0a35a0
mov dword [rsp + 0x38], r11d
push rcx
test qword [rsp + 0x40], rbp
movsx r11d, bpl
mov r8d, dword [rsp + 0x42]
je 0x140621bcd
xor rdi, qword [rsp + 0x40]
add dil, 0x6b
neg r14d
push r14
mov rbp, qword [rsp + 0x40]
and r11w, word [rsp + 0x4d]
movabs rcx, 0x3be925133af8590b
bswap r14
neg r14d
sub r8w, 0x6cd5
xor rcx, qword [rsp]
sub dword [rsp], 0x19064ff
test ecx, 0x1cec6be7
call fcn.14052a6a9
bswap r14d
cmp r14d, edi
call fcn.1405cb59f
invalid
Function at 0x140636d16
Capabilities:
Encode data using xor

Disassembly:
cmp cl, 0xb6
lea rcx, [rcx*2 + 0x77ff7f92]
lea rdx, [r9 + r9*4 + 0x9c302d9]
jae fcn.140532e0f
jno 0x14067cf7d
call fcn.140553aa1
test rcx, rdx
jg 0x14055907b
lea r15, [r9 + 0x27ef79d5]
mov rsi, qword [rsp + 0x38]
bswap r9d
movabs r15, 0x1f2c77ef3d5d4e22
not cx
movzx r9d, cx
setns r9b
xor r15, 0x33d77451
mov cx, 0x5e31
xor rcx, 0x329e6f23
cmp r15w, 0x406b
jae 0x140567c6d
add r15b, cl
call fcn.140567c2e
not r12b
mov r12, qword [rsp + 8]
and r15b, r15b
pop r9
not esi
test dword [rsp + 0x28], r15d
call fcn.140675248
cmovne r9, rdx
jne 0x140554fb3

Function at 0x14063b82a
Capabilities:
Check http status code

Disassembly:
test r9d, esi
mov r9, qword [rsp + 0x48]
not si
not word [rsp + 0x28]
mov esi, dword [rsp + 0x2a]
not esi
sets sil
call fcn.140593c8c
jg 0x14054c71b

Function at 0x140675296
Capabilities:
Encode data using xor

Disassembly:
jae 0x1405cc579
jno 0x1405cc56c
int 0xa3
or esi, dword [rcx + 0x56]
leave
clc
add cl, byte [rdi]
imul byte [rdi + rdx*2 + 0x1d880e76]
sti
invalid

Function at 0x140a620d3
Capabilities:
Get number of processors

Disassembly:
not cl
lea r11, [r9*4 + 0x141f10fe]
bswap ecx
jne 0x140a95726
neg r13b

Function at 0x140a6b389
Capabilities:
Encode data using xor

Disassembly:
lea rbx, [rbx + 0x279e1c75]
jl 0x140a81b73

Function at 0x140aab96f
Capabilities:
Get number of processors

Disassembly:
lea r8, [r9 + rbx*8 + 0x2c3a0c3a]
movsxd r8, ebx
test r8w, bx
bswap r8d
not r8w
sete r8b
movzx rcx, bl
sub r9w, bx
ja 0x140a95732

