joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001df0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
mov dword [rsp + 0x30], edi
cmp di, word [0x140024200]
jne 0x140001e6d
mov rcx, qword [0x140024040]
lea r8, [0x140024200]
lea edx, [rdi + 0x68]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
mov r11d, 0x104
lea rax, [0x140024200]
cmp word [rax], di
je 0x140001e5c
add rax, 2
sub r11, 1
jne 0x140001e4d
cmp r11, rdi
mov ebx, edi
mov eax, 0x80070057
cmove ebx, eax
cmp ebx, edi
jl 0x140001ec1
lea rsi, [0x140024410]
cmp di, word [0x140024410]
jne 0x140001eae
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x2e]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
mov ebx, eax
jl 0x140001ec1
lea rdx, [0x140024200]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, edi
je 0x140001ec1
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x14000b6a6
mov ebx, edi
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
cmp eax, edi
jne 0x140001ebf
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140011100
cmp eax, edi
mov ebx, eax
jl 0x140001ec1
cmp dword [rsp + 0x30], edi
je 0x140001ec1
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
mov ebx, eax
jl 0x140001ec1
lea rdx, [0x140024200]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, edi
je 0x140001ec1
lea r8, str..lnk
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.1400028b8
cmp eax, edi
mov ebx, eax
jl 0x140001ec1
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rsi
call fcn.140011024
mov ebx, eax
jmp 0x140001ec1
Function at 0x140002b50
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
xor ebx, ebx
xor edi, edi
mov rsi, rcx
and dword [rax + 8], ebx
test rcx, rcx
je 0x14000b7ba
and qword [rsp + 0x50], rbx
lea rax, [rsp + 0x98]
mov byte [rcx], bl
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionMedia_CenterSettingsJump_List
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000b7c4
mov rdi, qword [rsp + 0x50]
test eax, eax
jne 0x14000b7c4
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x90]
lea rdx, str.GuideTaskEnabled
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x88], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b7c4
mov eax, dword [rsp + 0x90]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
test eax, eax
jne 0x14000b7c4
cmp dword [rsp + 0x80], ebx
setne dl
mov byte [rsi], dl
test rdi, rdi
je 0x140002c46
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
mov ebx, 0x80004005
jmp 0x140002c46
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140002c38
Function at 0x140003e34
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x490
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rax, [r11 - 0x238]
lea r9, [r11 - 0x238]
xor r12d, r12d
mov r11, rdx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov r10d, 0x104
mov ebx, r12d
sub r11, rax
lea rax, [r10 + 0x7ffffefa]
cmp rax, r12
je 0x140003eaa
movzx eax, word [r11 + r9]
cmp ax, r12w
je 0x140003eaa
mov word [r9], ax
add r9, 2
sub r10, 1
jne 0x140003e85
cmp r10, r12
je 0x14000ba67
cmp ebx, r12d
mov word [r9], r12w
jl 0x140003f25
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rsp + 0x270]
mov r8, rdi
mov edx, 0x104
call fcn.1400028b8
cmp eax, r12d
mov ebx, eax
jl 0x140003f25
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003f4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14000ba7a
mov ebx, r12d
jmp 0x140003f16
cmp rdi, 0xffffffffffffffff
je 0x140003f25
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea r8, [rsp + 0x20]
mov rdx, rsi
mov rcx, rbp
call fcn.140003f94
cmp eax, r12d
mov ebx, eax
jl 0x14000ba75
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x140003f4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x140003f16
jmp 0x14000ba7a
sub r9, 2
mov ebx, 0x8007007a
jmp 0x140003eb3
jmp 0x140003f16
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r12d
cmovle ebx, eax
jmp 0x140003f16

Function at 0x140004354
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
mov eax, dword [r9]
mov rcx, qword [rcx]
mov rbx, r8
add eax, eax
mov rdi, r9
xor esi, esi
mov dword [rsp + 0x30], eax
lea rax, [r11 - 0x18]
mov dword [r9], esi
mov qword [r11 - 0x20], rax
lea r9, [r11 + 0x20]
lea rdx, str.RecordPath
xor r8d, r8d
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1400043db
cmp dword [rsp + 0x68], 1
jne 0x14000ba0d
mov ecx, dword [rsp + 0x30]
