joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027d40
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov qword [rsp + 0x30], 0
mov rdi, rcx
mov edx, 1
lea rcx, [rsp + 0x30]
mov rbx, r8
call fcn.140027750
test eax, eax
je 0x140027df2
test rbx, rbx
je 0x140027de0
mov eax, dword [rbx + 4]
mov r9d, 4
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov rdx, rdi
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ecx, dword [rbx]
mov r9d, 4
mov dword [rsp + 0x38], ecx
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 1
jmp 0x140027df4
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140032e60
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140029820
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x680
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140034ac0
mov r9, rbx
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140009eb0
xor edx, edx
lea rcx, [rsp + 0x460]
mov r8d, 0x208
call fcn.140034ac0
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0x201
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029952
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.140034ac0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x250]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.UninstallString
mov dword [rsp + 0x3c], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002992b
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [rsp + 0x460]
call fcn.140036978
mov ebx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
je 0x140029952
movzx ecx, word [rsp + 0x460]
cmp cx, word [0x14005693c]
je 0x140029952
mov eax, 1
jmp 0x140029954
xor eax, eax
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140032e60
add rsp, 0x680
pop rbx
ret
Function at 0x14002ad80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.1400221e0
test eax, eax
jne 0x14002af42
mov ecx, dword [0x140067998]
cmp ecx, 2
jne 0x14002adcb
call qword [sym.imp.POWRPROF.dll_PowerDeterminePlatformRole]
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [0x140067998], ecx
cmp ecx, 1
je 0x14002af42
call fcn.1400222b0
test eax, eax
jne 0x14002af42
mov dword [rsp + 0x40], eax
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14002ae01
xor r9d, r9d
lea r8, [rsp + 0x40]
lea edx, [rax + 8]
call fcn.140030410
xor ebx, ebx
lea rcx, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x38], rbx
call fcn.140027750
test eax, eax
je 0x14002ae86
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x180], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.OLEDPanel
mov dword [rsp + 0x44], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ae63
mov edi, dword [rsp + 0x48]
lea esi, [rbx + 1]
jmp 0x14002ae69
mov edi, dword [rsp + 0x30]
xor esi, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
mov rsi, qword [rsp + 0x180]
je 0x14002ae86
cmp edi, 1
cmovbe ebx, edi
mov edi, dword [rsp + 0x40]
cmp edi, 0x71
jne 0x14002aeae
test ebx, ebx
jne 0x14002af28
lea edx, [rdi - 0x70]
lea rcx, str.OLEDPanel
call fcn.140027c20
lea eax, [rdi - 0x70]
jmp 0x14002af61
cmp edi, 0x70
je 0x14002af2f
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140034ac0
mov eax, dword [0x140067978]
lea r8, str.OLED_panel_status_is_unknown_0x_x__lid_status___d
mov r9d, edi
mov dword [rsp + 0x20], eax
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140006460
mov rcx, qword [0x140067b00]
lea rax, [0x140067b00]
cmp rcx, rax
je 0x14002af19
test byte [rcx + 0x1c], 4
je 0x14002af19
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x50]
mov edx, 0xb
mov qword [rsp + 0x20], r8
call fcn.140031fc0
lea rcx, [rsp + 0x50]
call fcn.140032cd0
cmp ebx, 1
jne 0x14002af42
mov eax, 1
jmp 0x14002af61
cmp ebx, 1
jne 0x14002af42
