joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056280
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
call fcn.140014190
lea r9, [0x1400e8328]
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
xor edx, edx
mov rcx, rax
call fcn.14009cf00
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call fcn.140014190
cmp byte [rax + 0x64], bl
je 0x140056319
lea ecx, [rbx + 0x28]
call fcn.140095e50
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140056314
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], rax
call fcn.140014190
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov rdx, rax
mov rcx, rsi
call fcn.140098570
mov rbx, rax
mov qword [rsp + 0x30], rbx
cmp qword [r14 + 0x28], 0
je 0x140056441
mov rsi, rdi
cmp qword [rdi + 0x18], 8
jb 0x140056331
mov rsi, qword [rdi]
call fcn.140014190
mov qword [rsp + 0x20], rsi
lea r9, str.Saving_this_user_config_to_registry:__s
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov edx, 2
mov rcx, rax
call fcn.14009cf00
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140056363
mov rcx, qword [rdi]
lea rdx, [r14 + 0x98]
cmp qword [rdx + 0x18], 8
jb 0x140056374
mov rdx, qword [rdx]
mov eax, dword [rdi + 0x10]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x1400563be
call fcn.140014190
lea r9, str.Failed_to_save_user_config.
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov edx, 5
mov rcx, rax
call fcn.14009cf00
mov ecx, 0x1f4
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
call fcn.1400491a0
test al, al
je 0x14005641f
call fcn.140049440
test al, al
je 0x1400563fd
call fcn.140014190
lea r9, str.Sucessfully_loaded_user_config.
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov edx, 3
mov rcx, rax
call fcn.14009cf00
jmp 0x140056461
call fcn.140014190
lea r9, str.Failed_to_load_user_config.
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov edx, 5
mov rcx, rax
call fcn.14009cf00
jmp 0x140056461
call fcn.140014190
lea r9, str.Failed_to_clear_user_config.
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov edx, 5
mov rcx, rax
call fcn.14009cf00
jmp 0x140056461
call fcn.140014190
lea r9, str.Invalid_config_registry_key.
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov edx, 5
mov rcx, rax
call fcn.14009cf00
call fcn.140014190
lea r9, [0x1400e8328]
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveConfig
mov edx, 1
mov rcx, rax
call fcn.14009cf00
nop
test rbx, rbx
je 0x14005649d
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
nop
jmp 0x1400564a4
mov rcx, rdi
call fcn.140012b50
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400964b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400564d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
call fcn.140014190
lea r9, [0x1400e8328]
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveState
xor edx, edx
mov rcx, rax
call fcn.14009cf00
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call fcn.140014190
cmp byte [rax + 0x64], bl
je 0x140056569
lea ecx, [rbx + 0x28]
call fcn.140095e50
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140056564
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], rax
call fcn.140014190
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveState
mov rdx, rax
mov rcx, rsi
call fcn.140098570
mov rbx, rax
mov qword [rsp + 0x30], rbx
cmp qword [r14 + 0x28], 0
je 0x140056610
mov rsi, rdi
cmp qword [rdi + 0x18], 8
jb 0x140056581
mov rsi, qword [rdi]
call fcn.140014190
mov qword [rsp + 0x20], rsi
lea r9, str.Saving_state_info_to_registry:__s
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveState
mov edx, 2
mov rcx, rax
call fcn.14009cf00
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400565b3
mov rcx, qword [rdi]
lea rdx, [r14 + 0xd8]
cmp qword [rdx + 0x18], 8
jb 0x1400565c4
mov rdx, qword [rdx]
mov eax, dword [rdi + 0x10]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x140056630
call fcn.140014190
lea r9, str.Failed_to_save_state_info.
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveState
mov edx, 5
mov rcx, rax
call fcn.14009cf00
jmp 0x140056630
call fcn.140014190
lea r9, str.Invalid_config_key.
