joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012280
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x130
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x40]
xor ebx, ebx
mov r9d, 0x20119
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareNVIDIA_CorporationGlobalNVTweak
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001233c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.EventLogging
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012331
mov ebx, dword [rsp + 0x30]
cmp ebx, 4
ja 0x140012331
call fcn.14004e890
mov ecx, 3
cmp ebx, ecx
cmovl ecx, ebx
mov dword [rax + 0x4000], ecx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [0x1400ca600]
lea r8, str.Instance_d
mov edx, 0x64
lea rcx, [rsp + 0x50]
call fcn.140004d50
call fcn.14004e890
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.14004f4c0
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140064920
add rsp, 0x130
pop rbx
ret
Function at 0x140012b00
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdx, [rsp + 0x50]
xor edi, edi
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
xor r9d, r9d
mov qword [rsp + 0x50], rdi
mov r8d, 0xf003f
call fcn.14004f9e0
test eax, eax
jne 0x140012cdb
mov rcx, qword [rsp + 0x50]
lea rdx, str.Tweak
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x48]
mov r9d, 0xf003f
mov qword [rsp + 0x28], rdi
lea rdx, str.Tweak
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x20], edi
call fcn.14004f980
test eax, eax
jne 0x140012cd0
mov r8d, dword [rbx + 8]
lea rdx, str.OpenOnMonGridId
mov rcx, qword [rsp + 0x48]
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.DetectPhyMon
mov rcx, qword [rsp + 0x48]
shr r8d, 4
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.EdgeSnap
mov rcx, qword [rsp + 0x48]
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.PinSnappedWindows
mov rcx, qword [rsp + 0x48]
shr r8d, 1
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.ModKeysForMaxClick
mov rcx, qword [rsp + 0x48]
shr r8d, 2
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.SystemMenu
mov rcx, qword [rsp + 0x48]
shr r8d, 7
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.TransparentDrag
mov rcx, qword [rsp + 0x48]
shr r8d, 8
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.BlockSpanning
mov rcx, qword [rsp + 0x48]
shr r8d, 9
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.BlockSpanningChild
mov rcx, qword [rsp + 0x48]
shr r8d, 0xa
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx]
lea rdx, str.CenterDialog
mov rcx, qword [rsp + 0x48]
shr r8d, 0xb
and r8d, 1
call fcn.14004ffa0
mov r8d, dword [rbx + 4]
lea rdx, str.PixelSnap
mov rcx, qword [rsp + 0x48]
call fcn.14004ffa0
mov r8d, dword [rbx + 8]
lea rdx, str.OpenOnMonGridId
mov rcx, qword [rsp + 0x48]
call fcn.14004ffa0
mov r8d, dword [rbx + 0xc]
lea rdx, str.OpenDialogOnMonGridId
mov rcx, qword [rsp + 0x48]
call fcn.14004ffa0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140012d00
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
xor r9d, r9d
mov qword [rsp + 0x38], 0
mov r8d, 0xf003f
lea rdx, [rsp + 0x38]
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
call fcn.14004f9e0
test eax, eax
jne 0x140012d7b
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbx
call fcn.14004fb70
mov rbx, rax
test rax, rax
je 0x140012d6b
lea rdx, str.GridSendTo
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.GridMax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140016320
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
call fcn.140017350
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0xf003f
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
call fcn.14004f9e0
test eax, eax
jne 0x14001639a
mov rcx, qword [rsp + 0x30]
lea rdx, str.DesktopManagement
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rax, qword [0x1400ca5a8]
mov rcx, qword [rax + 0x18]
add rcx, qword [0x1400ca5a0]
call fcn.14004abe0
mov rcx, qword [0x1400ca5a8]
mov rdx, qword [rsp + 0x30]
add rcx, 8
call fcn.14004dd50
mov rcx, qword [0x1400ca5a8]
mov rdx, qword [rsp + 0x30]
add rcx, 0x10
call fcn.1400490c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x28
ret

Function at 0x1400163b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
call fcn.14004d890
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x20]
call fcn.14004d3f0
call fcn.14004d890
mov ecx, eax
call fcn.14004da00
call fcn.140017350
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0xf003f
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
call fcn.14004f9e0
test eax, eax
jne 0x140016454
mov rcx, qword [rsp + 0x30]
lea rdx, str.DesktopManagement
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rax, qword [0x1400ca5a8]
mov rcx, qword [rax + 0x18]
add rcx, qword [0x1400ca5a0]
call fcn.14004abe0
mov rcx, qword [0x1400ca5a8]
mov rdx, qword [rsp + 0x30]
add rcx, 8
call fcn.14004dd50
mov rcx, qword [0x1400ca5a8]
mov rdx, qword [rsp + 0x30]
add rcx, 0x10
call fcn.1400490c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400413e0

Function at 0x140018a40
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x1400c4008]
test rbx, rbx
jne 0x140018a87
lea ecx, [rbx + 0x70]
call fcn.1400647cc
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140018a71
mov rcx, rax
call fcn.140017e30
mov rbx, rax
