joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e4c0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbp, rdx
cmp qword [rdx + 0x18], 2
jge 0x14000e50c
lea r8, str.AECustomized.cpp
mov edx, 0x79
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.140055180
xor edi, edi
xor esi, esi
xor r14d, r14d
xor r15d, r15d
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x14000e700
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x14000e70b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x68]
lea edx, [rdi + 1]
xor ecx, ecx
call fcn.140055570
lea r8, [rsp + 0x70]
mov edx, 1
mov ecx, edx
call fcn.140055570
mov r10, qword [rbp + 8]
mov rbx, qword [rsp + 0x70]
test r10, r10
je 0x14000e6b6
mov rax, qword [rsp + 0x68]
nop dword [rax]
mov r11, r10
mov r9, r10
test r10, r10
je 0x14000e72c
mov r10, qword [r10]
mov r9, qword [r9 + 0x10]
test r9, r9
je 0x14000e66c
cmp dword [r9 + 0x178], 1
jne 0x14000e66c
mov edx, dword [r9 + 0x1d8]
lea ecx, [rdx - 1]
test ecx, 0xfffffffd
jne 0x14000e61c
cmp dword [r9 + 0x16c], 0
je 0x14000e61c
test rdi, rdi
je 0x14000e614
mov r8, qword [r9 + 0x118]
test r8, r8
je 0x14000e716
mov rcx, rax
sub r8, rax
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x14000e60b
add rcx, 2
test dx, dx
jne 0x14000e5f4
xor ecx, ecx
jmp 0x14000e610
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x14000e66c
mov rdi, r11
mov r14, r9
jmp 0x14000e66c
cmp edx, 4
jne 0x14000e66c
cmp dword [r9 + 0x16c], 0
je 0x14000e66c
test rsi, rsi
je 0x14000e666
mov r8, qword [r9 + 0x118]
test r8, r8
je 0x14000e721
mov rcx, rbx
sub r8, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x14000e65d
add rcx, 2
test dx, dx
jne 0x14000e646
xor ecx, ecx
jmp 0x14000e662
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x14000e66c
mov rsi, r11
mov r15, r9
test r10, r10
jne 0x14000e590
test rsi, rsi
je 0x14000e685
mov rdx, rsi
mov rcx, rbp
call fcn.140133f54
test rdi, rdi
je 0x14000e695
mov rdx, rdi
mov rcx, rbp
call fcn.140133f54
test r15, r15
je 0x14000e6a5
mov rdx, r15
mov rcx, rbp
call fcn.140107e90
test r14, r14
je 0x14000e6b6
mov rdx, r14
mov rcx, rbp
call fcn.140107e90
nop
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e6d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14000e6ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
int3
mov ecx, 0x80004005
call fcn.14000de90
int3
call fcn.1400f91a0
int3
Function at 0x14000efd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r9d, r8d
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x14000f00a
lea r8, str.AnimateMgr.cpp
mov edx, 0xd9
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
jmp fcn.140055180
mov rdx, qword [rcx + 0x150]
test rdx, rdx
je 0x14000f04c
nop word [rax + rax]
mov r8, rdx
test rdx, rdx
je 0x14000f1ab
mov r8, qword [r8 + 0x10]
mov rax, qword [rsi + 0x40]
mov rdx, qword [rdx]
mov rcx, qword [r8 + 0x38]
cmp qword [rcx + 0x40], rax
jne 0x14000f047
cmp dword [r8 + 8], r9d
je 0x14000f074
test rdx, rdx
jne 0x14000f020
mov qword [rsp + 0x40], rbp
cmp dword [rbx + 0xf8], r9d
ja 0x14000f089
lea r8, str.AnimateMgr.cpp
mov edx, 0xc8
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x14000f0a6
mov rdx, r8
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
jmp fcn.14000ec20
cmp r9, qword [rbx + 0xf8]
jge 0x14000f1b1
mov rax, qword [rbx + 0xf0]
mov rbp, qword [rax + r9*8]
test rbp, rbp
jne 0x14000f0ce
lea r8, str.AnimateMgr.cpp
mov edx, 0xe6
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp qword [rbx + 0x128], 0
mov qword [rsp + 0x48], rdi
jne 0x14000f0e9
mov ecx, 0x48
call fcn.1400f8110
jmp 0x14000f0f5
lea rcx, [rbx + 0x110]
call fcn.140133fa0
movups xmm0, xmmword [rbp]
mov rdi, rax
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [rbp + 0x30]
movsd qword [rax + 0x30], xmm1
mov qword [rax + 0x38], rsi
mov eax, dword [rax + 0xc]
mov dword [rdi + 0x40], eax
mov eax, dword [rdi + 0x14]
add eax, 0xfffffffb
cmp eax, 1
ja 0x14000f163
lea r9, vtable.type_info.0
mov dword [rsp + 0x20], 0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.1402c2cf4
test rax, rax
je 0x14000f163
mov ecx, 0xffdf
mov dword [rax + 0x4c], 0xff
and word [rax + 0x50], cx
lea rcx, [rbx + 0x148]