Function at 0x140abf8df
Capabilities:
Encode data using xor

Disassembly:
test byte [rsp + 0x38], 0xe6
jne 0x1406256a1
test dword [0xd06103b9], edi
nop
cmpsb byte [rsi], byte [rdi]
xor eax, 0xdf2ceaec
xor al, 5
jg 0x14061025f
fimul dword [rdx + 0x7b]
mov ebp, 0xcdb5a01e
ja 0x140610274
invalid
fbstp tbyte [rbx + rdi*4]
pop rcx
xchg esp, eax
pop rax
mov ah, 0xad
movabs byte [0xcba117e7ddcad5b8], al
jle 0x1406102b4
sub al, 0x35
invalid
iretd
bswap r13
js 0x140610259
mov r15, qword [rsp + 0x58]
movzx r15, byte [rsp + 0x58]
xor r13, qword [rsp + 0x58]
mov r13, qword [rsp + 0x40]
not word [rsp + 0x58]
neg si
test word [rsp + 0x58], 0xf66
lea rsp, [rsp + 0x10]
ret 8
Function at 0x140005be0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r9
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rdi
call fcn.140004f00
mov rcx, rax
test rax, rax
je 0x140005dd3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r9, rbx
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400dea78]
lea rcx, [rsp + 0x38]
call fcn.140006c20
mov rsi, qword [rsi + 8]
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x140005c89
mov r8d, 0xf0
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14005c7e0
jmp 0x140005d9c
test rbp, rbp
jne 0x140005c96
mov r8d, 0xf1
jmp 0x140005c71
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14007d560
test eax, eax
jne 0x140005ceb
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.14007c830
test eax, eax
jne 0x140005ceb
mov r8d, 0xfa
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14005c7e0
nop
jmp 0x140005d9c
mov r9d, 2
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140026e20
test eax, eax
je 0x140005d31
mov r8d, 0xff
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14005c7e0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140005d9c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x140005d9c
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 3
xor r8d, r8d
mov rdx, rbp
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x140005d89
mov r8d, 0x103
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14005c7e0
nop
test rsi, rsi
je 0x140005d9c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x140005d9c
test rsi, rsi
je 0x140005d97
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, 1
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140005db9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ba610
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140005030
int3
Function at 0x14000d490
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor edi, edi
add rcx, 8
mov dword [rcx + 0x28], edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
mov qword [rbx + 0x38], rdi
lea rax, vtable.CAsyncEventNotifyBase.0
mov qword [rbx], rax
lea r8, [0x14000d690]
mov qword [rbx + 0x40], rdi
lea rax, [rsp + 0x30]
mov dword [rbx + 0x48], edi
mov r9, rbx
mov dword [rbx + 0x4c], 2
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov dword [rbx + 0x78], 0xa
mov dword [rsp + 0x30], edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx + 0x38], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbx + 0x40], rax
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ba610
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000d810
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.14000b1e0
mov ecx, 0x3100
cmp word [rax + 0x342], cx
je 0x14000d846
call fcn.14000b1e0
mov ecx, 0x1179
cmp word [rax + 0x342], cx
jne 0x14000d872
mov r9d, dword [rdi + 0x48]
test r9d, r9d
je 0x14000d872
mov r8d, 0x61
lea rdx, str.CAsyncEventNotifyBase::PostEvent
lea rcx, str._s__d_m_bStop_d__return
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14005c7e0
lea rcx, [rdi + 8]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea rcx, [rdi + 0x50]
mov rdx, rsi
call fcn.14000d8c0
lea rcx, [rdi + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x40]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
Function at 0x1400127b0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
sub rsp, 0x28
mov rsi, rdx
test rdx, rdx
lea rdx, str.CAudioDeviceMuteStateHandler::OnRemoveDevice
mov rbp, rcx
jne 0x1400127e1
mov r8d, 0x1a3
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.14005c7e0
mov qword [rsp + 0x40], rbx
lea rcx, [0x1400deb00]
mov r8d, 0x1a5
mov qword [rsp + 0x58], rdi
call fcn.14005c7e0
cmp dword [rbp + 0x78], 0
mov edi, 0xffffffff
je 0x1400128ab
mov rdx, qword [rsi + 0x168]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], r14
call fcn.140004560
mov r14, rax
mov rcx, qword [rax]
cmp dword [rcx - 0x10], 0
jge 0x140012832
mov ebx, edi
jmp 0x140012850
lea rdx, str.0.0.0.00000000
call fcn.1400c08b0
mov rbx, rax
test rax, rax
jne 0x14001284a
mov ebx, edi
jmp 0x140012850
sub rbx, qword [r14]
sar rbx, 1
mov rdx, qword [rsp + 0x48]
mov eax, edi
shr ebx, 0x1f
xor bl, 1
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
mov r14, qword [rsp + 0x20]
sub eax, 1
jg 0x140012879
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x1400128ab
call fcn.14000b1e0
mov ebx, dword [rax + 0x2dc]
call fcn.14000b630
mov edx, 0x3fd
mov rcx, rax
mov r8d, 0x1f4
test bl, 0xf
jne 0x1400128a6
mov r8d, 0xc8
call fcn.1400afb90
cmp dword [rbp + 0x74], 0
je 0x140012948
mov rdx, qword [rsi + 0x168]
lea rcx, [rsp + 0x50]
call fcn.140004560
mov rsi, rax
mov rcx, qword [rax]
cmp dword [rcx - 0x10], 0
jge 0x1400128d6
mov ebx, edi
jmp 0x1400128f4
lea rdx, str.0.0.1.00000000
call fcn.1400c08b0
mov rbx, rax
test rax, rax
jne 0x1400128ee
mov ebx, edi
jmp 0x1400128f4
sub rbx, qword [rsi]
sar rbx, 1
mov rdx, qword [rsp + 0x50]
shr ebx, 0x1f
xor bl, 1
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140012916
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x140012948
call fcn.14000b1e0
mov ebx, dword [rax + 0x2dc]
call fcn.14000b630
mov edx, 0x3fe
mov rcx, rax
mov r8d, 0x1f4
test bl, 0xf
jne 0x140012943
mov r8d, 0xc8
call fcn.1400afb90
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x28
pop rsi
pop rbp
ret
Function at 0x140015450
Capabilities:
Print debug messages