jmp 0x140018a73
xor ebx, ebx
mov qword [0x1400c4008], rbx
test rbx, rbx
jne 0x140018a87
xor eax, eax
add rsp, 0x40
pop rbx
ret
cmp qword [rbx], 0
jne 0x140018ac1
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [0x140019820]
xor r8d, r8d
mov edx, 0x800b
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov qword [rbx], rax
xor edx, edx
lea rcx, [0x140018b70]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, 1
add rsp, 0x40
pop rbx
ret
Function at 0x140022f30
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x88
cmp qword [0x1400c40d8], 0
jne 0x14002309a
lea rax, [0x140023630]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x50], rax
mov edx, 0x7f00
mov rax, qword [0x1400ca600]
xor ecx, ecx
mov qword [r11 - 8], rdi
xor edi, edi
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x58], rdi
mov qword [r11 - 0x48], rdi
mov qword [r11 - 0x38], rdi
mov qword [r11 - 0x20], rdi
call qword [sym.imp.USER32.dll_LoadCursorW]
lea ecx, [rdi + 4]
mov qword [rsp + 0x58], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
lea rsi, str.nViewGridOverlayMainClass
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_RegisterClassW]
xor r9d, r9d
mov dword [rsp + 0x90], edi
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400c40d0], rax
test rax, rax
je 0x14002303f
lea rax, [rsp + 0x90]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140023300]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x1400c40d0]
mov edx, 0x1388
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rbx, rbx
je 0x140023023
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400c40d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x98]
mov qword [0x1400c40d0], rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xa0]
mov qword [0x1400c40d8], rax
test rax, rax
jne 0x14002309a
call fcn.14004e890
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nView_nViewMainGridOverlay.cpp
lea rax, str.failed_to_create_manager_thread
mov edx, 1
mov qword [rsp + 0x28], rax
lea r8, str.GridOverlayManager::init
mov dword [rsp + 0x20], 0x2c2
call fcn.14004f020
add rsp, 0x88
ret
Function at 0x140025960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x140025994
movabs r10, 0x100000001b3
movzx edx, byte [r8 + rcx]
inc r8
xor rax, rdx
imul rax, r10
cmp r8, r9
jb 0x140025980
ret
Function at 0x1400296c0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x70
mov ebx, ecx
test ecx, ecx
jne 0x140029700
xorps xmm0, xmm0
lea r8d, [rcx + 1]
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov rax, qword [0x1400ca5a8]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov edx, dword [rax + 0x28]
call fcn.140061160
mov rax, qword [0x1400ca5a8]
or dword [rax + 0x60], 8
mov rcx, qword [0x1400ca5a8]
add rcx, 0x50
call fcn.140012b00
mov rcx, qword [0x1400ca5a8]
add rcx, 0x9214
call fcn.140012d00
call fcn.140015f40
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 8]
call fcn.140042350
test ebx, ebx
jne 0x1400297a5
cmp qword [0x1400ca5b8], 0
je 0x14002979b
call fcn.14004e890
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nView_nViewMainMainWindow.cpp
lea rax, str.trigger_Wow_shutdown
mov qword [rsp + 0x28], rax
lea r8, str.terminateNView
lea edx, [rbx + 3]
mov dword [rsp + 0x20], 0x99
call fcn.14004f020
mov rcx, qword [0x1400ca5b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x1400ca5b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140042260
call fcn.140018ae0
call fcn.14004ce50
call fcn.140023430
call fcn.14003df30
mov rcx, qword [0x1400c4158]
test rcx, rcx
je 0x1400297c5
call fcn.140012670
xor r9d, r9d
lea rdx, [rsp + 0x88]
mov r8d, 0xf003f
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
call fcn.14004f9e0
test eax, eax
jne 0x14002980b
mov rcx, qword [rsp + 0x88]
lea rdx, str.nViewNextLoaded
xor r8d, r8d
call fcn.14004ffa0
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1400ca5a8]
test byte [rax + 0x60], 4
je 0x14002982d
call fcn.140045210
mov rcx, rax
lea rdx, str.SoftwareNVIDIA_CorporationGlobal_nView
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add rsp, 0x70
pop rbx
ret
Function at 0x140029840
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rbp + 0x400], rax
lea r9, str.nView_WOW_Process_Shutdown_Event
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xorps xmm0, xmm0
mov qword [0x1400ca5b8], rax
xor eax, eax
lea rcx, [rbp + 0x1f0]
movups xmmword [rsp + 0x70], xmm0
xor ebx, ebx
xor edx, edx
movups xmmword [rbp - 0x60], xmm0
mov r8d, 0x208
mov qword [rbp - 0x30], rax
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x54], 1
movups xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x50], bx
movups xmmword [rbp - 0x40], xmm0
call fcn.140067170
mov edx, 0x208
lea rcx, [rbp + 0x1f0]
call fcn.140051ac0
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x208
call fcn.140067170
lea rax, [0x140096788]
mov edx, 0x208
lea r9, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s__runWow
lea rcx, [rbp - 0x20]
call fcn.140004da0
xor eax, eax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400299c5
mov rcx, qword [rsp + 0x50]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
je 0x1400299ab
call fcn.14004e890
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nView_nViewMain_nViewMain.cpp
lea rax, str.timeout_while_waiting_for_WOW_process_to_idle.
