joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d060
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebp, ecx
lea r8, str.GlobalASUS_ASLDRSrv_Slate_Indicator_Event
mov ecx, 0x100002
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
mov rdi, rax
test rax, rax
je 0x14000d1b6
mov qword [rsp + 0x60], rbx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
xor ebx, ebx
mov ecx, 0x2003
test eax, eax
sete bl
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
xor esi, esi
test eax, eax
sete sil
cmp ebx, esi
je 0x14000d19e
mov rcx, rdi
test esi, esi
je 0x14000d17f
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test ebp, ebp
je 0x14000d185
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov ebx, 1
call fcn.14000fc40
test eax, eax
je 0x14000d158
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.QuietFanSlatePrompt
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d148
cmp dword [rsp + 0x3c], ebx
cmovbe ebx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp ebx, 1
jne 0x14000d185
call fcn.14000d1d0
lea rdx, str._prompt_fanslateai
test eax, eax
lea rcx, str._prompt_fanslate
cmovne rcx, rdx
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.1400187f0
jmp 0x14000d185
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov edx, 2
mov qword [rsp + 0x28], 0
mov r8d, esi
lea ecx, [rdx + 0xf]
call fcn.14000e470
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001a990
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000d500
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test ecx, ecx
je 0x14000d575
cmp qword [0x14004e448], rbx
jne 0x14000d539
mov qword [rsp + 0x28], rbx
lea r8, [0x14000d5e0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x14004e448], rax
cmp qword [0x14004e440], rbx
jne 0x14000d5cb
mov qword [rsp + 0x28], rbx
lea r8, [0x14000e7d0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x14004e440], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [0x14004e440]
test rcx, rcx
je 0x14000d5a0
mov edx, 0x9c4
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x14004e440]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14004e440], rbx
mov rcx, qword [0x14004e448]
test rcx, rcx
je 0x14000d5cb
mov edx, 0x9c4
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x14004e448]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14004e448], rbx
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14000e5a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x70
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov ebx, ebp
cmp dword [0x14004ef70], ebx
jbe 0x14000e7b2
lea r8, str.GlobalAsLdrSrv_NamedPipeMux
mov qword [rsp + 0x80], rsi
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenMutexW]
lea rsi, [0x14004ee70]
test rax, rax
je 0x14000e76e
mov rcx, rax
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop word [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
lea rcx, str..pipeAsLdrSrv_NamedPipeCommand
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e680
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xe7
jne 0x14000e766
mov edx, 0x7d0
lea rcx, str..pipeAsLdrSrv_NamedPipeCommand
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_WaitNamedPipeW]
test eax, eax
jne 0x14000e610
jmp 0x14000e766
mov eax, dword [0x14004ef70]
test eax, eax
je 0x14000e758
movaps xmm0, xmmword [0x14004ee70]
add eax, 0xffffffff
movaps xmm1, xmmword [0x14004ee80]
mov edx, ebp
movups xmmword [rsp + 0x48], xmm0
mov dword [0x14004ef70], eax
movups xmmword [rsp + 0x58], xmm1
je 0x14000e717
nop dword [rax]
nop word [rax + rax]
lea ebx, [rdx + 1]
mov eax, edx
mov ecx, ebx
shl rcx, 5
add rcx, rsi
shl rax, 5
add rax, rsi
je 0x14000e6fb
test rcx, rcx
je 0x14000e6ec
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
jmp 0x14000e70b
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
call fcn.14001f60c
mov dword [rax], 0x16
call fcn.14001f4ec
mov eax, dword [0x14004ef70]
mov edx, ebx
cmp ebx, eax
jb 0x14000e6c0