Disassembly:
push rbx
push rsi
sub rsp, 0x28
cmp dword [rcx + reloc.OLEAUT32.dll_LPSAFEARRAY_UserUnmarshal], 0
mov rsi, rdx
mov rbx, rcx
je 0x14001549e
mov r8d, 0x2f
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14005c7e0
mov r8d, 0xef
lea rdx, str.CAudioDeviceSessionEvents::AddNewAudioSession
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.14005c7e0
mov qword [rsp + 0x50], rdi
mov eax, 1
lock xadd dword [rcx + 0x120], eax
mov ecx, 0x30
call fcn.1400bac44
mov rdi, rax
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rax
lea rax, vtable.CAudioSessionEvents.0
mov qword [rdi], rax
call fcn.140004f00
mov rcx, rax
test rax, rax
je 0x14001566d
mov rax, qword [rax]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x20], r14
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor r14d, r14d
mov r8, rbx
add rax, 0x18
mov rdx, rsi
mov qword [rdi + 0x28], rax
mov rcx, rdi
mov qword [rdi + 8], r14
mov qword [rdi + 0x18], r14
mov qword [rdi + 0x20], r14
call fcn.14001bc60
lea rsi, [r14 - 1]
test eax, eax
je 0x14001561c
mov rbp, qword [rbx + 0x140]
cmp qword [rbx + 0x158], r14
jne 0x1400155d1
mov ecx, dword [rbx + 0x160]
test rcx, rcx
jne 0x140015558
mov ecx, r14d
jmp 0x140015572
xor edx, edx
mov rax, rsi
div rcx
cmp rax, 0x18
jb 0x140015662
lea rcx, [rcx + rcx*2]
shl rcx, 3
add rcx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140015662
mov rcx, qword [rbx + 0x150]
mov qword [rax], rcx
mov qword [rbx + 0x150], rax
mov r8d, dword [rbx + 0x160]
lea ecx, [r8 - 1]
lea rdx, [rcx*2 + 1]
add rdx, rcx
sub r8d, 1
lea rdx, [rax + rdx*8]
js 0x1400155d1
mov rax, qword [rbx + 0x158]
mov qword [rdx], rax
mov qword [rbx + 0x158], rdx
sub rdx, 0x18
sub r8d, 1
jns 0x1400155b6
mov rcx, qword [rbx + 0x158]
mov rax, qword [rcx]
mov qword [rcx + 0x10], rdi
mov qword [rbx + 0x158], rax
mov qword [rcx + 8], rbp
mov qword [rcx], r14
inc qword [rbx + 0x148]
mov rax, qword [rbx + 0x140]
test rax, rax
je 0x14001560c
mov qword [rax], rcx
mov qword [rbx + 0x140], rcx
jmp 0x140015624
mov qword [rbx + 0x138], rcx
mov qword [rbx + 0x140], rcx
jmp 0x140015624
mov rcx, rdi
call fcn.1400151a0
lock xadd dword [rbx + 0x120], esi
mov eax, dword [rbx + 0x120]
test eax, eax
jne 0x14001564c
cmp dword [rbx + reloc.OLEAUT32.dll_LPSAFEARRAY_UserUnmarshal], r14d
je 0x14001564c
mov rcx, qword [rbx + 0x118]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop rsi
pop rbx
ret
mov ecx, 0x8007000e
call fcn.140005030
int3
mov ecx, 0x80004005
call fcn.140005030
int3
Function at 0x140019e60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 0xc8]
lea r15, [rcx + 0x98]
mov rbx, qword [r15]
test rbx, rbx
je 0x140019ecf
test r14, r14
je 0x140019ecf
test rbx, rbx
je 0x140019f12
mov rdi, qword [r14 + 0x10]
mov rsi, qword [rbx + 0x10]
mov rcx, rdi
mov rbx, qword [rbx]
mov r14, qword [r14]
mov rax, qword [rdi]
mov rdx, qword [rsi]
call qword [rax + 0x38]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov edx, 8
mov rcx, rsi
call fcn.1400ba63c
test rbx, rbx
jne 0x140019e90
mov rcx, r15
call fcn.14000c270
mov rcx, r15
call fcn.14000c270
mov r8d, 0x20a
lea rdx, str.CAudioModuleAPIBase::UnregisterAllAudioDeviceModuleManagerEvent
lea rcx, [0x1400deb00]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
jmp fcn.14005c7e0
mov ecx, 0x80004005
call fcn.140005030
int3