xor edx, edx
lea rcx, str.OLEDPanel
call fcn.140027c20
mov rcx, qword [0x14006ae90]
test rcx, rcx
je 0x14002af5f
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14006ae90], 0
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140032e60
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
Function at 0x14002b040
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor esi, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov ebx, 1
call fcn.140027750
test eax, eax
je 0x14002b0f3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x60], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.OLEDProtect
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002b0bc
mov edi, dword [rsp + 0x3c]
mov esi, ebx
jmp 0x14002b0c0
mov edi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0x14002b0d4
cmp edi, ebx
cmovbe ebx, edi
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140032e60
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, ebx
jmp 0x14002b0db

Function at 0x14002b100
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x48], rax
test ecx, ecx
jne 0x14002b124
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
jmp 0x14002b146
cmp ecx, 1
jne 0x14002b134
mov qword [rsp + 0x40], 0xffffffffffffffff
jmp 0x14002b146
cmp ecx, 2
jne 0x14002b1d7
mov qword [rsp + 0x40], 0
mov edx, 1
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140027750
test eax, eax
je 0x14002b1d7
mov eax, dword [rsp + 0x44]
lea rdx, str.OLEDProtectHighDate
mov rcx, qword [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x38], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov eax, dword [rsp + 0x40]
lea rdx, str.OLEDProtectLowDate
mov rcx, qword [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x38], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140032e60
add rsp, 0x58
ret
Function at 0x14002bfb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rdi, rdx
lea r8, [0x14005693c]
mov edx, 0x104
mov rbp, rcx
call fcn.140036978
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
call fcn.140034ac0
mov edx, dword [0x7ffe02d8]
xor ebx, ebx
mov esi, ebx
cmp edx, 0xffffffff
je 0x14002c138
mov rax, qword [0x14006a9b0]
mov qword [rsp + 0x30], rbx
test rax, rax
je 0x14002c138
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
xor ecx, ecx
lea r8d, [rbx + 5]
call rax
test eax, eax
je 0x14002c138
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx]
cmp ax, word [0x14005693c]
je 0x14002c073
mov r8, rcx
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.140036978
mov rcx, qword [rsp + 0x30]
lea esi, [rbx + 1]
mov rax, qword [0x14006a9a8]
test rax, rax
je 0x14002c081
call rax
test esi, esi
je 0x14002c138
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140034ac0
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rcx, [0x14004dab0]
xor edx, edx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x14002c0d4
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.140036978
mov ebx, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002c0e4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test ebx, ebx
je 0x14002c138
test rdi, rdi
je 0x14002c0ff
lea r8, [rsp + 0x50]
mov edx, 0x104
mov rcx, rdi
call fcn.140036978
lea rcx, [rsp + 0x260]
mov edx, 0x104
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x50]
lea rcx, str.ASUSASUS_System_Control_InterfaceAsusOptimizationSplendid
mov qword [rsp + 0x20], rcx
lea r8, str._s_s_s_my_sp_data.sys
mov rcx, rbp
call fcn.140009eb0
mov eax, 1
jmp 0x14002c13a
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140032e60
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002c4e0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov esi, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x208