xor ecx, ecx
shl rax, 5
add rax, rsi
mov dword [rsp + 0x40], 0x20
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x48]
lea r8d, [rcx + 0x20]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
jmp 0x14000e680
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ebx, 1
mov rdi, qword [rsp + 0x88]
mov edx, ebp
cmp dword [0x14004ef70], edx
jbe 0x14000e7a4
nop dword [rax + rax]
xor eax, eax
mov ecx, edx
shl rcx, 5
inc edx
add rcx, rsi
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
cmp edx, dword [0x14004ef70]
jb 0x14000e780
mov rsi, qword [rsp + 0x80]
mov dword [0x14004ef70], ebp
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001a990
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
ret
Function at 0x14000f000
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, edx
test ecx, ecx
je 0x14000f107
mov eax, dword [0x1400479b8]
xor ebx, ebx
cmp eax, 2
jne 0x14000f036
test edx, edx
je 0x14000f18a
mov dword [0x1400479b8], ebx
jmp 0x14000f03e
test eax, eax
jne 0x14000f18a
mov rax, qword [0x14004f1d0]
test rax, rax
je 0x14000f18a
cmp qword [0x14004f1c8], rbx
je 0x14000f18a
lea rdx, str.AsusFoldableSwitcher
lea rcx, str.ASUSFOLDABLESWITCHER
call qword [0x1400335f0]
mov rsi, rax
test rax, rax
je 0x14000f18a
mov dword [0x1400479b8], 1
mov dword [0x1400479b4], 2
call fcn.14000f340
lea rcx, [0x1400479b0]
call fcn.14000f5c0
cmp qword [0x14004e480], rbx
jne 0x14000f0cd
mov qword [rsp + 0x28], rbx
lea r8, [0x14000f680]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x14004e480], rax
test edi, edi
je 0x14000f175
mov edx, dword [0x14004e740]
xor r9d, r9d
mov rax, qword [0x14004f1c8]
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [0x1400335f0]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [0x1400479b8], 1
jne 0x14000f18a
mov rcx, qword [0x14004e490]
xor ebx, ebx
mov dword [0x1400479b8], ebx
test rcx, rcx
je 0x14000f131
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14004e490], rbx
mov rcx, qword [0x14004e488]
test rcx, rcx
je 0x14000f14a
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14004e488], rbx
mov rcx, qword [0x14004e480]
test rcx, rcx
je 0x14000f175
mov edx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x14004e480]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14004e480], rbx
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000f5c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotationNonPreserve
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000f65c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.LastAutoRequest
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000f651
mov eax, dword [rsp + 0x3c]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001a990
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000f890
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, ecx
cmp ecx, 2
jbe 0x14000f8d0
cmp ecx, 3
jne 0x14000f9c7
call fcn.14000f9f0
lea eax, [rbx - 2]
jmp 0x14000f9c9
xor esi, esi
lea rax, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPrecisionTouchPadStatus
mov rcx, 0xffffffff80000001
mov ebp, esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000f9c7
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rdx, str.Enabled
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000f94e
mov edi, dword [rsp + 0x38]
cmp edi, 1
ja 0x14000f94e
lea ebp, [rsi + 1]
jmp 0x14000f952
mov edi, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebp, ebp
je 0x14000f9c7
cmp ebx, 2
jne 0x14000f9a4
mov rcx, qword [0x14004d840]
test rcx, rcx
je 0x14000f9c0
mov rax, qword [0x14004f1c8]
test rax, rax
je 0x14000f9c0
mov edx, dword [0x14004e760]
test edx, edx
je 0x14000f9c0
cmp edi, 1
sete sil
xor r8d, r8d
lea r9, [rsi + 0x600]
call qword [0x1400335f0]
lea eax, [rbx - 1]
jmp 0x14000f9c9
test ebx, ebx
jne 0x14000f9b2
cmp edi, 1
je 0x14000f9bb
lea eax, [rbx + 1]
jmp 0x14000f9c9
cmp ebx, 1
jne 0x14000f9c0
test edi, edi
jne 0x14000f9c0
call fcn.14000f9f0
mov eax, 1
jmp 0x14000f9c9
