joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400999a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x240
xor esi, esi
mov dword [r11 + 0x10], 0xff
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [r11 + 0x10]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x140099aac
nop
mov rax, qword [0x14011f188]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov r9d, dword [rax + 0xb0]
lea rax, [rsp + 0x270]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140099ab9
mov rcx, qword [rsp + 0x270]
call fcn.1400999a0
mov rcx, qword [rsp + 0x270]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140099ab9
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
jne 0x140099ab9
lea rax, [rsp + 0x278]
mov dword [rsp + 0x268], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x268]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400999f0
xor eax, eax
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x14009b4f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x40]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x14009ef20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400daca0
sub rsp, rax
mov rdi, rdx
lea rcx, str.ComSpec
lea rdx, [rsp + 0x20]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14009ef89
lea rcx, [rbx + 1]
cmp rcx, 0x7fff
ja 0x14009ef89
lea r8, [rbx*2 + 2]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.1400bcbb0
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x14009f900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov esi, r9d
mov r12d, r8d
mov r14d, edx
mov r13, rcx
mov r15d, ebx
test rcx, rcx
je 0x14009f93e
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x14009f945
mov rdi, qword [0x140125ac0]
test rdi, rdi
je 0x14009fb0d
mov qword [rsp + 0x80], rbp
lea rbp, [0x140128044]
test r14d, r14d
jns 0x14009f96e
movzx eax, r14w
neg ax
movzx edx, ax
jmp 0x14009f9a6
test r14d, r14d
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], rbp
cmovne eax, r14d
lea r9, [rsp + 0x40]
lea r8, [0x14009f8e0]
mov dword [rsp + 0x40], eax
mov edx, recv
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, rbp
je 0x14009fad8
mov r8d, recv
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14009fad8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14009fad8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14009fad8
cmp r12d, 0xffffffff
cmovne esi, r12d
test esi, esi
jne 0x14009fa08
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [rbp + 4]
lea r8, [rbp + 6]
mov r11, rbx
mov r9d, ebx
cmp bx, ax
jae 0x14009fad8
mov rdx, r8
mov r10d, eax
mov ebp, 0x100
nop word [rax + rax]
movzx eax, byte [r8]
mov ecx, ebx
test eax, eax
cmove eax, ebp
cmp eax, r9d
jle 0x14009fa48
cmp r9d, esi
setl cl
jmp 0x14009fa4d
cmp eax, esi
setge cl
test ecx, ecx
je 0x14009fa57
mov r11, rdx
mov r9d, eax
add rdx, 0xe
add r8, 0xe
sub r10, 1
jne 0x14009fa30
test r11, r11
je 0x14009fad8
movzx edx, word [r11 + 0xc]
lea r8d, [r10 + 3]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14009fad8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14009fad8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14009fad8
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, rbp
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r15, rax
mov rcx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x80]
test rcx, rcx
je 0x14009fafa
test r15, r15
je 0x14009fafa
mov qword [rcx], rdi
mov rax, r15
jmp 0x14009fb2e
test r13, r13
je 0x14009fb08
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
jne 0x14009faf5
test r14d, r14d
jle 0x14009fb18
lea ebx, [r14 - 1]
jmp 0x14009fb20
cmp r14d, 0xffffffff
cmovl ebx, r14d
mov r8d, ebx
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a2d60
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rsp + 0x60], rbp
xor r9d, r9d
mov ebp, edx