cmp rbx, rsi
je 0x1400043d5
cmp ecx, esi
je 0x14000ba24
test cl, 1
jne 0x14000ba18
mov rax, rcx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
jne 0x14000ba22
shr ecx, 1
xor eax, eax
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rsp + 0x68], 2
je 0x1400043aa
mov eax, 0xd
jmp 0x1400043db
jmp 0x14000ba18
mov word [rbx], si
jmp 0x1400043d5
Function at 0x1400054a0
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [0x1400240c8]
test rcx, rcx
je 0x140005c55
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400054e8
cmp dword [rsp + 0x34], 4
je 0x14000572d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov eax, dword [rsp + 0x4c]
jmp 0x1400054ea
xor edx, edx
mov r8d, 0x20005
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400054e2
lea rdx, str.ehsched
mov r8d, 0x20084
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rbx
mov qword [0x1400240c8], rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x1400240c8]
test rcx, rcx
jne 0x1400054b6
jmp 0x1400054e2

Function at 0x140005af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
push rbx
sub rsp, 0x40
mov rcx, qword [0x140024010]
and dword [rsp + 0x68], 0
lea rax, [r11 + 0x18]
mov qword [r11 - 0x20], rax
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x18]
lea rdx, str.EhtrayExitDelay
xor r8d, r8d
mov ebx, 0xa
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140009e59
mov eax, ebx
add rsp, 0x40
pop rbx
ret
cmp dword [rsp + 0x30], 4
jne 0x140005b41
cmp dword [rsp + 0x60], 4
cmove ebx, dword [rsp + 0x68]
jmp 0x140005b41
Function at 0x140005d7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, 1
xor esi, esi
sub ecx, edi
je 0x14000a9f2
sub ecx, edi
je 0x14000a9e9
sub ecx, edi
je 0x14000a9e0
sub ecx, edi
je 0x14000a9d7
sub ecx, edi
je 0x14000a9ce
sub ecx, 2
je 0x14000a9f9
sub ecx, edi
je 0x14000a9c5
cmp ecx, edi
je 0x14000a9bc
mov al, dil
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rbx, str.HideRadio
jmp 0x14000aa00
lea rbx, str.HideVideos
jmp 0x14000aa00
lea rbx, str.HideMusic
jmp 0x14000aa00
lea rsi, str.EnableRemoteRecordedTV
jmp 0x14000a9f9
lea rsi, str.EnableRemoteMyTV
jmp 0x14000a9f9
lea rsi, str.EnableRemoteTVGuide
jmp 0x14000a9f9
lea rsi, str.EnableRemoteLiveTV
lea rbx, str.HideTV
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMedia_CenterStart_Menu
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000aad2
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005de8
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000aad2
cmp dword [rsp + 0x30], 4
jb 0x14000aad2
cmp dword [rsp + 0x50], eax
sete dil
test dil, dil
jne 0x14000aad2
test rsi, rsi
je 0x14000aad2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000aad2
cmp dword [rsp + 0x30], 4
jb 0x14000aad2
cmp dword [rsp + 0x50], eax
setne dil
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005de8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140005de8
Function at 0x140005e18
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x690
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x680], rax
xor ebx, ebx
neg dl
movsxd rdi, ecx
sbb esi, esi
mov rbp, rbx
mov r12, rbx
and esi, 0xfffffffe
add esi, 5
cmp edi, ebx
jge 0x14000ab8f
mov rcx, qword [0x1400263f0]
mov r13d, 0x104
lea rdx, [rsp + 0x50]
mov r8d, r13d
mov word [rsp + 0x50], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x260]
sub rdx, rax
mov r11, r13
lea rcx, [rsp + 0x260]
mov r14d, 1
lea rax, [r11 + 0x7ffffefa]
cmp rax, rbx
je 0x140005ecd
movzx eax, word [rdx + rcx]
cmp ax, bx
je 0x140005ecd
mov word [rcx], ax
add rcx, 2
sub r11, r14
jne 0x140005eac
cmp r11, rbx
je 0x14000aba9
mov word [rcx], bx
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, str.EHShell.exe
lea rcx, [rsp + 0x50]
mov rdx, r13
call fcn.1400028b8
cmp rbp, rbx
jne 0x14000abb2
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov eax, ebx
mov qword [rsp + 0x30], rbx
cmp edi, ebx
mov qword [rsp + 0x28], rbx
cmovge eax, edi
lea r9, str.EhTray.exe_is_starting_EhShell.exe
mov r8d, 0x6000001
movsxd rcx, eax
mov edx, r14d
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x140024078]
call fcn.1400029a0
lea rax, [rsp + 0x260]
lea r8, [rsp + 0x50]
lea rdx, str.open
mov r9, r12
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
movzx ebx, bl
cmovg ebx, r14d
mov al, bl
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