Function at 0x14001cad0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rbp, r9
mov ecx, BSTR_UserUnmarshal
mov ebx, r8d
mov rdi, rdx
call fcn.1400bac44
xor edx, edx
mov r8d, BSTR_UserMarshal
mov rsi, rax
lea rcx, [rax + 2]
call fcn.1400c0ee0
mov word [rsi], bx
test rdi, rdi
je 0x14001cb62
lea rax, [rsi + 2]
mov edx, 0x7f
sub rdi, rax
nop dword [rax + rax]
lea rcx, [rdx + 0x7fffff7f]
test rcx, rcx
je 0x14001cb54
movzx ecx, word [rdi + rax]
test cx, cx
je 0x14001cb54
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x14001cb30
jmp 0x14001cb59
test rdx, rdx
jne 0x14001cb5d
sub rax, 2
xor ecx, ecx
mov word [rax], cx
movaps xmm0, xmmword [rbp]
mov rdx, rsi
mov eax, dword [rbp + 0x10]
mov rcx, r14
movups xmmword [rsi + 0x104], xmm0
mov dword [rsi + 0x114], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14000d810
Function at 0x14001cd40
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp r8d, 0x16
jne 0x14001cd84
mov rax, qword [rsp + 0x60]
lea rdx, str.CBackgroundAdminProcMain::OnWindowsMessage
mov r8d, 0x27
mov qword [rsp + 0x20], rax
lea rcx, str._s__d_WM_ENDSESSION_wParam_d_lParam_d
call fcn.14005c7e0
call fcn.140014060
mov rcx, rax
add rsp, 0x30
pop rbx
jmp 0x140096090
cmp r8d, 0x10
jne 0x14001cdf1
mov rax, qword [rsp + 0x60]
lea rdx, str.CBackgroundAdminProcMain::OnWindowsMessage
mov r8d, 0x2d
mov qword [rsp + 0x20], rax
lea rcx, str._s__d_WM_CLOSE_wParam_d_lParam_d_Start
call fcn.14005c7e0
add rbx, 0xffffffffffffffe0
mov rcx, rbx
call fcn.14001d470
test rbx, rbx
je 0x14001cdd3
mov rcx, rbx
call fcn.14001cca0
mov edx, 0x50
mov rcx, rbx
call fcn.1400ba63c
mov r8d, 0x30
lea rdx, str.CBackgroundAdminProcMain::OnWindowsMessage
lea rcx, str._s__d_WM_CLOSE_end
add rsp, 0x30
pop rbx
jmp fcn.14005c7e0
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
lea rsi, [rcx + 0xb8]
lea r14, [rcx + 0xe8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rbx, qword [r14]
test rbx, rbx
je 0x14009611b
mov rdi, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rdi, rdi
je 0x140096116
cmp dword [0x140158e54], 0
jne 0x1400960fa
cmp dword [0x140158e50], 0
jne 0x1400960fa
cmp dword [0x140158e58], 0
jne 0x1400960fa
mov rdx, qword [rdi + 0x800]
xor r8d, r8d
call fcn.140095c30
cmp qword [rdi + 0x810], 0
je 0x140096116
mov rcx, qword [rdi + 0x7e0]
test rcx, rcx
je 0x140096116
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test rbx, rbx
jne 0x1400960c4
mov rcx, r14
call fcn.14000c270
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]