mov rbx, rcx
lea edx, [rdi + 0x10]
test r8b, r8b
je 0x1400a2dee
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1f4
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x1400a2df7
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x70]
test r8d, r8d
je 0x1400a2df7
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400a2df7
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a2df7
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
test ebp, ebp
cmovns edi, ebp
mov rbp, qword [rsp + 0x60]
test edi, edi
je 0x1400a2e5b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001710
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400a2e5b
add edi, esi
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x1400a2e5b
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001710
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400a2e30
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a4e80
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1890]
test rcx, rcx
je 0x1400a4f63
mov eax, dword [rbx]
test eax, eax
je 0x1400a4f63
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x1400a4ebf
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x1400a4edd
mov r8d, 0x7fff
lea rdx, [rbx + 0x189c]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400a4edd
mov word [rbx + 0x189c], si
test byte [rbx], 4
je 0x1400a4ef6
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x1400a4f34
mov rcx, qword [rbx + 0x1890]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400a4f34
movzx r9d, byte [rbx + 0x1850]
lea rdx, [rbx + 0x11a9c]
mov ecx, dword [rsp + 0x30]
call fcn.140031d80
test eax, eax
jne 0x1400a4f34
mov word [rbx + 0x11a9c], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x1400a4f63
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1189a]
mov r8d, 0x101
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_GetClassNameW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400a5440
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get graphical window text
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
cmp qword [0x140125d78], 0
mov rax, qword [0x14011f188]
mov byte [rax + 0x7f], 1
je 0x1400a5518
movzx r8d, byte [0x140125e84]
mov qword [rsp + 0x30], rbx
movzx eax, r8b
and al, 0xc0
neg al
sbb ecx, ecx
and ecx, 8
mov edx, ecx
or edx, 1
test r8b, 0xc
cmove edx, ecx
mov ecx, edx
or ecx, 4
test r8b, 0x30
cmove ecx, edx
mov r9d, ecx
or r9d, 2
test r8b, 3
cmove r9d, ecx
mov eax, r9d
and al, 2
neg al
sbb al, al
and al, 3
movzx edx, al
movzx eax, dl
or al, 0x30
test r9b, 4
movzx ebx, al
cmove ebx, edx
or bl, 0xcc
not bl
and bl, byte [0x140125e82]
je 0x1400a5513
cmp r9d, 8
jne 0x1400a54f6
movzx r8d, word [0x14011fb34]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.14001fed0
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
xor r8d, r8d
mov byte [rsp + 0x20], 0
movzx edx, bl
xor ecx, ecx
call fcn.1400221e0
mov rbx, qword [rsp + 0x30]
mov ecx, 0x4bf
call qword [sym.imp.USER32.dll_GetQueueStatus]
shr eax, 0x10
test ax, ax
je 0x1400a553c
mov edx, 1
lea ecx, [rdx - 2]
add rsp, 0x38
jmp fcn.140001710
add rsp, 0x38
ret
Function at 0x1400a5910
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11cd8
call fcn.1400daca0
sub rsp, rax
xor r9d, r9d
mov dword [rsp + 0x18a0], edx
lea rax, [0x1400fcb50]
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x1038], rax
lea rdx, [rsp + 0x20]
mov rax, qword [rcx + 0x10]
xorps xmm0, xmm0
lea rcx, [0x1400a6100]
mov qword [rsp + 0x1898], rax
mov byte [rsp + 0x1871], r9b
mov dword [rsp + 0x1874], r9d
mov qword [rsp + 0x1878], r9
movdqa xmmword [rsp + 0x1880], xmm0
mov dword [rsp + 0x1890], r9d
mov qword [rsp + 0x18a8], r9
mov qword [rsp + 0x18b0], r9
mov dword [rsp + 0x18a4], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1878], 0
je 0x1400a59c4