cmp edi, 0xe
jae 0x140005e60
lea rbp, str.Home.xml
mov rbp, qword [rbp + rdi*8]
jmp 0x140005e60
sub rcx, 2
jmp 0x140005ed6
lea r8, str._homepage:_s__prefetch:_d
lea rcx, [rsp + 0x470]
mov r9, rbp
mov rdx, r13
mov dword [rsp + 0x20], edi
call fcn.1400105f8
cmp eax, ebx
jl 0x140005f73
lea r12, [rsp + 0x470]
jmp 0x140005f01
Function at 0x1400061e8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r12d, r12d
mov rdi, rax
cmp rax, r12
je 0x14000c3f8
mov rbx, rax
cmp word [rax], r12w
je 0x140006234
nop
add rbx, 2
cmp word [rbx], r12w
jne 0x140006220
add rbx, 2
cmp word [rbx], r12w
jne 0x140006220
mov qword [rsp + 0x38], r12
sub rbx, rax
mov qword [rsp + 0x30], r12
sar rbx, 1
mov r8, rax
xor edx, edx
lea r9d, [rbx + 1]
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbp, eax
cmp ebp, r12d
je 0x14000c3ef
mov rcx, rbp
call fcn.140002694
mov rsi, rax
cmp rax, r12
je 0x14000c3ef
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, r12d
je 0x14000c3df
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
jmp 0x1400062ba
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
mov rcx, rsi
call fcn.140002700
mov rsi, r12
jmp 0x1400062ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1400062ba

Function at 0x1400064a0
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cc6d
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
jne 0x1400064ce
mov edx, 0x20b
cmp word [rcx + 0x18], dx
sete al
repz ret
xor eax, eax
ret
Function at 0x140007830
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
cmp rcx, rbx
je 0x14000790c
lea rdx, [rax + 8]
mov r12b, bl
mov dword [rax + 8], ebx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
cmp rax, rbx
je 0x14000790c
lea r13d, [rbx + 1]
cmp dword [rsp + 0x40], r13d
mov esi, r13d
jle 0x1400078fa
lea rdi, [rax + 8]
cmp qword [rdi], rbx
je 0x1400078ed
mov rcx, qword [rdi]
lea rdx, [0x14001e0f0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x140009af0
mov rcx, qword [rdi]
lea rdx, str._surviveehschedtermination
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x140009af8
mov rcx, qword [rdi]
lea rdx, str._nav:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rbx
je 0x1400078ed
mov edx, 0x3a
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrChrIW]
cmp rax, rbx
je 0x1400078ed
lea rcx, [rax + 2]
call fcn.140007930
mov dword [0x140025ea0], eax
add esi, r13d
add rdi, 8
cmp esi, dword [rsp + 0x40]
jl 0x140007881
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp r12b, bl
jne 0x140009b04
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov r12b, r13b
jmp 0x1400078ed
mov byte [0x1400263fa], r13b
jmp 0x1400078ed
call fcn.140005c00
mov ecx, 0xa
call fcn.14000f300
movzx ecx, bl
cmp al, bl
cmovne ecx, r13d
mov bl, cl
jmp 0x14000790c

Function at 0x1400082b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
mov r10, rdx
add r8, rcx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
lea rcx, [rax + r8 + 0x18]
test r11d, r11d
je 0x14000cc70
mov edx, dword [rcx + 0xc]
cmp r10, rdx
jb 0x1400082e7
mov eax, dword [rcx + 8]
add eax, edx
cmp r10, rax
jb 0x1400082f8
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400082d5
jmp 0x14000cc70
mov rax, rcx
ret
xor eax, eax
ret
Function at 0x1400087b0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, qword [0x140024058]
mov rsi, qword [0x140024030]
lea rax, [0x14001e140]
xor r14d, r14d
mov r12d, 0x80004005
cmp rax, r14
je 0x140008912
cmp qword [rsi + 8], r14
jne 0x140008912
lea eax, [r14 + 8]
lea r15d, [r14 + 2]
lea rbp, [r14 - 1]
mul r15
cmovo rax, rbp
mov rcx, rax
call fcn.140002220
mov rdi, rax
lea eax, [rbp + 5]
mul r15
cmovo rax, rbp
mov rcx, rax
call fcn.140002220
mov rbx, rax
lea eax, [rbp + 0x11]
mul r15
cmovo rax, rbp
mov rcx, rax
call fcn.140002220
mov rbp, rax
cmp rdi, r14
je 0x14000bc68
cmp rbx, r14
je 0x14000bc68
cmp rax, r14
je 0x14000bc68
lea r8d, [r14 + 0x10]
lea rdx, [0x14001e140]
mov rcx, rdi
call fcn.1400029f0
xor r11d, r11d
lea rcx, [rbp + 4]
mov qword [rbx], r11
lea rdx, [0x14001e144]
mov r9, r15
movzx eax, word [rdx - 4]
mov word [rcx - 4], ax
movzx eax, word [rdx - 2]
mov dword [rcx], r14d
mov word [rcx - 2], ax
mov qword [rcx + 4], r13
test byte [rdx], 1
jne 0x14000bc4d
test byte [rdx], r15b
jne 0x14000bc5d
test byte [rdx], 4
je 0x1400088b9
bts dword [rcx], 8
add rdx, 8
add rcx, 0x10
sub r9, 1
jne 0x140008887
lea r8d, [r9 + 0x10]