mov rdx, rdi
call fcn.140133d78
cmp qword [rbx + 0x160], 1
mov rdi, qword [rsp + 0x48]
jne case.default.0x14000f1a4
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov edx, 0x861
lea r8d, [r9 + 0x32]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
jmp qword [sym.imp.USER32.dll_SetTimer]
call fcn.1400f91a0
int3
call fcn.1400f91a0
int3
invalid
mov bh, ah
mov esi, dword [rax]
mov cl, 5
mov ebp, 0xed780000
add eax, 0x780000bd
in eax, dx
jl 0x1406aeda6
cdq
mov esi, 0xed78000e
pop rsp
cdq
in eax, 0x94
jrcxz 0x1406aee05
mov al, 6
neg dword [rax]
in al, 0xe0
lahf
invalid
Function at 0x140012b60
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rsi, rcx
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140012d05
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc8], rax
lea rbx, [0x140345b70]
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.140015a40
or rdi, 0xffffffffffffffff
test al, al
jne 0x140012bde
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140012bc0
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.1400105e0
nop
mov rcx, qword [rsi + 0x98]
test rcx, rcx
jne 0x140012bf9
mov edx, 0xd9
mov rbx, qword [rsp + 0xc8]
jmp 0x140012c77
mov rcx, qword [rcx + 0x538]
mov rax, qword [rcx]
lea rdx, [rsp + 0xd8]
call qword [rax + 0x100]
nop
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.1400157c0
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012c44
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xc8]
lea rcx, [rbx - 0x18]
call fcn.140015740
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0xd0]
call fcn.140033e80
test eax, eax
jne 0x140012c8c
mov edx, 0xdb
lea r8, str.AudioCoreSetting.cpp
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x140012ce3
mov rax, qword [rsi + 0x98]
cmp qword [rax + 0x538], 0
je 0x140012ce3
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.14029ff20
mov dword [rsp + 0x30], VarBstrFromDisp
mov qword [rsp + 0x38], 0
lea rax, str.open
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140012cfa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000de90
int3
Function at 0x140014f50
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov rdi, rcx
mov rax, qword [rcx + 0x98]
test rax, rax
je 0x140014f8b
test dword [rax + 0x548], 0x4000
je 0x140015120
xor esi, esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov r9d, 0x2001f
lea r8, str.SoftwareRealtekAudioGUI_INFORMATIONDriverInfomation
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140015610
test eax, eax
je 0x140015014
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, str.SoftwareRealtekAudioGUI_INFORMATIONDriverInfomation
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.1400153d0
test eax, eax
je 0x140015014
lea r8, str.AudioCoreSetting.cpp
mov edx, 0x488
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
mov rbx, qword [rsp + 0x48]
jmp 0x140015112
mov eax, dword [rdi + 0x614]
shr eax, 5
and eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MultiStreamPlaybackSupport
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rdi + 0x614]
shr eax, 6
and eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MultiStreamRecordingSupport
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rdi + 0x614]
and eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MultiStreamPlaybackEnable
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rdi + 0x614]
shr eax, 1
and eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MultiStreamRecordingEnable
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140015112
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rbx, rbx
je 0x140015120
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140015850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140015883
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400158ca
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400158c5
nop
cmp rbx, rcx
jae 0x1400158ca
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400158b0
cmp rbx, rcx
jb 0x1400158ce
xor eax, eax
jmp 0x1400158da
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f690
Capabilities:
Print debug messages

Disassembly:
push r13
sub rsp, 0x30