xor r14d, r14d
call fcn.140034ac0
mov r9, rdi
lea r8, str._s.
mov edx, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.140009eb0
xor edx, edx
lea rcx, [rbp + 0x3c0]
mov r8d, 0x208
call fcn.140034ac0
lea r9, [0x140069850]
mov edx, 0x104
lea r8, [0x14005c750]
lea rcx, [rbp + 0x3c0]
call fcn.140009eb0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14002c790
mov qword [rsp + 0x918], rbx
test byte [rsp + 0x60], 0x10
jne 0x14002c769
lea rax, [rbp - 0x74]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14002c5b6
cmp esi, 1
jne 0x14002c609
cmp ebx, 0xa
jl 0x14002c5ec
lea eax, [rbx - 0xa]
movsxd rcx, eax
lea rdx, str._cmdef.icm
lea rax, [rbp - 0x74]
lea rcx, [rax + rcx*2]
call fcn.1400400ac
test eax, eax
je 0x14002c6c3
lea rdx, str.pqconfig.dv
lea rcx, [rbp - 0x74]
call fcn.1400400ac
test eax, eax
je 0x14002c6c3
jmp 0x14002c769
cmp esi, 2
jne 0x14002c63e
cmp ebx, 4
jl 0x14002c769
lea eax, [rbx - 4]
movsxd rcx, eax
lea rdx, str..icm
lea rax, [rbp - 0x74]
lea rcx, [rax + rcx*2]
call fcn.1400400ac
test eax, eax
je 0x14002c6c3
jmp 0x14002c769
cmp esi, 3
jne 0x14002c769
cmp ebx, 4
jl 0x14002c769
lea eax, [rbx - 4]
movsxd rcx, eax
lea rdx, str..icm
lea rax, [rbp - 0x74]
lea rcx, [rax + rcx*2]
call fcn.1400400ac
test eax, eax
jne 0x14002c769
lea r8d, [rsi + 2]
lea rdx, str.ASUS_
lea rcx, [rbp - 0x74]
call fcn.1400404fc
test eax, eax
je 0x14002c6c3
lea rax, [rbp + 0x3c0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002c6a0
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp - 0x74]
call fcn.1400404fc
test eax, eax
jne 0x14002c769
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x14002c6d0
inc rcx
movsxd rax, ebx
add rcx, rax
cmp rcx, 0x104
jae 0x14002c769
xor edx, edx
lea rcx, [rbp + 0x5d0]
mov r8d, 0x208
call fcn.140034ac0
mov r8, rdi
lea rcx, [rbp + 0x5d0]
mov edx, 0x104
call fcn.140036978
lea r8, [rsp + 0x30]
xor edx, edx
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesExW]
test eax, eax
je 0x14002c736
test dword [rsp + 0x30], 0x400
jne 0x14002c769
lea rax, [rbp - 0x74]
mov r9, rdi
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.140009eb0
lea rcx, [rbp + 0x1b0]
call fcn.140031aa0
inc r14d
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x14002c5a0
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rbx, qword [rsp + 0x918]
mov eax, r14d
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.140032e60
lea r11, [rsp + 0x8f0]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002cad0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14d, edx
lea rax, str.CPanelMode
test r8d, r8d
lea rdx, str.Mode
mov ebp, r9d
mov edi, r8d
mov rsi, rcx
mov r9, rcx
cmovne rdx, rax
lea rcx, str.Main
mov r8d, 0x1e
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
mov ebx, eax
cmp eax, 0x1e
ja 0x14002cb3d
mov eax, 0x400000e6
bt eax, ebx
jae 0x14002cb3d
cmp ebx, 0x1e
je 0x14002cbd1
jmp 0x14002cb42
mov ebx, 1
mov eax, 0xffffffff
cmp ebx, 6
jne 0x14002cb80
lea rax, str.CPanelColorTemperature
test edi, edi
lea rdx, str.ColorTemperature
mov r9, rsi
cmovne rdx, rax
lea r8d, [rbx + 0x2c]
lea rcx, str.Main
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
xor ecx, ecx
test eax, eax
cmovs eax, ecx
lea ecx, [rbx + 0x5e]
jmp 0x14002cbb9
cmp ebx, 7
jne 0x14002cbbe
lea rax, str.CPanelEyeCareLevel
test edi, edi
lea rdx, str.EyeCareLevel
mov r9, rsi
cmovne rdx, rax
lea r8d, [rbx - 5]
lea rcx, str.Main
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
xor ecx, ecx
test eax, eax
cmovs eax, ecx
mov ecx, 4
cmp eax, ecx
cmovg eax, ecx
mov r9d, edi
mov dword [rsp + 0x20], ebp
mov r8d, r14d
mov edx, eax
mov ecx, ebx