mov qword [rsp + 0x28], rax
lea r8, str.forkWowProcess
lea edx, [rbx + 2]
mov dword [rsp + 0x20], 0xb0
call fcn.14004f020
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140029a04
call fcn.14004e890
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nView_nViewMain_nViewMain.cpp
lea rax, [rbp - 0x20]
mov edx, 1
mov qword [rsp + 0x30], rax
lea r8, str.forkWowProcess
lea rax, str.failed_to_launch_32_bit_Wow__s
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xb5
call fcn.14004f020
xor al, al
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140064920
mov rbx, qword [rsp + 0x520]
add rsp, 0x510
pop rbp
ret
Function at 0x14002f5e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400c4168], rax
test rax, rax
je 0x14002f79b
xor esi, esi
mov dword [rsp + 0x30], esi
mov ecx, 0xb70
call fcn.1400647cc
mov rbx, rax
test rax, rax
je 0x14002f64e
mov rcx, rax
mov rdx, rdi
mov r8d, 0xb70
call fcn.140066d60
jmp 0x14002f651
mov rbx, rsi
mov qword [rsp + 0x48], rsi
mov eax, 7
mov qword [rsp + 0x50], rax
mov word [rsp + 0x38], si
test rbx, rbx
je 0x14002f6be
lea r8d, [rax + 0x26]
lea rdx, str.NVIDIA_RTX_Desktop_Manager_Profile_App_Loader
lea rcx, [rsp + 0x38]
call fcn.14000a2d0
mov r8d, 1
lea rdx, [0x1400aed00]
lea rcx, [rsp + 0x38]
call fcn.14000baf0
lea rdx, [rbx + 0xa0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002f6a4
lea rcx, [rsp + 0x38]
call fcn.14000baf0
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x38]
cmp rax, 8
cmovae rdx, qword [rsp + 0x38]
lea rcx, str.LoadingProfileAppClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14002f749
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x14002f360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x14002f749
mov edx, 0x1388
mov rcx, qword [0x1400c4168]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
lea rcx, str.LoadingProfileAppClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rdi + 0xb60], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400c4168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400c4168], rsi
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14002f79b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f796
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f7bb
call fcn.140064808
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140064920
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
call fcn.14006b51c
int3
Function at 0x140031e20
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0xb60]
sub rsp, 0xc60
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rbp + 0xb50], rax
mov rax, qword [rcx + 0x60]
lea rbx, [rcx + 0x60]
mov r10, rdx
mov qword [rbx + 8], rax
lea rax, [rsp + 0x30]
xor r14d, r14d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rdx, str.AutoRunAppsV4
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140032030
mov rcx, qword [rsp + 0x30]
lea r9d, [r14 + 0x50]
mov qword [rsp + 0xc90], rsi
lea r8, [rbp + 0xab0]
xor edx, edx
mov esi, r14d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x14003201d
mov qword [rsp + 0xc98], rdi
lea rax, [rbp - 0x20]
lea rdi, [rbp + 0xab0]
sub rdi, rax
nop dword [rax + rax]
lea rcx, [rbp + 0xa60]
mov word [rsp + 0x40], r14w
mov word [rbp - 0x20], r14w
mov word [rbp + 0x80], r14w
mov word [rbp + 0x148], r14w
mov word [rbp + 0x350], r14w
mov word [rbp + 0x558], r14w
mov word [rbp + 0x800], r14w
mov word [rbp + 0x760], r14w
mov word [rbp + 0xa0c], r14w
mov dword [rbp + 0xa08], r14d
mov dword [rbp + 0xa5c], r14d
mov dword [rbp + 0xa80], r14d
mov qword [rbp + 0xa88], r14
call qword [sym.imp.USER32.dll_SetRectEmpty]
lea rcx, [rbp + 0xa70]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
xorps xmm0, xmm0
mov word [rbp + 0xa90], r14w
lea rdx, [rbp + 0xab0]
movdqa xmmword [rbp + 0xaa0], xmm0
mov qword [rbp + 0xa98], r14
call fcn.1400460c0
mov edx, 0x50
lea rax, [rbp - 0x20]
lea rcx, [rdx + 0x7fffffae]
test rcx, rcx
je 0x140031fa4
movzx ecx, word [rdi + rax]
test cx, cx
je 0x140031fa4
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140031f82
test rdx, rdx
lea rcx, [rax - 2]
cmovne rcx, rax
mov word [rcx], r14w
lea rcx, [rsp + 0x40]
call fcn.14002a8e0
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140031fe4
mov rcx, rdx
mov r8d, 0xb70