mov rax, qword [0x14011f188]
mov ecx, dword [rax + 0x90]
cmp ecx, 0xffffffff
jle 0x1400a59c4
mov edx, 1
call fcn.140001710
add rsp, 0x11cd8
ret
Function at 0x1400a59d0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x11bd0]
mov eax, 0x11cd0
call fcn.1400daca0
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx r14d, dl
mov rsi, rcx
je 0x1400a5c1a
xor ebx, ebx
mov byte [rcx], 1
cmp qword [0x1401274e8], rcx
je 0x1400a5a26
mov qword [0x1401274e8], rcx
mov dword [0x1401274f8], ebx
cmp qword [0x1401274f0], rbx
jne 0x1400a5a49
mov ecx, 0xfa0
call fcn.14009a150
test rax, rax
je 0x1400a5c39
mov qword [0x1401274f0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x14011f188]
mov rcx, rsi
sub r8, 0xffffffffffffff80
mov rdx, rax
mov rdi, rax
call fcn.1400a5e80
mov ecx, dword [0x1401274f8]
test rax, rax
mov dword [rbp + 0x1774], ebx
setne r15b
mov qword [rbp + 0x1778], rbx
test rax, rax
mov qword [rbp + 0x1780], rbx
mov qword [rbp + 0x1798], rbx
cmove ecx, ebx
mov qword [rbp + 0x17a8], rbx
mov dword [0x1401274f8], ecx
mov qword [rbp + 0x17b0], rbx
test r14b, r14b
je 0x1400a5aba
mov byte [rbp + 0x1771], bl
test r15b, r15b
je 0x1400a5ac1
mov byte [rbp + 0x1771], 1
mov rax, qword [0x14011f188]
lea rdx, [0x1400fcb50]
mov r8, qword [0x1401274f0]
mov qword [rbp + 0x1788], r8
mov dword [rbp + 0x1790], ecx
mov qword [rbp + 0xf38], rdx
mov qword [rbp + 0xf40], rbx
mov qword [rbp + 0xf48], rdx
mov qword [rbp + 0xf50], rdx
test rax, rax
je 0x1400a5b0f
sub rax, 0xffffffffffffff80
mov qword [rsp + 0x28], rax
jmp 0x1400a5b14
mov qword [rsp + 0x28], rbx
test ecx, ecx
mov qword [rbp + 0xf68], rsi
mov dword [rsp + 0x20], reloc.WSOCK32.dll_recv
setg sil
nop dword [rax]
test r15b, r15b
je 0x1400a5b66
mov edx, ebx
test ecx, ecx
jle 0x1400a5b4f
mov rax, r8
nop
cmp qword [rax], rdi
je 0x1400a5b66
inc edx
add rax, 8
cmp edx, ecx
jl 0x1400a5b40
cmp ecx, 0x1f4
jge 0x1400a5b66
movsxd rax, ecx
inc ecx
mov dword [0x1401274f8], ecx
mov qword [r8 + rax*8], rdi
mov dword [rbp + 0x1790], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400a3b40]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp + 0x1778]
test rcx, rcx
jne 0x1400a5ba7
test sil, sil
je 0x1400a5c1a
mov r8, qword [0x1401274f0]
mov ecx, ebx
mov dword [0x1401274f8], ebx
xor sil, sil
jmp 0x1400a5b30
call fcn.1400a2a50
movsxd rcx, dword [0x1401274f8]
mov rdx, qword [rbp + 0x1778]
mov r8, qword [0x1401274f0]
test ecx, ecx
jle 0x1400a5bd7
mov rax, r8
cmp qword [rax], rdx
je 0x1400a5bf2
inc ebx
add rax, 8
cmp ebx, ecx
jl 0x1400a5bc8
cmp ecx, 0x1f4
jge 0x1400a5bf2
mov qword [r8 + rcx*8], rdx
inc ecx
mov rdx, qword [rbp + 0x1778]
mov dword [0x1401274f8], ecx
mov rax, qword [0x14011f188]
mov ecx, dword [rax + 0x90]
cmp ecx, 0xffffffff
jle 0x1400a5c15
mov edx, 1
call fcn.140001710
mov rdx, qword [rbp + 0x1778]
mov rax, rdx
jmp 0x1400a5c1c
xor eax, eax
lea r11, [rsp + 0x11cd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400111f0
int3
Function at 0x1400a5c40
Capabilities:
Enumerate gui resources
Find taskbar

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
mov eax, 0x11cd0
call fcn.1400daca0
sub rsp, rax
xor ebx, ebx
mov byte [rcx], 0
cmp qword [0x1401274e8], rcx
movzx ebp, dl
mov rdi, rcx
je 0x1400a5c79
mov qword [0x1401274e8], rcx
mov dword [0x1401274f8], ebx
cmp qword [0x1401274f0], rbx
jne 0x1400a5c9c
mov ecx, 0xfa0
call fcn.14009a150
test rax, rax
je 0x1400a5e6f
mov qword [0x1401274f0], rax
mov qword [rsp + 0x11ce0], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov edx, 4
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
je 0x1400a5cd6
mov edx, 4
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
jne 0x1400a5cc0
mov r8, qword [0x14011f188]
mov rdx, rsi
sub r8, 0xffffffffffffff80
mov rcx, rdi
call fcn.1400a5e80
mov ecx, dword [0x1401274f8]
test rax, rax
lea rax, [0x1400fcb50]
mov dword [rsp + 0x20], ebx
cmovne ecx, ebx
mov qword [rsp + 0x1038], rax
mov dword [0x1401274f8], ecx
mov dword [rsp + 0x1874], ebx
mov qword [rsp + 0x1878], rbx
mov qword [rsp + 0x1880], rbx
mov qword [rsp + 0x18a8], rbx
mov qword [rsp + 0x18b0], rbx
test bpl, bpl
je 0x1400a5d48
mov byte [rsp + 0x1871], bl
test ecx, ecx
je 0x1400a5d50
mov byte [rsp + 0x1871], 1
mov rax, qword [0x1401274f0]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x1888], rax
mov rax, qword [rdi + 0x10]
mov dword [rsp + 0x1890], ecx
lea rcx, [0x1400a5f80]
mov qword [rsp + 0x1898], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x1878]
test rcx, rcx
je 0x1400a5e01
call qword [sym.imp.USER32.dll_GetLastActivePopup]
mov rcx, rax
call fcn.1400a2a50
movsxd rcx, dword [0x1401274f8]
mov rdx, qword [rsp + 0x1878]
mov r8, qword [0x1401274f0]
test ecx, ecx
jle 0x1400a5dcf
mov rax, r8
nop dword [rax]
cmp qword [rax], rdx
je 0x1400a5de3
inc ebx
add rax, 8
cmp ebx, ecx
jl 0x1400a5dc0
cmp ecx, 0x1f4
jge 0x1400a5de3
mov qword [r8 + rcx*8], rdx
inc ecx
mov dword [0x1401274f8], ecx
mov rax, qword [0x14011f188]
mov ecx, dword [rax + 0x90]
cmp ecx, 0xffffffff
jle 0x1400a5e52
mov edx, 1
call fcn.140001710
jmp 0x1400a5e52
mov eax, dword [0x1401274f8]
test eax, eax
je 0x1400a5e3b
cmp eax, 1
mov dword [0x1401274f8], ebx
setg al
test al, al
je 0x1400a5e52
mov rax, qword [0x1401274f0]
xor edx, edx
mov rcx, rdi
mov dword [0x1401274f8], 1
mov qword [rax], rsi
call fcn.1400a5c40
jmp 0x1400a5e52
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov rcx, rax
call fcn.1400a2a50
mov rsi, qword [rsp + 0x11ce0]
lea r11, [rsp + 0x11cd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400111f0
int3
Function at 0x1400bb800
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bb84a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400bb84a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400bb84a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400bb84a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400bb84a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400bb84c
xor al, al
add rsp, 0x28
ret

Function at 0x1400cd984
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400cd7e3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400cd7e3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400cd7e3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400cd7e3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400cd7e3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400cd7e3
cmp dword [rcx + 0xf8], 0
je 0x1400cd7e3
mov ecx, ebx
call fcn.1400cd8a0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400cd670
nop
cmp dword [rbp + 0x20], 0
je 0x1400cd831
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400cd83c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400cd774
Function at 0x1400d5d70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400d5df7
mov rsi, rbx
cmp word [rax], bp
je 0x1400d5db6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400d5da0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400d5d9c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400d2300
mov rdi, rax
test rax, rax
je 0x1400d5de4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400bcbb0
mov rbp, rdi
xor ecx, ecx
call fcn.1400d22c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dabd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400dabf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400dabf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002ee0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rbp, r9
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x140002f23
lea r8d, [rdx + 0x1d]
lea rdx, str.CAECustomized::Init
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140061d00
test r8, r8
jne 0x140002f30
mov r8d, 0x1e
jmp 0x140002f01
test rbp, rbp
jne 0x140002f3b
lea r8d, [rbp + 0x1f]
jmp 0x140002f01
test dword [rdx + 0xa8], 0x10000000
jne 0x140002f6c
test byte [rdx + 0x134], 8
jne 0x140002f6c
test dword [rdx + 0xf4], 0x1000
jne 0x140002f6c
test dword [rdx + 0x148], 0x100
jne 0x140002f6c
xor eax, eax
jmp 0x140002f71
mov eax, 0x80
and dword [rcx], 0xffffff7f
lea r8, str.TESHLLED
or dword [rcx], eax
lea rdx, str.Customize
lea rcx, [0x14016b430]
xor r9d, r9d
call fcn.1400056a0
xor ecx, ecx
mov edx, 0x400000
cmp eax, 0x51e305a9
mov eax, dword [rdi]
cmove ecx, edx
btr eax, 0x16
or ecx, eax
mov dword [rdi], ecx
test edx, ecx
jne 0x140003037
call fcn.1400bae80
test eax, eax
je 0x140002fd3
mov eax, 0x1028
cmp word [rsp + 0x60], ax
jne 0x140002fd3
mov ecx, 0x4000
jmp 0x140002fd5
xor ecx, ecx
mov eax, dword [rdi]
lea r9, [rsp + 0x48]
btr eax, 0xe
mov dword [rsp + 0x48], 0
or eax, ecx
lea r8, str.DellAudioUINotExist
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONJackInfomation
lea ecx, [rax*8]
xor ecx, eax
and ecx, 0x20000
xor ecx, eax
mov eax, ecx
shl eax, 9
xor eax, ecx
and eax, 0x800000
xor eax, ecx
mov rcx, 0xffffffff80000002
mov dword [rdi], eax
call fcn.1400820c0
mov eax, dword [rsp + 0x48]
shl eax, 0x1a
xor eax, dword [rdi]
and eax, 0x4000000
xor dword [rdi], eax
mov ecx, dword [rdi]
mov eax, 0x103c
cmp word [rsp + 0x60], ax
je 0x1400030a6
mov r9d, 0x17aa
cmp word [rsp + 0x60], r9w
jne 0x1400030b4
movzx eax, word [rsp + 0x68]
mov edx, 0x6000
cmp ax, dx
jb 0x14000306a
mov edx, 0x67ff
cmp ax, dx
jbe 0x1400030b4
mov edx, 0x2301
cmp ax, dx
jne 0x1400030b4
bts ecx, 0x1c
mov dword [rsp + 0x60], edx
mov dword [rdi], ecx
lea rdx, str.CCustomizeLenovo::AECustomize
lea rcx, str._s__d_0x_04X_04X_DspR0_Copy_RSA1_R0_L_To_RSA1_R0_R
mov r8d, 0x12a
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140061d00
mov r9, rdi
mov r8, rbp
mov rcx, rbx
call fcn.140042580
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140005b80
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r9
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rdi
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140005d73
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r9, rbx
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e9be8]
lea rcx, [rsp + 0x38]
call fcn.140006bc0
mov rsi, qword [rsi + 8]
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x140005c29
mov r8d, 0xf0
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140061d00
jmp 0x140005d3c
test rbp, rbp
jne 0x140005c36
mov r8d, 0xf1
jmp 0x140005c11
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
mov rdx, rbx
mov rcx, rsi
call fcn.1400831a0
test eax, eax
jne 0x140005c8b
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140082470
test eax, eax
jne 0x140005c8b
mov r8d, 0xfa
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140061d00
nop
jmp 0x140005d3c
mov r9d, 2
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140027f60
test eax, eax
je 0x140005cd1
mov r8d, 0xff
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140061d00
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140005d3c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x140005d3c
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 3
xor r8d, r8d
mov rdx, rbp
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x140005d29
mov r8d, 0x103
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140061d00
nop
test rsi, rsi
je 0x140005d3c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x140005d3c
test rsi, rsi
je 0x140005d37
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, 1
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140005d59
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c5860
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3