mov rax, qword [rcx + 0x98]
mov r13, rcx
test rax, rax
jne 0x14001f6c3
lea r8, str.AudioDeviceMgr.cpp
mov edx, 0x28a
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
add rsp, 0x30
pop r13
jmp fcn.140055180
mov qword [rsp + 0x20], r15
mov r15, qword [rax + 0x1bd8]
test r15, r15
je 0x14001f887
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r14
mov rax, r15
test r15, r15
je 0x14001f89f
mov rbp, qword [rax + 0x10]
mov rax, qword [r13 + 0x98]
mov r15, qword [r15]
test rax, rax
jne 0x14001f72d
lea r8, str.AudioDeviceMgr.cpp
mov edx, 0x295
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x14001f865
test rbp, rbp
jne 0x14001f74f
lea r8, str.AudioDeviceMgr.cpp
mov edx, 0x296
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x14001f865
cmp dword [rbp + 0x168], 0
jne 0x14001f865
test byte [rax + 0x30], 0x80
je 0x14001f76f
cmp dword [rbp + 0x1d8], 4
je 0x14001f865
lea rcx, [rbp + 0x218]
call fcn.14015f354
mov rax, qword [r13 + 0x98]
mov edi, dword [rbp + 0x3a4]
mov rsi, qword [rax + 0x1bd8]
test rsi, rsi
je 0x14001f865
nop dword [rax + rax]
mov rcx, rsi
test rsi, rsi
je 0x14001f899
mov rcx, qword [rcx + 0x10]
mov rsi, qword [rsi]
cmp rcx, rbp
je 0x14001f85c
test rcx, rcx
je 0x14001f85c
cmp qword [rcx + 0x1f8], 2
jl 0x14001f85c
mov eax, dword [rbp + reloc.COMCTL32.dll_Ordinal_380]
cmp dword [rcx + reloc.COMCTL32.dll_Ordinal_380], eax
jne 0x14001f85c
mov eax, dword [rbp + 0x170]
cmp dword [rcx + 0x170], eax
jne 0x14001f85c
mov rbx, qword [rcx + 0x1e8]
test rbx, rbx
je 0x14001f85c
nop dword [rax + rax]
mov rax, rbx
test rbx, rbx
je 0x14001f893
mov r9, qword [rax + 0x10]
mov rbx, qword [rbx]
test r9, r9
je 0x14001f857
xor r10d, r10d
test edi, edi
je 0x14001f857
mov edx, dword [r9 + 0x5c]
xor eax, eax
test edx, edx
je 0x14001f83e
mov r8d, dword [rbp + r10*4 + 0x3a8]
cmp dword [r9 + rax*4 + 0x60], r8d
je 0x14001f848
inc eax
cmp eax, edx
jb 0x14001f831
inc r10d
cmp r10d, edi
jb 0x14001f823
jmp 0x14001f857
mov rdx, r9
lea rcx, [rbp + 0x218]
call fcn.140133d78
test rbx, rbx
jne 0x14001f800
test rsi, rsi
jne 0x14001f7a0
test r15, r15
jne 0x14001f6f1
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop r13
ret
call fcn.1400f91a0
int3
call fcn.1400f91a0
int3
call fcn.1400f91a0
int3
Function at 0x140023a30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [r9]
mov rbx, r8
add eax, eax
mov rdi, r9
mov dword [rsp + 0x40], eax
xor esi, esi
mov dword [r9], esi
lea rax, [rsp + 0x40]
mov rcx, qword [rcx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140023abe
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 1
ja 0x140023aa0
mov ecx, dword [rsp + 0x40]
test rbx, rbx
je 0x140023ab8
test ecx, ecx
je 0x140023ab5
test cl, 1
jne 0x140023aa0
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x140023ab8
mov eax, SafeArrayDestroy
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov word [rbx], si
shr ecx, 1
mov dword [rdi], ecx
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140027410
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov rdi, r9
movzx ebx, r8w
mov rsi, rdx
xor r15d, r15d
mov qword [r11 + 8], r15
mov rcx, qword [0x1403ff420]
mov rax, qword [rcx]
mov qword [r11 - 0x68], r15
xor r9d, r9d
lea r8, [r11 + 8]
mov edx, 0x10000077
call qword [rax + 0x10]
mov edx, ebx
mov r8, qword [rdi]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400274de
mov edx, 0xe0
lea r8, str.AudioObjectUI.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
nop
mov rdx, qword [rsi]
or ebx, 0xffffffff
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400274b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400274cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, rbx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
jne 0x1400274fc
mov edx, 0xe4
jmp 0x140027481
mov rdx, rbx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
jne 0x140027528
mov edx, 0xe8
jmp 0x140027481
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 2]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140027565
mov edx, 0xf4
jmp 0x140027481
mov dword [rsp + 0xa0], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xa0]
mov r8d, ebp
