joyce8/EMBER2024-capa huggingface dataset:
Function at 0x171b25450
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x78
xor ebx, ebx
lea rdx, [rbp - 0x20]
mov ecx, 0x2001f
mov qword [rbp - 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rbx
lea rdx, str.SoftwareMicrosoftWindowsDWM
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jg 0x171b324f2
js 0x171b25520
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.AccentColor
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x28]
lea r9, [rbp + 0x30]
lea r8, str.ColorPrevalence
mov dword [rbp + 0x30], ebx
xor edx, edx
call fcn.171b0235c
test eax, eax
js 0x171b32501
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x20]
mov dword [rbp + 0x28], 1
test rcx, rcx
je 0x171b2554b
lea r9, [rbp + 0x28]
lea r8, str.SystemUsesLightTheme
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
call fcn.171b0235c
test eax, eax
jns 0x171b2558f
mov r8d, 2
mov dword [rbp + 0x28], r8d
mov edx, dword [rbp + 0x18]
movzx ecx, dx
shr ecx, 8
movzx eax, dl
shl eax, 8
or ecx, eax
shr edx, 0x10
shl ecx, 8
movzx eax, dl
or ecx, eax
or ecx, 0xc4000000
call fcn.171b2559c
lea rcx, [rbp - 0x20]
call fcn.171b08884
xor eax, eax
add rsp, 0x78
pop rbx
pop rbp
ret
mov r8d, dword [rbp + 0x28]
jmp 0x171b25555
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x171b254bc
lea rdx, [rbp - 0x18]
mov dword [rbp + 0x20], ebx
mov ecx, 0x2001f
mov qword [rbp - 0x18], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
lea r8, str.ColorPrevalence
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
call fcn.171b0235c
mov ecx, dword [rbp + 0x20]
lea rdx, str.ColorPrevalence
test eax, eax
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x20]
mov r9d, 4
cmovs ecx, ebx
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], ecx
xor r8d, r8d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
lea rcx, [rbp - 0x18]
call fcn.171b08884
nop
jmp 0x171b25510
Function at 0x171b25668
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor ebx, ebx
mov rdi, rcx
cmp dword [0x171b932e4], ebx
jne 0x171b2578b
mov edx, 0x2001f
lea rcx, [rsp + 0x50]
call fcn.171b088b4
mov rax, qword [0x171b934f8]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov rcx, qword [rsp + 0x50]
test rax, rax
cmovne rcx, rax
and qword [rsp + 0x40], rbx
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
and qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x171b32584
test ebx, ebx
js 0x171b25779
mov rcx, qword [rsp + 0x78]
lea rdx, str.StartColorMenu
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x171b32592
test ebx, ebx
js 0x171b25768
mov rcx, qword [rsp + 0x78]
lea rax, [rdi + 4]
mov dword [rsp + 0x28], 4
lea rdx, str.AccentColorMenu
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x171b325a0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, dword [rdi + 4]
call fcn.171b25450
lea rcx, [rsp + 0x50]
call fcn.171b08884
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
movzx ebx, ax
or ebx, 0x80070000
jmp 0x171b256e8
movzx ebx, ax
or ebx, 0x80070000
jmp 0x171b25728
movzx ebx, ax
or ebx, 0x80070000
jmp 0x171b25768

Function at 0x171b257a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
and dword [rsp + 0x58], 0
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
lea r8, str.AutoColorization
lea rax, [r11 + 8]
mov dword [rsp + 0x60], 4
mov qword [r11 - 0x20], rax
lea rdx, str.Control_PanelDesktop
lea rax, [r11 + 0x10]
mov r9d, 0x10000012
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x28], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov edx, 1
lea ecx, [rdx + 0xc]
test eax, eax
jne 0x171b25827
cmp dword [rsp + 0x58], 4
jne 0x171b325ae
cmp dword [rsp + 0x50], edx
ja 0x171b25835
xor ecx, ecx
cmp dword [rsp + 0x50], edx
sete al
test ecx, ecx
jns 0x171b25844
xor dl, dl
mov al, dl
add rsp, 0x48
ret
cmp eax, 0xea
cmove eax, ecx
mov ecx, eax
test eax, eax
jle 0x171b2583e
movzx ecx, cx
or ecx, 0x80070000
mov eax, dword [rsp + 0x50]
jmp 0x171b25819
test eax, eax
jne 0x171b2581f
jmp 0x171b2581d
cmp dword [rsp + 0x60], 4
jne 0x171b25835
movzx eax, word [rsp + 0x50]
sub ax, 0x30
cmp ax, dx
ja 0x171b25835
xor ecx, ecx
xor eax, eax
lea r8d, [rcx + 0x31]