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001a990
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000fd10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ebx, ebx
lea rax, [rsp + 0x30]
mov rdi, r9
mov qword [rsp + 0x30], rbx
mov rsi, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea r9d, [rbx + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fdc7
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.14001c070
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov dword [rsp + 0x3c], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000fdbc
lea r8, [rsp + 0x40]
mov edx, 0x104
mov rcx, rdi
call fcn.14001f62c
mov ebx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001a990
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000fdf0
Capabilities:
Persist via screensaver registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r9
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fec1
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.14001c070
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14001f62c
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x14000fe74
lea ecx, [rax*2 + 2]
mov edi, 1
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
lea rdx, str.SCRNSAVE.EXE
mov r9d, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmove ebx, edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001a990
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140010d10
Capabilities:
Get process image filename

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp dword [0x140047964], 0
je 0x140010e63
call fcn.140012d00
test eax, eax
je 0x140010e63
cmp dword [0x14004796c], 0
jne 0x140010d62
mov ecx, 0x20
call fcn.140013150
mov eax, 1
jmp 0x140010e65
mov rax, qword [0x14004f1d0]
test rax, rax
je 0x140010e63
cmp qword [0x14004f2c0], 0
je 0x140010e63
cmp qword [0x14004f210], 0
je 0x140010e63
lea rdx, str.Windows_Default_Lock_Screen
lea rcx, str.Windows.UI.Core.CoreWindow
call qword [0x1400335f0]
mov rbx, rax
test rax, rax
je 0x140010e63
mov rax, qword [0x14004f2c0]
call qword [0x1400335f0]
cmp rax, rbx
jne 0x140010e63
mov rax, qword [0x14004f210]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0
call qword [0x1400335f0]
mov r8d, dword [rsp + 0x20]
test r8d, r8d
je 0x140010e63
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140010e63
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14001c070
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x140010e5a
lea rdx, str.Microsoft.LockApp_cw5n1h2txyewy
lea rcx, [rsp + 0x30]
call fcn.14001b900
test rax, rax
je 0x140010e5a
mov ecx, 0x20
call fcn.140013150
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
jmp 0x140010e65
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001a990
add rsp, 0x250
pop rbx
ret
Function at 0x140010e80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, qword [0x14004d840]
lea r8, str.GlobalASUS_ASLDRSrv_OLED_Protection_Event
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
mov rdi, rax
test rax, rax
je 0x140011094
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.14001c070
lea rcx, [rsp + 0x40]
call fcn.140011690
test eax, eax
je 0x14001102d
mov qword [rsp + 0x270], rbx
mov rcx, qword [0x14004a6a8]
lea rax, [0x14004a6a8]
cmp rcx, rax
je 0x140010f1e
test byte [rcx + 0x1c], 8
je 0x140010f1e
mov rcx, qword [rcx + 0x10]
lea rax, str.OLED_screen_saver_is_existing
mov qword [rsp + 0x20], rax
call fcn.140019c20
mov rcx, rdi
mov dword [0x14004e4f4], 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov ebx, 0x708
call fcn.14000fc40
test eax, eax
je 0x140010f9f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.OLEDProtectScreensaver
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140010f94
mov ecx, dword [rsp + 0x3c]
lea eax, [rcx - 0x3c]
cmp eax, 0xdd4
cmovbe ebx, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [rbx + rbx*4]
add eax, eax
mov dword [0x1400479c8], eax
call fcn.140011b50
mov rbx, qword [rsp + 0x270]