lea rdx, [rsp + 0x40]
call fcn.140066d60
add qword [rbx + 8], 0xb70
jmp 0x140031ff1
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.140030ad0
mov rcx, qword [rsp + 0x30]
lea r8, [rbp + 0xab0]
inc esi
mov r9d, 0x50
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x140031ed0
mov rdi, qword [rsp + 0xc98]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0xc90]
mov rcx, qword [rbx + 8]
movabs rax, 0x2cc3d8d4a245f203
sub rcx, qword [rbx]
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
setne al
mov rcx, qword [rbp + 0xb50]
xor rcx, rsp
call fcn.140064920
add rsp, 0xc60
pop r14
pop rbx
pop rbp
ret
Function at 0x1400336c0
Capabilities:
Check for foreground window switch

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r15
sub rsp, 0x20
mov rbx, rcx
xor r15d, r15d
mov rcx, qword [rcx + 0x60]
movabs r12, 0x2cc3d8d4a245f203
mov rax, r12
xor bpl, bpl
mov esi, r15d
mov rdx, qword [rbx + 0x68]
sub rdx, rcx
imul rdx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test edx, edx
jle 0x140033824
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov r14d, r15d
nop dword [rax]
imul rdi, r14, 0xb70
cmp qword [rdi + rcx + 0xb58], r15
jne 0x1400337ac
mov rcx, qword [rdi + rcx + 0xb60]
test rcx, rcx
je 0x1400337ac
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400337ac
mov rcx, qword [rbx + 0x60]
xor r9d, r9d
movsxd rax, esi
imul rdx, rax, 0xb70
lea r8, [rcx + 0xb58]
mov rcx, qword [rcx + rdi + 0xb60]
add r8, rdx
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400337a9
mov byte [rbx + 0x58], 1
xor r9d, r9d
mov rcx, qword [rbx + 0x60]
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rdi + rcx + 0xb60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rbx + 0x60]
mov qword [rdi + rax + 0xb60], r15
jmp 0x1400337ac
mov bpl, 1
mov r8, qword [rbx + 0x68]
mov rax, r12
mov rcx, r8
sub rcx, qword [rbx + 0x60]
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
dec edx
cmp esi, edx
jne 0x1400337f2
test bpl, bpl
je 0x1400337f2
mov esi, 0xffffffff
xor bpl, bpl
mov r14, 0xffffffffffffffff
lea ecx, [rsi + 0xb]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, qword [rbx + 0x68]
mov rcx, qword [rbx + 0x60]
mov rax, r12
sub r8, rcx
inc esi
imul r8
inc r14
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp esi, edx
jl 0x140033720
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rsi
jmp fcn.140031370
Function at 0x14003a610
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003a6e4
cmp byte [rcx + 0x72], 0
je 0x14003a6e4
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14003a6e0
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14003a6a6
sub eax, 1
je 0x14003a6aa
cmp eax, 2
jne 0x14003a6e0
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140064920
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14003a6d7
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1400738f8
cmp rdi, rax
jne 0x14003a6e0
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14003a68e
xor al, al
jmp 0x14003a68e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140064920
add rsp, 0x60
pop rbx
ret
Function at 0x14003b720
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14003b751
xor eax, eax
jmp 0x14003b89f
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14003b78e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14003b78e
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14003b89f
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14003b894
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14003b7d5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003b7fe
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140072b48
cmp ax, di
je 0x14003b894
movzx edi, si
jmp 0x14003b894
lea r8, [rsp + 0x48]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x14003b894
cmp eax, 1
jle 0x14003b854
cmp eax, 3
jne 0x14003b894
movzx ecx, word [rsp + 0x40]
jmp 0x14003b7e1
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14003b881
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.1400738f8
cmp rbp, rax
jne 0x14003b894
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, si
jne 0x14003b897
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140064920
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret