joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006fd98
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rax, str.UndockedShellUpdate
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], RestartDialog
call fcn.14006e8dc
mov rcx, rdi
call fcn.14006fedc
mov eax, dword [rdi + 0xc8]
test eax, 0x802
je 0x14006fddc
test eax, 0x1200
jne 0x14006fddc
mov al, 1
jmp 0x14006fdde
xor al, al
mov byte [rdi + 0xdc], al
lea rcx, [rdi + 0x1b0]
call fcn.140087de4
mov ebx, eax
test eax, eax
jns 0x14006fe2a
mov rcx, qword [rsp + 0x28]
mov r9d, eax
lea r8, str.shellliblogontasksBlackBoxData.h
mov edx, reloc.UxTheme.dll_Ordinal_86
call fcn.14001e09c
mov rcx, qword [rsp + 0x28]
mov r9d, ebx
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x1837
call fcn.14009cb2c
jmp 0x14006fe38
xor edx, edx
lea rcx, [0x14038ba38]
call fcn.140041dd0
lea r8, str.DesktopReadyTimeout
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegDeleteKeyValueW]
nop dword [rax + rax]
lea rbx, [rdi + 0x1c0]
lea rdx, [rdi + 0x1b0]
xor r8d, r8d
lea rcx, [0x140275d90]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolTimer]
nop dword [rax + rax]
mov rdx, rax
mov rcx, rbx
call fcn.14001f048
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14006fea8
mov rcx, qword [rsp + 0x28]
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x1846
call fcn.140195678
jmp 0x14006feca
mov qword [rsp + 0x30], 0xffffffffdc3cba00
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolTimer]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140070b74
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rsi
sub rsp, 0x20
and qword [rax + 8], 0
xor ebx, ebx
mov qword [rax + 0x10], rbx
xor edx, edx
lea rcx, [rax + 8]
call fcn.140070bd8
lea rdx, [rsp + 0x30]
call fcn.140070c20
test eax, eax
jns 0x140183e88
xor sil, sil
test rbx, rbx
jne 0x140183ecf
cmp qword [rsp + 0x30], 0
jne 0x140183ee4
mov al, sil
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14019dcac
lea rcx, [rsp + 0x38]
call fcn.1400207e0
mov rbx, qword [rsp + 0x38]
test eax, eax
js 0x140070ba8
mov rdx, rbx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x140070ba8
mov sil, 1
jmp 0x140070bab
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
nop
jmp 0x140070bb4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
jmp 0x140070bc0
Function at 0x140072270
Capabilities:
Query or enumerate registry value

Disassembly:
mov byte [rsp + 0x10], dl
push rbx
push rdi
push r14
sub rsp, 0x40
mov edi, ecx
and dword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r8, str.TestHookDisableNthMSA
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r14, 0xffffffff80000002
mov rcx, r14
call fcn.14007b130
and dword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r8, str.EnableNthMSA
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerNGCUpsellData
mov rcx, r14
call fcn.14007b130
mov ebx, 1
cmp dword [rsp + 0x68], 0
jne 0x14018457a
mov dl, bl
lea rcx, [0x14038c690]
call fcn.140069e50
cmp dword [rsp + 0x70], 0
jne 0x140072345
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 0x20010010
lea r8, [0x14030efa0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp dword [0x140389e78], ebx
je 0x140184599
xor bl, bl
mov al, bl
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
xor r9d, r9d
lea r8, str.EnableNthMSA
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerNGCUpsellData
mov rcx, r14
call fcn.14019da84
nop
jmp 0x1400722ed
cmp dword [rsp + 0x78], 0
jne 0x140072345
test dil, 2
jne 0x1401845b5
cmp dword [rsp + 0x68], 0
je 0x140072345
test edi, 0x2011
je 0x140072347
jmp 0x140072345

Function at 0x1400725a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
sub rsp, 0x40
and dword [rcx], 0
lea rax, [r11 + 0x10]
and dword [rcx + 4], 0
lea r8, [0x14030efa0]
and dword [rcx + 8], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
and dword [rcx + 0x14], 0
mov rbx, rcx
and dword [rcx + 0x18], 0
mov r9d, 0x20010010
mov qword [r11 - 0x18], rax
lea rax, [r11 + 8]
mov byte [rcx + 0x1c], 0
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
mov dword [rsp + 0x58], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp dword [rsp + 0x50], 0
mov qword [rbx + 0x20], 0x1b
setne al
mov byte [rbx + 0x1d], al
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140073138
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140073196
mov rcx, qword [rsp + 0x40]
lea rdx, str.LogonWork
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x38
ret
Function at 0x140075a50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov rbx, r9
mov dword [rsp + 0x40], 8
lea rax, [r11 - 0x18]
mov r9d, 8
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rbx
and qword [r11 - 0x38], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jle 0x140075a94
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140075aae
cmp dword [rsp + 0x40], 8
mov ecx, 0x80004005
cmovne eax, ecx
test eax, eax
js 0x140075aae
add rsp, 0x50
pop rbx
ret
xor ecx, ecx
mov qword [rbx], rcx
jmp 0x140075aa7

Function at 0x140075abc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
lea rax, [r11 + 0x10]
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x10], rax
lea r8, str.StartMenuInit
lea rax, [r11 + 8]
xor ebx, ebx
xor r9d, r9d
mov qword [r11 - 0x18], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov dword [rsp + 0x40], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov eax, ecx
add rsp, 0x30
pop rbx
ret

Function at 0x140076680
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x458
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov eax, dword [0x140389e74]
test eax, eax
je 0x1400766c2
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x458
ret
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x202
lea rdx, [rsp + 0x30]
mov ecx, SafeArrayDestroy
call qword [sym.imp.SspiCli.dll_GetUserNameExW]
nop dword [rax + rax]
neg al
sbb eax, eax
add eax, 2
mov dword [0x140389e74], eax
jmp 0x1400766a3
Function at 0x140076938
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x470], rax
call fcn.140075abc
cmp eax, 0xd
jae 0x140076b3a
xor ebx, ebx
test eax, eax
jne 0x140076a1f
mov edx, 0x104
mov dword [rsp + 0x40], edx
lea r9, str.WindowsUpdate
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, str.UpdateURL
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140076a1b
cmp word [rsp + 0x260], bx
je 0x140076a1b
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
lea r8, str.StartMenuLogoff
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
nop dword [rax + rax]
mov cl, bl
jmp 0x140076a21
mov cl, 1
call fcn.140205768
call fcn.140206848
call fcn.1402052c4
lea rcx, [0x14038ab40]
call fcn.1400a9490
test al, al
jne 0x140076a45
call fcn.140204fe4
call fcn.140204f44
call fcn.1401a27f4
call fcn.140207858
xor r9d, r9d
lea r8, [0x14030c980]
lea edx, [r9 + 3]
lea rcx, [0x14031c1b0]
call fcn.140035738
lea r8, str.UserStartTime
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionTrayNotify
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
lea rcx, [0x14038ab40]
call fcn.1400a9490
test al, al
jne 0x140076b3a
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x4c], 4
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, str.AuditinProgress
lea rdx, str.SystemSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140076af9
cmp dword [rsp + 0x40], ebx
jne 0x140076b3a
mov dword [rsp + 0x44], SafeArrayDestroy
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.StartMenuInit
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
nop dword [rax + rax]
lea rcx, [0x14038ab40]
call fcn.1400a9490
test al, al
jne 0x140076b54
mov ecx, 1
call fcn.140076c14
mov dl, 1
lea rcx, [0x14038bf78]
call fcn.140076b90
call fcn.1400772e4
nop
call fcn.140076f68
nop
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x480
pop rbx
ret
Function at 0x140078150
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
call fcn.140078c94
xor r8d, r8d
lea rcx, [0x1401bb380]
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolTimer]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
je 0x140187ace
xor edi, edi
test dword [rbx + 0x10], 0xfffffffb
jne 0x140078254
and qword [rsp + 0x70], rdi
lea rax, [rsp + 0x60]
and dword [rsp + 0x68], edi
lea r9d, [rdi + 8]
mov qword [rsp + 0x30], rax
lea r8, str.TaskbarStateLastRun
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
lea rax, [rsp + 0x68]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x140078254
cmp dword [rbx + 0x10], 4
mov eax, 0xea60
mov esi, 0x927c0
mov rcx, rdi
cmovne esi, eax
mov edx, esi
call fcn.140078264
cmp dword [rbx + 0x10], 0
jne 0x14007821e
cmp eax, 0x927c0
jbe 0x14007821e
mov dword [rbx + 0x10], 4
mov eax, eax
lea rdx, [rsp + 0x60]
imul rcx, rax, 0xffffffffffffd8f0
mov r9d, esi
mov r8d, 0x240c8400
mov qword [rsp + 0x60], rcx
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolTimer]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
call fcn.1401b599c
jmp 0x1400781ef
mov eax, 0x80004005
jmp 0x14007824b
Function at 0x14007a2c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
cmp byte [0x140389680], 0
jne 0x14007a322
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x18], rax
lea r8, str.IsCloudAndHistoryFeatureAvailable
lea rax, [0x14038ac28]
mov r9d, 0x10010
mov qword [r11 - 0x20], rax
lea rdx, str.SoftwareMicrosoftClipboard
and qword [r11 - 0x28], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov byte [0x140389680], 1
cmp dword [0x14038ac28], 0
setne al
add rsp, 0x48
ret
Function at 0x14007aca4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rsi
sub rsp, 0x40
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x18], rax
lea rsi, [0x140389750]
mov qword [r11 - 0x20], rsi
lea r8, str.DefaultStartColor
and qword [r11 - 0x28], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14007ad0a
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x1401889ac
mov rcx, rsi
call fcn.14007af30
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
lea rax, [rsp + 0x50]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x30], rax
lea r8, str.DefaultAccentColor
lea rax, [0x140389754]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1401889fe
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x14007ad1a
jmp 0x14007ad12