cmp r8w, word [rsp + 0x50]
jmp 0x171b25816
Function at 0x171b25b14
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
xor eax, eax
movaps xmmword [rsp + 0x60], xmm6
mov r10d, ecx
lea r9, [0x171b813ec]
and r10d, 0xffffff
mov dil, r8b
mov rsi, rdx
mov ebx, ecx
cmp r10d, dword [r9]
je 0x171b25b5b
add eax, 8
add r9, 0x20
cmp eax, 0x180
jb 0x171b25b43
jmp 0x171b32c68
cdqe
lea rcx, [0x171b813e0]
movups xmm0, xmmword [rcx + rax*4]
movups xmm1, xmmword [rcx + rax*4 + 0x10]
movups xmmword [0x171b92e90], xmm0
movups xmmword [0x171b92ea0], xmm1
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
and qword [rsp + 0x58], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, rsi
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x171b32cc6
mov rcx, qword [rsp + 0x58]
lea rax, [0x171b92e90]
mov dword [rsp + 0x28], 0x20
lea r9d, [rbx + 3]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AccentPalette
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x171b32cc6
mov ecx, dword [0x171b92e9c]
call fcn.171b25850
test ebx, ebx
jne 0x171b32ceb
xor ebx, ebx
mov rcx, qword [rsp + 0x58]
and qword [rsp + 0x58], 0
test rcx, rcx
je 0x171b25c38
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rsi, qword [r11 + 0x18]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsp, r11
pop rdi
ret
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x54]
call fcn.171b5d188
call fcn.171b257a0
movss xmm6, dword [rsp + 0x54]
mov ecx, ebx
movss xmm3, dword [rsp + 0x98]
movaps xmm1, xmm6
movss xmm2, dword [rsp + 0x50]
mov byte [rsp + 0x20], al
call fcn.171b5c66c
comiss xmm6, dword [0x171b85cac]
mov eax, 0x981788
mov ecx, 0xc63f7
cmova eax, ecx
mov dword [0x171b92eac], eax
jmp 0x171b25b7b
test dil, dil
je 0x171b25c07
test ebx, ebx
je 0x171b25c07
mov rcx, qword [rsp + 0x78]
mov r9d, ebx
call fcn.171b5d3f0
mov ebx, eax
jmp 0x171b25c1c
mov rcx, qword [rsp + 0x78]
mov r9d, ebx
call fcn.171b5d468
nop
jmp 0x171b25c1a
Function at 0x171b26dcc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov rdi, r8
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [r11 - 0x20], bx
lea rdx, str.LMVersion
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x171b34f76
lea rcx, [rsp + 0x40]
call fcn.171b2740c
mov dword [rdi], eax
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.171b28ea0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
jg 0x171b34f7f
mov ebx, eax
jmp 0x171b26e42
movzx ebx, ax
or ebx, 0x80070000
jmp 0x171b26e42

Function at 0x171b26e6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov esi, edx
mov rbp, rcx
xor ebx, ebx
lea rdx, [rsp + 0x38]
mov ecx, 0x2001f
mov qword [rsp + 0x38], rbx
mov rdi, r8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
test rdi, rdi
je 0x171b34f8e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x171b26f77
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x171b26f73
lea rcx, [rsp + 0x50]
call fcn.171b2740c
mov dword [rdi], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
call fcn.171b08884
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.171b28ea0
mov rbx, qword [rsp + 0x298]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
mov dword [rdi], esi
jmp 0x171b26f32
mov dword [rdi], esi
jmp 0x171b26f43
mov ebx, 0x80070057
jmp 0x171b26f43
Function at 0x171b26f84
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov ecx, 0x2001f
mov qword [rsp + 0x60], rbx
mov rdi, r8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
test rdi, rdi
je 0x171b34f98
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
lea r9d, [rbx + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x171b2704a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov dword [rsp + 0x58], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x171b27024
mov dword [rdi], ebx
mov ebx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rcx, [rsp + 0x60]
call fcn.171b08884
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov dword [rdi], ebx
mov ebx, 1
jmp 0x171b27035
mov ebx, 0x80070057
jmp 0x171b27035

Function at 0x171b2705c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
and qword [rax + 8], 0
mov rsi, rdx
lea rdx, [rax + 8]
mov ecx, 0x2001f
mov rbx, r8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
test rbx, rbx
lea rdi, [0x171b680f8]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
cmovne rdi, rbx
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x171b27145
mov dx, 0x25
mov rcx, rdi
call fcn.171b2913c
neg rax
mov rcx, rdi
sbb ebx, ebx
neg ebx
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
lea r9d, [rbx + 1]
xor r8d, r8d
mov rdx, rsi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jg 0x171b34fa2
lea rcx, [rsp + 0x60]
call fcn.171b08884
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
movzx ebx, bx
or ebx, 0x80070000
jmp 0x171b2714d
Function at 0x171b27170
Capabilities:
Identify system language via api

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov rsi, r9
xor edx, edx
mov rdi, r8
test ecx, ecx
je 0x171b35062
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_memset
xor r9d, r9d
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
test eax, eax
je 0x171b34fb0
mov ebx, 1
lea rcx, str.ThemeActive
mov edx, ebx
call fcn.171b272c8
cmp dword [rsp + 0x4b0], 0
je 0x171b34fc8
mov edx, ebx
lea rcx, str.LoadedBefore
call fcn.171b272c8
call qword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetUserDefaultUILanguage]
nop dword [rax + rax]
movzx edx, ax
lea rcx, str.LastUserLangID
call fcn.171b272c8
call fcn.171b0ed58
mov edx, eax
lea rcx, str.LastLoadedDPI
call fcn.171b272c8
cmp dword [0x171b934b8], 0
jne 0x171b2723f
call fcn.171b26c1c
mov edx, dword [0x171b934b0]
lea rcx, str.LastLoadedDPIPlateaus
call fcn.171b272c8
mov eax, dword [rsp + 0x4a0]
lea rcx, str.LastLoadedPPI
test eax, eax
mov edx, 0x60
cmovne edx, eax
call fcn.171b272c8
call fcn.171b26d38
lea rdx, [rsp + 0x30]
lea rcx, str.DllName
call fcn.171b27490
mov r8, rdi
lea rdx, str.ColorName
call fcn.171b2705c
mov r8, rsi
lea rdx, str.SizeName
call fcn.171b2705c
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.171b28ea0
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.171b251d4
nop
jmp 0x171b271d4
lea r9, [rsp + 0x240]
lea rdx, str.DllName
call fcn.171b541fc
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x171b3505b
lea r8, [rsp + 0x30]
lea rdx, str.DllName
call fcn.171b2705c
lea rcx, str.LoadedBefore
call fcn.171b54138
lea rcx, str.LastUserLangID
call fcn.171b54138
lea rcx, str.LastLoadedDPI
call fcn.171b54138
lea rcx, str.LastLoadedDPIPlateaus
call fcn.171b54138
lea rcx, str.LastLoadedPPI
call fcn.171b54138
lea rcx, str.ColorName
call fcn.171b54138
lea rcx, str.SizeName
jmp 0x171b350c9
mov eax, ebx
jmp 0x171b272a4
lea rcx, str.ThemeActive
call fcn.171b272c8
lea rcx, str.DllName
call fcn.171b54138
lea rcx, str.ColorName
call fcn.171b54138
lea rcx, str.SizeName
call fcn.171b54138
lea rcx, str.LoadedBefore
call fcn.171b54138
lea rcx, str.LastUserLangID
call fcn.171b54138
lea rcx, str.LastLoadedDPI
call fcn.171b54138
lea rcx, str.LastLoadedDPIPlateaus
call fcn.171b54138
lea rcx, str.LastLoadedPPI
call fcn.171b54138
nop
jmp 0x171b272a2
Function at 0x171b272c8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, edx
mov rsi, rcx
xor ebp, ebp
lea rdx, [rsp + 0x58]
mov ecx, 0x2001f
mov qword [rsp + 0x58], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rbp
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x50], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x171b350e2
mov r9d, edi
lea r8, [0x171b686c4]
lea edx, [rbp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.171b05948
mov ebx, eax
test eax, eax
js 0x171b273c3
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x171b2737e
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x171b350d4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rcx, [rsp + 0x58]
call fcn.171b08884
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.171b28ea0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, 0x80070000
jmp 0x171b273c3
jle 0x171b273d4
movzx ebx, ax
or ebx, 0x80070000
jmp 0x171b273d4
Function at 0x171b27504
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r15, r8
mov edi, r9d
mov r14, rcx
lea rdx, [rsp + 0x30]
xor eax, eax
lea rcx, str._SystemRoot_
mov r8d, 0x104
mov word [rsp + 0x30], ax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
mov esi, eax
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], esi
mov edx, 1
mov r9d, eax
mov qword [rsp + 0x20], r14
mov ecx, 0x800
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x171b2761c
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
lea rcx, str._SystemRoot_
mov ebx, eax
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
sub ebx, esi
add eax, ebx
cmp eax, edi
jge 0x171b2761c
lea r8, str._SystemRoot_
mov edx, edi
mov rcx, r15
call fcn.171b07b08
mov rcx, r15
lea rbx, [r14 + rsi*2]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
movsxd rcx, eax
mov r8, rbx
mov edx, edi
lea rcx, [r15 + rcx*2]
call fcn.171b07b08
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.171b28ea0
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
jmp 0x171b275fc

Function at 0x171b276d0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x44], 0
mov rbx, rcx
je 0x171b35178
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
nop dword [rax + rax]
mov r8, rbx
lea rdx, [0x171b286c0]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumDesktopsW]
nop dword [rax + rax]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_GetDesktopWindow]
nop dword [rax + rax]
mov rcx, rax
mov rdx, rbx
call fcn.171b28480
nop
jmp 0x171b27708
Function at 0x171b27718
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
lea rcx, [rsp + 0x48]
xor ebx, ebx
call fcn.171b279dc
call fcn.171b27b18
test al, al
je 0x171b2782a
lea r8, [0x171b68e10]
lea edx, [rbx + 0x20]
lea rcx, [rsp + 0x60]
call fcn.171b07b08
test eax, eax
js 0x171b277ee
mov edx, 0x104
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x171b277ee
lea r9, [rbp + 0x1b0]
mov edx, 0x104
lea r8, str._suxtheme.dll
lea rcx, [rbp - 0x60]
call fcn.171b05948
test eax, eax
js 0x171b277ee
lea rax, [rbp - 0x60]
mov dword [rsp + 0x20], 0x28
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_RegisterUserApiHook]
nop dword [rax + rax]
test eax, eax
jne 0x171b277fc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
lea rcx, [0x171b934a0]
call fcn.171b2a314
test al, al
jne 0x171b2782a
call qword [sym.imp.USER32.dll_RegisterDManipHook]
nop dword [rax + rax]
test eax, eax
jne 0x171b2782a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.171b2798c
mov eax, ebx
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.171b28ea0
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4d0
pop rbp
ret
Function at 0x171b280b4
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x38], 0
lea r8, [rbp + 0x30]
and dword [rbp + 0x30], 0
xorps xmm0, xmm0
mov qword [rbp - 0x18], rdx
lea rdx, [rbp + 0x38]
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rcx
call fcn.171b28178
mov rbx, qword [rbp + 0x38]
mov edi, eax
test eax, eax
je 0x171b28100
mov ecx, dword [rbp + 0x30]
mov dword [rbp - 8], ecx
mov qword [rbp - 0x10], rbx
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rbp - 0x20]
lea rdx, [0x171b28650]
call qword [sym.imp.USER32.dll_EnumDesktopsW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x171b2813b
test edi, edi
je 0x171b2813b
mov edi, dword [rbp - 8]
test edi, edi
jne 0x171b3546a
test rbx, rbx
je 0x171b28158
mov rcx, qword [0x171b92ce0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x80]
mov eax, esi
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
and qword [rbp - 0x10], 0
xor r14d, r14d
and dword [rbp - 8], 0
test edi, edi
jle 0x171b2813b
mov r15, rbx
mov rcx, qword [r15]
lea rdx, [rbp - 0x20]
call fcn.171b27fa0
mov esi, eax
test eax, eax
je 0x171b2813b
inc r14d
add r15, 8
cmp r14d, edi
jl 0x171b35481
jmp 0x171b2813b
Function at 0x171b2910c
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov byte [rdi], al
inc rdi
mov al, 0x23
mov byte [rdi], al
inc rdi
mov al, 0x35
mov byte [rdi], al
inc rdi
mov al, 0x38
mov byte [rdi], al
inc rdi
mov al, 0
mov byte [rdi], al
inc rdi
mov rcx, r10
sub rsp, 0x20
push r14
xor r14, rsp
push r11
xor r11, rsp
xor ebx, esp
mov r14, r11
xor r11, r14
test r11, r11
invalid

Function at 0x171b2916c
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
call r13
add rsp, 0x20
add rsp, 0x200
sub rsp, 0x80
lea rdi, [rsp + 0x10]
mov al, 0x54
mov byte [rdi], al
mov al, 0x65
mov byte [rdi + 1], al
mov al, 0x72