cmp eax, 1
jne 0x140011026
mov eax, dword [0x14004e4f0]
cmp eax, 1
jne 0x140010fd2
cmp dword [0x14004e4e8], 0
je 0x140011026
jmp 0x140010fd6
test eax, eax
je 0x140010ff0
mov rax, qword [0x14004f238]
test rax, rax
je 0x140010ff0
mov edx, 0x32
mov rcx, rsi
call qword [0x1400335f0]
mov rax, qword [0x14004f230]
mov dword [0x14004e4f0], 1
mov dword [0x14004e4e8], 0
test rax, rax
je 0x140011026
xor r9d, r9d
mov r8d, 0x7530
mov rcx, rsi
lea edx, [r9 + 0x32]
call qword [0x1400335f0]
call fcn.140011750
jmp 0x140011036
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov eax, dword [0x14004e4ec]
cmp eax, 1
je 0x14001108b
test eax, eax
je 0x14001105f
mov rax, qword [0x14004f238]
test rax, rax
je 0x14001105f
mov edx, 0x33
mov rcx, rsi
call qword [0x1400335f0]
mov rax, qword [0x14004f230]
mov dword [0x14004e4ec], 1
test rax, rax
je 0x14001108b
xor r9d, r9d
mov r8d, 0xea60
mov rcx, rsi
lea edx, [r9 + 0x33]
call qword [0x1400335f0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [0x14004e4f4]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001a990
mov rsi, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x1400110c0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [0x14004e4f4], 0
mov rdi, rcx
je 0x14001133e
mov rax, qword [0x14004f268]
test rax, rax
je 0x14001133e
cmp qword [0x14004f2c8], 0
je 0x14001133e
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 8
call qword [0x1400335f0]
test eax, eax
je 0x14001133e
mov eax, dword [rsp + 0x34]
cmp dword [0x14004e4e4], eax
mov qword [rsp + 0x58], rbx
jb 0x1400112a6
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ecx, dword [0x14004e4e4]
mov edx, eax
mov r8d, dword [0x14004e4e0]
cmp eax, ecx
cmovb ecx, eax
mov eax, 0x51eb851f
sub edx, ecx
mov dword [0x14004e4e4], ecx
mov ecx, dword [0x1400479c8]
mul edx
shr edx, 5
lea eax, [rdx + 0x64]
cmp eax, ecx
jb 0x1400111f0
test r8d, r8d
jne 0x1400111f0
mov rcx, qword [0x14004a6a8]
lea rax, [0x14004a6a8]
cmp rcx, rax
je 0x1400111a3
test byte [rcx + 0x1c], 8
je 0x1400111a3
mov rcx, qword [rcx + 0x10]
lea rax, str.OLED_screen_saver_timeout
mov qword [rsp + 0x20], rax
call fcn.140019c20
mov dword [0x14004e4e0], 1
call fcn.1400118b0
xor ebx, ebx
test eax, eax
je 0x1400112d4
mov qword [rsp + 0x28], rbx
lea r8, [0x140011970]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x1400112d4
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x1400112d4
lea eax, [rdx + 0x258]
cmp eax, ecx
jb 0x140011339
test r8d, r8d
jne 0x140011339
lea eax, [rdx + 0xc8]
cmp eax, ecx
jb 0x140011240
cmp dword [0x14004e4d4], r8d
jne 0x140011240
mov dword [0x14004e4d4], 1
call fcn.1400118b0
test eax, eax
je 0x140011240
xor r8d, r8d
lea rcx, str._prompt_scrstart
lea edx, [r8 + 1]
call fcn.1400187f0
mov eax, dword [0x14004e4f0]
cmp eax, 1
jne 0x140011259
cmp dword [0x14004e4e8], eax
je 0x140011339
jmp 0x14001125d
test eax, eax
je 0x140011277
mov rax, qword [0x14004f238]
test rax, rax
je 0x140011277
mov edx, 0x32
mov rcx, rdi
call qword [0x1400335f0]
mov rax, qword [0x14004f230]
mov dword [0x14004e4f0], 1
mov dword [0x14004e4e8], 1
test rax, rax
je 0x140011339
mov r8d, 0x1388
jmp 0x140011329
xor ebx, ebx
mov dword [0x14004e4e4], eax
cmp dword [0x14004e4e0], ebx
je 0x1400112ce
mov rcx, qword [0x14004e4d8]
mov dword [0x14004e4e0], ebx
test rcx, rcx
je 0x1400112ce
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov dword [0x14004e4d4], ebx
mov eax, dword [0x14004e4f0]
cmp eax, 1
jne 0x1400112e9
cmp dword [0x14004e4e8], ebx
je 0x140011339
jmp 0x1400112ed
test eax, eax
je 0x140011307
mov rax, qword [0x14004f238]
test rax, rax
je 0x140011307
mov edx, 0x32
mov rcx, rdi
call qword [0x1400335f0]
mov rax, qword [0x14004f230]
mov dword [0x14004e4e8], ebx
mov dword [0x14004e4f0], 1
test rax, rax
je 0x140011339
mov r8d, 0x7530
xor r9d, r9d
mov rcx, rdi
lea edx, [r9 + 0x32]
call qword [0x1400335f0]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001a990
add rsp, 0x40
pop rdi
ret