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveState
mov edx, 5
mov rcx, rax
call fcn.14009cf00
call fcn.140014190
lea r9, [0x1400e8328]
lea r8, str.ProgrammableKey::PKRegistrySetting::SaveState
mov edx, 1
mov rcx, rax
call fcn.14009cf00
nop
test rbx, rbx
je 0x14005666c
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
nop
jmp 0x140056673
mov rcx, rdi
call fcn.140012b50
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400964b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14006aa80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.CMainService::CreateQTMonitor
xor edx, edx
call fcn.14009cf00
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x30], rbx
mov esi, edi
call fcn.140014190
cmp byte [rax + 0x64], sil
je 0x14006ab1d
lea ecx, [rdi + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14006ab12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.CMainService::CreateQTMonitor
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x14006ab15
mov rbx, rdi
mov qword [rsp + 0x30], rbx
mov rsi, rbx
cmp qword [0x140137820], 0
jne 0x14006abae
mov dword [rsp + 0x38], edi
call fcn.140014190
mov rcx, rax
lea r9, str.Starting_Create_QP_Monitor_Thread
lea r8, str.CMainService::CreateQTMonitor
mov edx, 3
call fcn.14009cf00
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x14006ac10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140137820], rax
cmp qword [0x140137818], 0
jne 0x14006abae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Failed_to_create_Quick_Panel_Monitor_thread_:__d
lea r8, str.CMainService::CreateQTMonitor
mov edx, 5
call fcn.14009cf00
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.CMainService::CreateQTMonitor
mov edx, 1
call fcn.14009cf00
nop
test rsi, rsi
je 0x14006abe9
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400964b0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14006d0b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.CMainService::ReadSysInfo
xor edx, edx
call fcn.14009cf00
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x30], rbx
mov ebp, edi
call fcn.140014190
cmp byte [rax + 0x64], bpl
je 0x14006d152
lea ecx, [rdi + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14006d147
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.CMainService::ReadSysInfo
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x14006d14a
mov rbx, rdi
mov qword [rsp + 0x30], rbx
mov rbp, rbx
mov sil, 1
cmp qword [0x140137810], 0
jne 0x14006d1e8
mov dword [rsp + 0x38], edi
call fcn.140014190
mov rcx, rax
lea r9, str.Starting_Read_SysInfo_Thread
lea r8, str.CMainService::ReadSysInfo
mov edx, 3
call fcn.14009cf00
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, qword [0x140137808]
lea r8, [0x14006d260]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140137810], rax
test rax, rax
jne 0x14006d1e8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Failed_to_create_ReadSysInfo_thread_:__d
lea r8, str.CMainService::ReadSysInfo
mov edx, 5
call fcn.14009cf00
xor sil, sil
movzx edi, sil
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.ReadSysInfo_return___d
lea r8, str.CMainService::ReadSysInfo
mov edx, 1
call fcn.14009cf00
nop
test rbp, rbp
je 0x14006d22b
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400964b0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14006e010
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x8a0
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x890], rax
movups xmm0, xmmword [str.HotKeyServiceUWP]
movzx eax, word [0x1400f6510]
mov rbx, rdx
movups xmm1, xmmword [0x1400f6500]
movzx edi, cx
xor edx, edx
mov r8d, 0x800
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x82]
movaps xmmword [rsp + 0x70], xmm1
mov word [rsp + 0x80], ax
call fcn.1400a57c0
lea rsi, [rsp + 0x8d0]
call fcn.140015930
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x80]
xor esi, esi
mov r9, rbx
mov r8d, 0x400
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
call fcn.1400b7940
lea rdx, str.HotKeyServiceUWP
xor ecx, ecx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_RegisterEventSourceW]
mov rbx, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x14006e13c
mov edx, edi
test edi, edi
je 0x14006e0fb
sub edx, 1
je 0x14006e0f3
sub edx, 1
je 0x14006e0eb
mov r9d, 0x60000000
jmp 0x14006e101
mov r9d, 0xa0000000
jmp 0x14006e101
mov r9d, 0xe0000000
jmp 0x14006e101
mov r9d, 0x20000000
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov ecx, 1
mov dword [rsp + 0x30], esi
movzx edx, di
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rsi
lea r8d, [rcx + 1]
mov rcx, rbx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.1400964b0
add rsp, 0x8a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006e160
Capabilities:
Create service
Modify service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4c0
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, qword [rsp + 0x520]
mov rbp, r8
mov r12, qword [rsp + 0x528]
mov rdi, rdx
mov r13, qword [rsp + 0x530]
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
mov r14d, r9d
call fcn.1400a57c0
xor edx, edx
lea rcx, [rsp + 0x290]
mov r8d, 0x20c
call fcn.1400a57c0
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x14006e206
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.14003f080
jmp 0x14006e32a
lea r9, [rsp + 0x80]
mov qword [rsp + 0x4b8], rbx
lea r8, str.__s_
mov edx, 0x106
lea rcx, [rsp + 0x290]
call fcn.14006e560
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14006e25e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.14003f080
jmp 0x14006e322
mov qword [rsp + 0x60], r13
xor eax, eax
mov qword [rsp + 0x58], r12
mov r9d, 0xf01ff
mov qword [rsp + 0x50], r15
mov r8, rdi
mov qword [rsp + 0x48], rax
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov rcx, rbx
lea rax, [rsp + 0x290]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14006e2d1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.14003f080
mov rcx, rbx
jmp 0x14006e31c
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14006e301
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.ChangeServiceConfig2__SERVICE_CONFIG_DESCRIPTION__failed_w_err_0x_08lx_n
call fcn.14003f080
mov rdx, rsi
lea rcx, str._s_is_installed._n
call fcn.14003f080
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400964b0
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006e350
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
xor ebp, ebp
mov edi, ebp
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x28]
call fcn.14009dd10
nop
xor edx, edx
xor ecx, ecx
lea r8d, [rbp + 1]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14006e3c7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.14003f080
jmp 0x14006e4c4
mov r8d, 0x10024
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14006e3fa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.14003f080
jmp 0x14006e4c4
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x14006e492
mov rdx, rbx
lea rcx, str.Stopping__s.
