joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bba0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp dword [0x140079af0], 0
je 0x14000bdab
test ecx, 0xfffffff8
jne 0x14000bdab
cmp ecx, 5
je 0x14000bdab
mov qword [rsp + 0x40], rbx
mov ebx, dword [0x140079b20]
mov qword [rsp + 0x48], rsi
mov esi, dword [0x140079b24]
mov qword [rsp + 0x30], rdi
mov edi, dword [0x140079b1c]
test ecx, 0xfffffffa
jne 0x14000bc02
cmp ecx, 5
je 0x14000bc02
xor eax, eax
cmp ecx, 1
sete al
mov dword [0x140079b1c], eax
lea eax, [rcx - 2]
cmp eax, 2
ja 0x14000bc18
xor eax, eax
cmp ecx, 3
sete al
mov dword [0x140079b20], eax
cmp ecx, 6
je 0x14000bc27
cmp ecx, 7
je 0x14000bc3b
cmp ecx, 4
jne 0x14000bc45
cmp ecx, 7
je 0x14000bc3b
mov dword [0x140079b24], 0
cmp ecx, 4
jne 0x14000bc45
mov dword [0x140079b24], 1
cmp edi, dword [0x140079b1c]
jne 0x14000bc55
cmp ebx, dword [0x140079b20]
je 0x14000bcc9
mov eax, dword [0x140079b20]
xor edx, edx
cmp dword [0x140079b1c], edx
setne dl
add edx, 0x300
neg eax
sbb ecx, ecx
and ecx, 2
add edx, ecx
lea rcx, str.AutoKeybdLight
call fcn.1400320f0
test edi, edi
jne 0x14000bc9c
cmp dword [0x140079b1c], edi
je 0x14000bc9c
lea edx, [rdi + 1]
lea rcx, str.AutoKeybdLightBrightenPrompt
call fcn.1400320f0
test ebx, ebx
jne 0x14000bcb7
cmp dword [0x140079b20], ebx
je 0x14000bcb7
lea edx, [rbx + 1]
lea rcx, str.AutoKeybdLightDimPrompt
call fcn.1400320f0
mov rcx, qword [0x140079b00]
test rcx, rcx
je 0x14000bcc9
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov eax, dword [0x140079b24]
cmp esi, eax
je 0x14000bd4c
xor edx, edx
lea rcx, str.KeybdBatteryAutoLight
test eax, eax
setne dl
call fcn.1400320f0
mov eax, dword [0x140079924]
cmp eax, 2
jne 0x14000bd14
mov ecx, dword [0x1400799b4]
cmp ecx, eax
jne 0x14000bd06
call fcn.14002aa70
mov ecx, dword [0x1400799b4]
xor eax, eax
cmp ecx, 1
sete al
mov dword [0x140079924], eax
cmp eax, 1
jne 0x14000bd4c
mov qword [rsp + 0x28], 0
lea r8, [0x14001c9e0]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14000bd4c
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [0x140079b08]
test rcx, rcx
je 0x14000bd70
cmp dword [0x140079b1c], 0
jne 0x14000bd6a
cmp dword [0x140079b20], 0
je 0x14000bd70
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp edi, dword [0x140079b1c]
mov rdi, qword [rsp + 0x30]
jne 0x14000bd8d
cmp ebx, dword [0x140079b20]
jne 0x14000bd8d
cmp esi, dword [0x140079b24]
je 0x14000bd97
mov ecx, 1
call fcn.14000be70
mov rsi, qword [rsp + 0x48]
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000bf70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
xor edi, edi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
xor edx, edx
call fcn.140031c50
test eax, eax
je 0x14000c011
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.PriorKeybdLightLevel
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000bfeb
mov ebx, dword [rsp + 0x3c]
lea edi, [rax + 1]
jmp 0x14000bfef
mov ebx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x14000c011
cmp ebx, 3
ja 0x14000c011
test rsi, rsi
je 0x14000c00a
mov dword [rsi], ebx
mov eax, 1
jmp 0x14000c013
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000c4a0
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x58
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp dword [0x14007b31c], 0
mov rsi, r9
mov r14, r8
mov ebp, edx
mov edi, ecx
je 0x14000c657
cmp ecx, 2
ja 0x14000c650
cmp dword [0x14007b304], 0
mov qword [rsp + 0x50], rbx
je 0x14000c5b2
mov rax, qword [0x14007d110]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000c64b
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 0x60078
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov dword [rsp + 0x30], 4
lea rdx, [rsp + 0x34]
mov ecx, 0x53545344
call fcn.140006780
test eax, eax
je 0x14000c64b
xor ebx, ebx
cmp dword [rsp + 0x30], 4
cmovae ebx, dword [rsp + 0x38]
bt ebx, 0x10
jae 0x14000c64b
movzx ebx, bx
mov ecx, ebx
call fcn.14000c450
mov edx, ebx
lea rcx, str.CameraShutter
call fcn.1400320f0
cmp dword [0x14007b318], 0
je 0x14000c584
mov rcx, qword [0x14007d010]
test rcx, rcx
je 0x14000c584
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test ebp, ebp
je 0x14000c64b
test r14, r14
je 0x14000c598
mov dword [r14], 0x85
test rsi, rsi
je 0x14000c64b
mov dword [rsi], ebx
mov eax, 1
mov rbx, qword [rsp + 0x50]
jmp 0x14000c659
cmp dword [0x14007b300], 0
jne 0x14000c64b
xor ebx, ebx
cmp ecx, 2
jne 0x14000c5d3
call fcn.14000c8f0
test eax, eax
mov edi, ebx
sete dil
mov ecx, edi
call fcn.14000c450
mov edx, edi
lea rcx, str.CameraShutter
call fcn.1400320f0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007b310]
mov qword [0x14007b308], rax
test rcx, rcx
je 0x14000c609
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x14000c634
mov qword [rsp + 0x28], rbx
lea r8, [0x14000c760]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14000c634
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebp, ebp
je 0x14000c64b
test r14, r14
je 0x14000c644
mov dword [r14], 0x85
test rsi, rsi
je 0x14000c64b
mov dword [rsi], edi
mov rbx, qword [rsp + 0x50]
mov eax, 1