mov edx, r15d
mov rcx, rbp
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp eax, r14d
je 0x1400088f3
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
mov dword [rsi + 4], r15d
mov rdi, r14
mov rbx, r14
mov r12d, r14d
jmp 0x1400088f3
cmp rbp, r14
je 0x140008900
mov rcx, rbp
call fcn.140002214
cmp rdi, r14
jne 0x14000bc73
cmp rbx, r14
jne 0x14000bc81
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, r12d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [rcx], 0x20
mov word [rcx - 2], r14w
jmp 0x1400088a7
or dword [rcx], 0x430
jmp 0x1400088b0
mov r12d, 0x8007000e
jmp 0x1400088f3
mov rcx, rdi
call fcn.140002214
nop
jmp 0x140008909
mov rcx, rbx
call fcn.140002214
nop
jmp 0x140008912
Function at 0x140008ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rdx, [rsp + 0x60]
lea rcx, str.MediaCenter_EnabledSku
xor edi, edi
mov dword [rsp + 0x60], edi
call sub.slc.dll_SLGetWindowsInformationDWORD
mov ecx, dword [rsp + 0x60]
cmp eax, edi
lea rax, [rsp + 0x38]
lea ebx, [rdi + 1]
cmovl ecx, edi
lea rdx, str.SoftwarePoliciesMicrosoftWindowsMediaCenter
mov r9d, ebx
mov dword [rsp + 0x60], ecx
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x14000bba2
lea rax, [rsp + 0x38]
lea rdx, str.SoftwarePoliciesMicrosoftWindowsMediaCenter
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x14000bbf4
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareclientsMediaWindows_Media_CenterInstallInfo
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x140008bc6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.IconsVisible
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x78]
cmp eax, edi
cmovne ecx, ebx
mov dword [rsp + 0x78], ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x60], edi
je 0x14000bc46
cmp dword [rsp + 0x68], edi
jne 0x14000bc46
cmp dword [rsp + 0x70], edi
jne 0x14000bc46
cmp dword [rsp + 0x78], edi
je 0x14000bc46
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.MediaCenter
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x68]
cmp eax, edi
cmovne ecx, edi
mov dword [rsp + 0x68], ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140008b1e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.MediaCenter
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
cmp eax, edi
cmovne edx, edi
mov dword [rsp + 0x70], edx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140008b4e
mov ebx, edi
jmp 0x140008bee
Function at 0x140008c1c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp byte [rcx + 0x70], dil
jne 0x140008c4f
mov byte [rcx + 0x70], 1
lea rcx, str.ehETW.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x78], rax
cmp rax, rdi
jne 0x14000be5c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x14001ff20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.ehClosePrefLog
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.EHOME_EVENT_TRACE
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.EHOME_EVENT_TRACE_U
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.EHOME_EVENT_TRACE_US
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.ehETWTracingEnabled
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, qword [rbx + 0x18]
mov qword [rbx + 0x28], rax
cmp r8, rdi
je 0x14000bf2c
cmp qword [rbx + 0x20], rdi
je 0x14000bf2c
cmp qword [rbx], rdi
je 0x14000bf2c
cmp qword [rbx + 8], rdi
je 0x14000bf2c
cmp qword [rbx + 0x10], rdi
je 0x14000bf2c
cmp rax, rdi
je 0x14000bf2c
mov rcx, qword [rbx + 0x60]
lea rdx, [rbx + 0x30]
call r8
mov qword [rbx + 0x68], rax
cmp rax, rdi
jne 0x140008c4f
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x28], rdi
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x78], rdi
jmp 0x140008c4f

Function at 0x140008c88
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140001ef0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.140001ef0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x14000bf8a
cmp dword [rsp + 0x24], 5
jb 0x140008d23
jmp 0x140008d1f
mov byte [rbx + 0x18], sil
lea rax, [0x14001cfc0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140008d80
movzx ecx, byte [0x1400268e0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1400268e0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp dword [rsp + 0x30], esi
jne 0x140008d23
cmp dword [rsp + 0x24], 4
ja 0x140008d1f
jne 0x140008d23
cmp dword [rsp + 0x28], 0
ja 0x140008d1f
jmp 0x140008d23