Function at 0x14007ad30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
cmp dword [0x14038b2e8], 0
mov rdi, rcx
jne 0x140188a0c
mov edx, 0x20019
mov dword [rsp + 0x68], 4
lea rcx, [rsp + 0x40]
call fcn.14007ae40
mov rax, qword [0x14038c658]
lea r8, str.StartColorMenu
mov rcx, qword [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
test rax, rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
cmovne rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x140188a1c
test ebx, ebx
js 0x14007ae0d
mov rax, qword [0x14038c658]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov qword [rsp + 0x30], r8
test rax, rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.AccentColorMenu
cmovne rcx, rax
lea rax, [rdi + 4]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x140188a2a
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14007ae23
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
js 0x140188a38
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
lea rdx, [rcx + 4]
call fcn.14026181c
mov ebx, eax
jmp 0x14007ae23
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14007adb3
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14007ae0d
mov rcx, rdi
call fcn.14007af30
mov ebx, eax
test eax, eax
js 0x14007ae2b
mov rcx, rdi
call fcn.140262104
nop
jmp 0x14007ae2b
Function at 0x14007b130
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x58
lea rax, [r11 - 0x18]
mov dword [rsp + 0x78], 0
mov qword [r11 - 0x28], rax
mov r9d, 0x10000012
lea rax, [r11 - 0x14]
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x30], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x38], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
je 0x14007b194
cmp eax, 0xea
je 0x14007b1c9
test eax, eax
jle 0x14007b1c1
movzx eax, cx
or eax, 0x80070000
add rsp, 0x58
ret
cmp dword [rsp + 0x78], 4
mov ecx, SafeArrayDestroy
jne 0x140188ac2
mov eax, dword [rsp + 0x44]
cmp eax, 1
ja 0x14007b186
xor ecx, ecx
cmp eax, 1
mov rax, qword [rsp + 0x80]
sete cl
mov dword [rax], ecx
xor ecx, ecx
mov eax, ecx
add rsp, 0x58
ret
mov ecx, SafeArrayDestroy
jmp 0x14007b186
cmp dword [rsp + 0x40], 4
jne 0x14007b186
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x30]
cmp dx, 1
ja 0x14007b186
xor ecx, ecx
mov edx, 0x31
cmp dx, ax
mov rax, qword [rsp + 0x80]
sete cl
mov dword [rax], ecx
xor ecx, ecx
jmp 0x14007b1c1