Function at 0x14001d920
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp r8d, 0x16
jne 0x14001d964
mov rax, qword [rsp + 0x60]
lea rdx, str.CBackgroundProcMain::OnWindowsMessage
mov r8d, 0x2e
mov qword [rsp + 0x20], rax
lea rcx, str._s__d_WM_ENDSESSION_wParam_d_lParam_d
call fcn.14005c7e0
call fcn.140014060
mov rcx, rax
add rsp, 0x30
pop rbx
jmp 0x140096090
cmp r8d, 0x10
jne 0x14001d9d1
mov rax, qword [rsp + 0x60]
lea rdx, str.CBackgroundProcMain::OnWindowsMessage
mov r8d, 0x34
mov qword [rsp + 0x20], rax
lea rcx, str._s__d_WM_CLOSE_wParam_d_lParam_d_Start
call fcn.14005c7e0
add rbx, 0xffffffffffffffe0
mov rcx, rbx
call fcn.14001ed10
test rbx, rbx
je 0x14001d9b3
mov rcx, rbx
call fcn.14001d880
mov edx, 0x108
mov rcx, rbx
call fcn.1400ba63c
mov r8d, 0x37
lea rdx, str.CBackgroundProcMain::OnWindowsMessage
lea rcx, str._s__d_WM_CLOSE_end
add rsp, 0x30
pop rbx
jmp fcn.14005c7e0
add rsp, 0x30
pop rbx
ret
Function at 0x140021da0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rbp, rdx
mov r15, rcx
call fcn.140004f00
mov rcx, rax
test rax, rax
je 0x140021fd0
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
xor r13d, r13d
mov dword [rsp + 0x38], r13d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
lea r14, [r13 - 1]
test eax, eax
jne 0x140021f92
cmp dword [rsp + 0x40], 7
jne 0x140021f92
mov edi, dword [rsp + 0x38]
shr edi, 1
je 0x140021f92
mov ecx, edi
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400bac3c
mov r12, rax
test rax, rax
je 0x140021f92
cmp edi, 2
jb 0x140021f89
lea r8d, [rdi + rdi]
mov dword [rsp + 0x3c], r8d
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140021f89
cmp dword [rsp + 0x44], 7
jne 0x140021f89
mov eax, dword [rsp + 0x3c]
test al, 1
jne 0x140021f89
mov ebp, eax
shr ebp, 1
cmp ebp, 1
jb 0x140021f89
shr rax, 1
cmp word [r12 + rax*2 - 2], r13w
jne 0x140021f89
cmp ebp, 1
jbe 0x140021eea
cmp word [r12 + rax*2 - 4], r13w
jne 0x140021f89
mov edi, r13d
test ebp, ebp
je 0x140021f89
nop word [rax + rax]
mov eax, edi
lea rdx, [r12 + rax*2]
cmp r13w, word [rdx]
jne 0x140021f13
mov eax, 1
jmp 0x140021f7f
test rdx, rdx
jne 0x140021f1d
mov eax, r13d
jmp 0x140021f2a
mov rax, r14
inc rax
cmp word [rdx + rax*2], r13w
jne 0x140021f20
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140004940
mov rbx, qword [rsp + 0x48]
movzx eax, word [rbx]
cmp ax, word [0x1400deef8]
je 0x140021f7c
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CLSIDFromString]
mov rdx, qword [rsi + 8]
cmp qword [rsi + 0x10], rdx
je 0x140021f6f
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdx], xmm0
add qword [rsi + 8], 0x10
jmp 0x140021f7c
lea r8, [rsp + 0x50]
mov rcx, rsi
call fcn.140026980
mov eax, dword [rbx - 0x10]
add edi, eax
cmp edi, ebp
jb 0x140021f00
mov rcx, r12
call fcn.1400ba63c
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140021fab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ba610
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140005030
int3