jmp 0x14000c659
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c8f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor esi, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov ebx, 1
call fcn.140031c50
test eax, eax
je 0x14000c9a3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x60], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CameraShutter
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c96c
mov edi, dword [rsp + 0x3c]
mov esi, ebx
jmp 0x14000c970
mov edi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0x14000c984
cmp edi, ebx
cmovbe ebx, edi
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, ebx
jmp 0x14000c98b
Function at 0x14000d470
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov eax, dword [0x14007993c]
xor ebx, ebx
cmp eax, 2
jne 0x14000d5b5
lea rcx, str.679E3D4C_DD35_4970_88B5_78BBB8887206
mov dword [0x14007993c], ebx
call fcn.14000d3c0
test eax, eax
je 0x14000d5af
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.1400423d0
mov edx, 0x104
lea rcx, [rsp + 0x250]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000d5af
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.1400423d0
lea r9, [rsp + 0x250]
mov edx, 0x104
lea r8, str._sASVidDMFT.dll
lea rcx, [rsp + 0x40]
call fcn.14000a160
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000d5af
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea r9, [rsp + 0x250]
mov edx, 0x104
lea r8, str._slibarcsoft_video_enhance.dll
lea rcx, [rsp + 0x40]
call fcn.14000a160
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000d5af
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
mov dword [0x14007993c], eax
jmp 0x14000d5b5
mov eax, dword [0x14007993c]
cmp eax, 1
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x470
pop rbx
ret
Function at 0x14000d5e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rax, [rbp - 0x20]
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rbp - 0x20], rbx
mov r9d, 0x20019
lea rdx, str.SOFTWAREArcSoftASVidDMFTSettings
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d74f
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x14]
mov dword [rbp - 0x18], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.VideoBokeh
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
lea edi, [rbx + 1]
test eax, eax
jne 0x14000d681
cmp dword [rbp - 0x14], edi
jne 0x14000d681
lea ebx, [rdi + 1]
jmp 0x14000d73a
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.EyeCorrection
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d6c0
cmp dword [rbp - 0x18], edi
jne 0x14000d6c0
lea ebx, [rax + 3]
jmp 0x14000d73a
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AutoZoom
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d6ff
cmp dword [rbp - 0x18], edi
jne 0x14000d6ff
lea ebx, [rax + 4]
jmp 0x14000d73a
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NightVideo
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d73a
cmp dword [rbp - 0x18], edi
cmove ebx, edi
test rsi, rsi
je 0x14000d741
mov dword [rsi], ebx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
jmp 0x14000d7a6
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREArcSoftASVidDMFTSettings
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000d7a4
test rsi, rsi
je 0x14000d793
mov dword [rsi], ebx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 1
jmp 0x14000d7a6
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400406e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000dfe0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], rbx
call fcn.140031c50
test eax, eax
je 0x14000e097
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x60], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CameraIntelligent
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e05d
mov edi, dword [rsp + 0x3c]
lea esi, [rbx + 1]
jmp 0x14000e063
mov edi, dword [rsp + 0x40]
mov esi, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
mov rsi, qword [rsp + 0x60]
je 0x14000e07d
cmp edi, 4
cmovbe ebx, edi
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x50
pop rbx
ret
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x50
pop rbx
ret
Function at 0x14000e1f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rax, [rbp - 0x20]
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rbp - 0x20], rbx
mov r9d, 0x20019
lea rdx, str.SOFTWAREMirametrixDMFTIPC
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e35f
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x14]
mov dword [rbp - 0x18], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.FaceBeautification
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
lea edi, [rbx + 1]
test eax, eax
jne 0x14000e291
cmp dword [rbp - 0x14], edi
jne 0x14000e291
lea ebx, [rdi + 4]
jmp 0x14000e34a
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.UserFraming
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e2d0
cmp dword [rbp - 0x18], edi
jne 0x14000e2d0
lea ebx, [rax + 4]
jmp 0x14000e34a
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.BackgroundBlur