Function at 0x1400807f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [0x14038ab38]
xor ebx, ebx
mov rdi, r9
mov rsi, r8
mov rbp, rdx
lea ecx, [rbx + 0x43]
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
jne 0x14008085a
mov r10, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], r10
mov r8, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
nop dword [rax + rax]
test eax, eax
sete bl
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140081264
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov byte [r11 + 0x20], r9b
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
lea rax, [r11 + 0x20]
mov rbp, rdx
mov qword [r11 - 0x40], rax
xor r13d, r13d
lea r9, [r11 - 0x38]
mov r12, rcx
mov qword [r11 - 0x48], r13
mov rdx, rsi
mov dword [r11 + 0x20], r13d
mov rcx, rbp
xor r8d, r8d
mov edi, r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
mov r14d, 0x80070000
test eax, eax
jg 0x14018a2e2
test ebx, ebx
js 0x1400813a5
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x14018a2ed
test ecx, ecx
je 0x14018a2ed
test cl, 1
jne 0x14018a2ed
test ebx, ebx
js 0x1400813a5
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14018a37a
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x14018a2f7
test ebx, ebx
js 0x1400813a5
mov esi, dword [rsp + 0x88]
shr esi, 1
dec esi
cmp dword [rsp + 0x30], 2
je 0x14018a302
test ebx, ebx
js 0x1400813a5
cmp word [rdi + rsi*2], r13w
jne 0x1400813d5
mov rcx, r12
inc esi
call fcn.1400813e4
test rdi, rdi
je 0x1400813a2
test rsi, rsi
je 0x1400813a2
lea rax, [rsi - 1]
mov qword [r12], rdi
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], rsi
mov word [rdi + rsi*2 - 2], r13w
mov rdi, r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, 0x8007000d
jmp 0x1400813a5
movzx ebx, ax
or ebx, r14d
jmp 0x1400812cc
mov ebx, 0x8007000d
jmp 0x1400812fb
movzx ebx, ax
or ebx, r14d
jmp 0x140081351
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x14008136b
mov ecx, r14d
add rcx, rcx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x14018a37a
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x14018a384
cmp eax, r14d
ja 0x14018a384
mov rcx, rdi
mov ebx, r13d
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rdi, rbp
lea esi, [r15 - 1]
jmp 0x14008136f
mov ebx, 0x8007000e
jmp 0x1400813a5
mov rcx, rbp
mov ebx, 0x8007007a
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
jmp 0x14008136b
Function at 0x140086fb8
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xb0
xor edx, edx
lea rcx, [0x14038b4f0]
call fcn.140087068
mov rcx, qword [0x14038a6f0]
xor ebx, ebx
test rcx, rcx
jne 0x14018bd24
lea r8, [0x14038a6f0]
lea rcx, [0x14038a408]
call fcn.140087270
test eax, eax
js 0x14018bd3e
mov rax, qword [0x140389598]
lea rcx, [0x140047790]
test rax, rax
jne 0x14018bd61
mov qword [0x140389598], rcx
lea r9, [0x140078cc0]
lea rcx, [0x140079610]
mov r8d, 0x282a
lea rdx, [0x14038a3d0]
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
je 0x140087053
cmp qword [0x14038a3d8], rbx
je 0x140087053
mov ebx, 1
mov eax, ebx
add rsp, 0xb0
pop rbx
ret
mov qword [0x14038a6f0], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006b68f.0]
nop
jmp 0x140086fe1
mov rcx, qword [rsp + 0xb8]
lea r8, str.pcshell_shellexplorer_tray.cpp
mov r9d, eax
mov edx, 0x1b8
call fcn.14009cb2c
xor eax, eax
jmp 0x140087055
cmp rax, rcx
je 0x140087013
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x90
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x20]
call fcn.140195e4c
int3

Function at 0x140088038
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [r11 - 0x28]
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [r11 - 0x38], rax
lea r8, str.PersonalColors_Background
lea rax, [r11 - 0x20]
mov r9d, 2
mov qword [r11 - 0x40], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsPersonalization
and qword [r11 - 0x48], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
xor edx, edx
test eax, eax
lea ecx, [rdx + 1]
cmove edx, ecx
xchg dword [0x14038b2e8], edx
call fcn.1400880c8
mov byte [0x140389e66], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x68
ret

Function at 0x14008e8b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
mov ebx, dword [rsp + 0x78]
xor esi, esi
mov rdi, qword [rsp + 0x70]
cmp ebx, 0x7fffffff
ja 0x14008e926
lea eax, [rbx + rbx]
mov dword [rsp + 0x78], eax
lea rax, [r11 + 0x30]
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14008e915
test ebx, ebx
je 0x14008e909
mov word [rdi], si
test eax, eax
jle 0x14008e915
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 0x216
jmp 0x14008e8fe