call fcn.14003f080
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
je 0x14006e473
mov eax, dword [rsp + 0x34]
cmp eax, 3
jne 0x14006e477
lea rcx, [0x1400eda00]
call fcn.14003f080
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x14006e441
mov eax, dword [rsp + 0x34]
mov rdx, rbx
cmp eax, 1
lea rcx, str._n_s_is_stopped._n
je 0x14006e48d
lea rcx, str._n_s_failed_to_stop._n
call fcn.14003f080
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14006e4b5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.14003f080
jmp 0x14006e4c4
mov rdx, rbx
lea rcx, str._s_is_removed._n
call fcn.14003f080
mov ebx, ebp
nop word [rax + rax]
mov dword [rsp + 0x20], ebp
lea rdx, str.HPHotkeyNotification.exe
lea rcx, [rsp + 0x28]
call fcn.14009e010
lea r8, [rsp + 0x20]
lea rdx, str.HPHotkeyNotification.exe
lea rcx, [rsp + 0x28]
call fcn.14009de70
inc ebx
cmp dword [rsp + 0x20], 0
je 0x14006e509
cmp ebx, 0x64
jl 0x14006e4d0
test rsi, rsi
je 0x14006e517
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rdi, rdi
je 0x14006e526
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x28]
call fcn.14009dd90
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400964b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14009a430
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov eax, dword [rcx + 0x220]
cmp eax, 0xffffffff
jne 0x14009a5bd
xor r14d, r14d
mov dword [rbp + 0x20], r14d
mov dword [rbp - 0x30], 4
test r9, r9
je 0x14009a47f
cmp word [r9], r14w
jne 0x14009a486
lea r9, str.MaxLogSize
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400ed8a0]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r14w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r9 + r8*2], r14w
jne 0x14009a4b0
mov rdx, r9
lea rcx, [rbp - 0x20]
call fcn.140013240
nop
test rsi, rsi
je 0x14009a513
mov dword [rbp - 0x2c], r14d
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14009a513
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x14009a513
mov dword [rbx + 0x220], eax
jmp 0x14009a569
test rdi, rdi
je 0x14009a55f
mov dword [rbp - 0x2c], r14d
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14009a55f
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x14009a55f
mov dword [rbx + 0x220], eax
jmp 0x14009a569
mov dword [rbx + 0x220], 0x800
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14009a5a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009a5a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009a5d2
call fcn.140095e90
movdqa xmm0, xmmword [0x1400ed8a0]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r14w
mov eax, dword [rbx + 0x220]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400b1720
int3
Function at 0x14009a730
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rbp - 0x40], r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rbp - 0x40], 1
lea rdx, [rbp + 0x48]
mov rcx, r14
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x14009a934
mov ecx, esi
call fcn.140095ea0
mov rbx, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14009a927
mov r9, rax
mov r8d, esi
mov edx, dword [rbp + 0x48]
mov rcx, r14
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW
test eax, eax
je 0x14009a927
mov qword [rbp - 0x38], r15
mov dword [rbp + 0x40], r15d
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x38]
lea rdx, str.StringFileInfo040904E4ProductName
mov rcx, rbx
call sub.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW
test eax, eax
je 0x14009a86f
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x14009a86f
mov r8d, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400ed8a0]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.140013240
nop
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.14002c700
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14009a915
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009a910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009a951
jmp 0x14009a910
mov qword [rbp - 0x38], r15
mov dword [rbp + 0x40], r15d
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x38]
lea rdx, str.StringFileInfo040904B0ProductName
mov rcx, rbx
call sub.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW
test eax, eax
je 0x14009a927
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x14009a927
mov r8d, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400ed8a0]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.140013240
nop
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.14002c700
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14009a915
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009a910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009a94b
call fcn.140095e90
movdqa xmm0, xmmword [0x1400ed8a0]
mov word [rbp - 0x20], r15w
movdqu xmmword [rbp - 0x10], xmm0
test rbx, rbx
je 0x14009a934
mov rcx, rbx
call fcn.140095e90
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b1720
int3
call fcn.1400b1720
int3