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e30f
cmp dword [rbp - 0x18], edi
jne 0x14000e30f
lea ebx, [rax + 2]
jmp 0x14000e34a
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.FaceIllumination
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e34a
cmp dword [rbp - 0x18], edi
cmove ebx, edi
test rsi, rsi
je 0x14000e351
mov dword [rsi], ebx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
jmp 0x14000e3b6
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMirametrixDMFTIPC
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000e3b4
test rsi, rsi
je 0x14000e3a3
mov dword [rsi], ebx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 1
jmp 0x14000e3b6
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400406e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000e3e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14d, edx
mov esi, ecx
xor ebx, ebx
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], rbx
call fcn.140031c50
test eax, eax
je 0x14000e48b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x60], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CameraPromptCount
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e468
mov edi, dword [rsp + 0x3c]
lea ebp, [rbx + 1]
jmp 0x14000e46e
mov edi, dword [rsp + 0x40]
mov ebp, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebp, ebp
mov rbp, qword [rsp + 0x60]
je 0x14000e48b
cmp edi, 3
ja 0x14000e48b
mov ebx, edi
jae 0x14000e494
test esi, esi
jne 0x14000e4b9
test r14d, r14d
jne 0x14000e4be
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
cmp esi, 2
jne 0x14000e4d1
mov edx, 3
lea rcx, str.CameraPromptCount
call fcn.1400320f0
jmp 0x14000e496
cmp esi, 1
jne 0x14000e494
lea edx, [rbx + 1]
lea rcx, str.CameraPromptCount
call fcn.1400320f0
jmp 0x14000e496
Function at 0x14000ece0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], rbx
call fcn.140031c50
test eax, eax
je 0x14000ed6f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ChkExternalDisplay
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ed53
mov edi, dword [rsp + 0x3c]
lea ebx, [rax + 1]
jmp 0x14000ed57
mov edi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
je 0x14000ed6f
cmp edi, 1
jne 0x14000ed6f
mov eax, edi
jmp 0x14000ed71
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14000f070
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x178
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebx, ebx
mov qword [r11 + 0x20], r14
mov eax, ebx
mov qword [r11 - 0x18], r15
test ecx, ecx
mov esi, ecx
sete al
mov r15d, eax
lea rax, [0x14007b3c0]
cmp dword [rax + r15*4], ebx
lea r14, [rax + r15*4]
jne 0x14000f0df
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14000f0df
test esi, esi
mov dword [rsp + 0x20], ebx
mov edx, 0x24
mov eax, 0xf
cmovne edx, eax
mov r8, r14
xor r9d, r9d
call fcn.14003d1c0
xor edx, edx
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x38]
call fcn.140031c50
test eax, eax
je 0x14000f172
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x198], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MultipleRefreshRate
mov qword [rsp + 0x1a0], rdi
mov dword [rsp + 0x40], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000f147
mov edi, dword [rsp + 0x44]
lea ebp, [rax + 1]
jmp 0x14000f14d
mov edi, dword [rsp + 0x30]
mov ebp, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebp, ebp
mov rbp, qword [rsp + 0x198]
je 0x14000f16a
cmp edi, 1
cmovbe ebx, edi
mov rdi, qword [rsp + 0x1a0]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400423d0
mov r9d, dword [r14]
lea r8, str.LaunchRefreshRateSupported_0x_x___d___d
mov edx, 0x104
mov dword [rsp + 0x28], ebx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], r15d
call fcn.140006720
mov rcx, qword [0x140079b70]
lea rax, [0x140079b70]
mov r15, qword [rsp + 0x170]
cmp rcx, rax
je 0x14000f1df
test byte [rcx + 0x1c], 4
je 0x14000f1df
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x50]
mov edx, 0xb
mov qword [rsp + 0x20], rax
call fcn.14003f070
lea rcx, [rsp + 0x50]
call fcn.14003fe60
mov edx, dword [r14]
mov r14, qword [rsp + 0x1a8]
lea eax, [rdx - 0x101]
test eax, 0xfffffffd
je 0x14000f236
lea eax, [rdx - 0x104]
test eax, 0xfffffff9
jne 0x14000f21b
cmp edx, 0x106
je 0x14000f21b
cmp ebx, 1
je 0x14000f24d
test esi, esi
je 0x14000f232
cmp ebx, 1
jne 0x14000f232
xor edx, edx
lea rcx, str.MultipleRefreshRate
call fcn.1400320f0
xor eax, eax
jmp 0x14000f252
test esi, esi
je 0x14000f24d
test ebx, ebx
jne 0x14000f24d
lea edx, [rbx + 1]
lea rcx, str.MultipleRefreshRate
call fcn.1400320f0
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x178
pop rsi
pop rbx
ret
Function at 0x14000fdb0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp qword [0x14007b3b0], 0
je 0x14000fe18
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rdx, qword [0x14007b3a8]
test rdx, rdx
je 0x14000fddf
mov rcx, rax
sub rcx, rdx
cmp rcx, 0x7d0
jbe 0x14000fe18
mov qword [0x14007b3a8], rax
lea r8, [0x14000fe20]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14000fe18
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
add rsp, 0x38
ret