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400275b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400275cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140029c30
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov esi, ecx
xor ebp, ebp
mov qword [rax - 0x20], rbp
mov dword [rax - 0x18], ebp
mov qword [rax - 0x10], rbp
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140029e7d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.RTSnMg64.cpl
or rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140029c90
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.1400105e0
mov r9d, 0x2001f
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140015610
mov rbx, qword [rsp + 0x78]
test esi, esi
je 0x140029d8d
test eax, eax
jne 0x140029d06
mov dword [rsp + 0x28], 2
lea rax, [0x140345b70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140029e39
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.1400153d0
mov r9d, 0x2001f
lea r8, str.Control_Paneldont_load
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.140015610
test eax, eax
jne 0x140029e07
mov dword [rsp + 0x28], 2
lea rax, [0x140345b70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140029e39
test eax, eax
jne 0x140029da4
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140029e39
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.1400153d0
mov r9d, 0x2001f
lea r8, str.Control_Paneldont_load
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.140015610
test eax, eax
jne 0x140029e07
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140029e39
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, str.Control_Paneldont_load
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.1400153d0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140029e52
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140029e62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000de90
int3
Function at 0x14002b6b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x2a8
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx + 0x20]
call fcn.1400fa914
mov edx, 0x26
mov rcx, qword [rax + 0x10]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
bt eax, 8
jb 0x14002b850
cmp dword [0x1403ff83c], 7
jne 0x14002b83a
cmp dword [0x140401350], 0
jne 0x14002b831
lea rax, [rsp + 0x38]
mov qword [rsp + 0x2d0], rbp
mov ebp, 1
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov dword [0x140401350], ebp
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftPlus_ThemesCurrent
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002b829
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x34], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002b81e
movups xmm0, xmmword [str.Windows_Classic.theme]
mov eax, dword [0x140348a48]
lea rcx, [rsp + 0x70]
movups xmm1, xmmword [0x140348a30]
mov qword [rsp + 0x2a0], rsi
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x68], eax
movsd xmm0, qword [0x140348a40]
movsd qword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x40]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, eax
jl 0x14002b816
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, eax
lea rcx, [rsp + 0x70]
movsxd rax, esi
lea rdx, [rsp + 0x40]
lea rcx, [rcx + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [0x14040134c]
test eax, eax
cmove ecx, ebp
mov dword [0x14040134c], ecx
mov rsi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x2d0]
cmp dword [0x14040134c], 0
je 0x14002b843
cmp dword [0x1403ff430], 1
jne 0x14002b850
mov rdx, rbx
mov rcx, rdi
call fcn.14002c950
jmp 0x14002b85b
mov rdx, rbx
mov rcx, rdi
call fcn.14002b880
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14029d880
add rsp, 0x2a8
pop rdi
pop rbx
ret
Function at 0x140033e80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rcx, qword [rcx]
movzx eax, word [rcx]
cmp ax, word [0x140345b70]
jne 0x140033ee3
lea r8, str.Common.cpp
mov edx, 0x740
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033edb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
cmp eax, 0xffffffff
je 0x140033ec5
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033f0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
add rsp, 0x30
pop rbx
ret