call fcn.14002c7c0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14002d8d0
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push rdi
sub rsp, 0x68
movdqa xmm0, xmmword [0x14005dfc0]
mov rdi, r8
mov qword [rax - 0x38], 0xffffffffffffffff
mov ebp, ecx
mov qword [rax - 0x30], 0xffffffffffffffff
mov qword [rax - 0x28], 0xffffffffffffffff
mov qword [rax - 0x20], 0xffffffffffffffff
movdqu xmmword [rax - 0x48], xmm0
test r8, r8
je 0x14002d9ce
mov qword [rax + 8], rbx
xor ebx, ebx
mov qword [rax + 0x20], rsi
mov esi, ebx
mov qword [rax - 0x18], r14
cmp dword [r8 + 8], ebx
jne 0x14002d996
cmp dword [r8 + 0xc], ebx
jne 0x14002d996
cmp dword [r8 + 0x10], ebx
jne 0x14002d996
cmp dword [r8], ebx
je 0x14002d996
lea r9, [r8 + 0x1c]
xor r8d, r8d
lea rdx, str.SupportVideoEnhance
lea rcx, str.Main
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
test eax, eax
mov edx, ebx
setg dl
mov dword [rdi + 4], edx
test eax, eax
jle 0x14002d98f
lea r9, [rdi + 0x1c]
xor r8d, r8d
lea rdx, str.IsVideoEnhance
lea rcx, str.Main
lea esi, [rbx + 1]
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
mov ecx, ebx
cmp eax, esi
sete cl
mov dword [rsp + 0x34], ecx
jmp 0x14002d9a1
mov ebx, 1
jmp 0x14002d9a1
cmp dword [r8], ebx
mov ecx, 1
cmove ebx, ecx
mov r9d, ebp
lea r8, [rsp + 0x30]
mov edx, ebx
mov ecx, esi
call fcn.140007850
mov r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
pop rdi
pop rbp
ret
mov dword [rsp + 0x34], edx
lea r8, [rsp + 0x30]
xor edx, edx
mov r9d, ebp
lea ecx, [rdx + 1]
call fcn.140007850
add rsp, 0x68
pop rdi
pop rbp
ret

Function at 0x14002d9f0
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x60
movdqa xmm0, xmmword [0x14005dfa0]
mov esi, ecx
mov qword [rax - 0x28], 0xffffffffffffffff
mov qword [rax - 0x20], 0xffffffffffffffff
mov qword [rax - 0x18], 0xffffffffffffffff
mov qword [rax - 0x10], 0xffffffffffffffff
movdqu xmmword [rax - 0x38], xmm0
test r8, r8
je 0x14002dab9
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rdi
xor edi, edi
mov ebx, edi
cmp dword [r8 + 8], edi
jne 0x14002da8a
cmp dword [r8 + 0xc], ebx
jne 0x14002da8a
cmp dword [r8 + 0x10], ebx
jne 0x14002da8a
cmp dword [r8], ebx
je 0x14002da8a
cmp qword [0x14006ae90], rbx
je 0x14002da83
lea r9, [r8 + 0x1c]
mov edi, 1
lea rdx, str.LutDcScale
lea rcx, str.Main
lea r8d, [rdi + 0x63]
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x34], eax
jmp 0x14002da95
mov ebx, 1
jmp 0x14002da95
cmp dword [r8], ebx
mov ecx, 1
cmove ebx, ecx
mov r9d, esi
lea r8, [rsp + 0x30]
mov edx, ebx
mov ecx, edi
call fcn.140007850
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rsi
ret
mov dword [rsp + 0x34], edx
lea r8, [rsp + 0x30]
xor edx, edx
mov r9d, esi
lea ecx, [rdx + 1]
call fcn.140007850
add rsp, 0x60
pop rsi
ret
Function at 0x14002dae0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor ebx, ebx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov ebp, ebx
call fcn.140034ac0
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rbx + 2]
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002dc12
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW]
test eax, eax
je 0x14002dbbb
mov edi, ebx
nop dword [rax]
nop word [rax + rax]
mov edx, 0x5c
lea rcx, [rsp + 0x4c]
call fcn.1400345e8
test rax, rax
jne 0x14002db7b
lea rax, [rsp + 0x4c]
jmp 0x14002db7f
add rax, 2
lea rdx, str.AsusSplendid.exe
mov rcx, rax
call fcn.1400400ac
test eax, eax
jne 0x14002dba9
lea ebp, [rax + 1]
cmp rdi, 0x10
jge 0x14002dba6
mov eax, dword [rsp + 0x28]
mov dword [rsp + rdi*4 + 0x260], eax
inc rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW]
test eax, eax
jne 0x14002db60
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebp, ebp
je 0x14002dc12
nop dword [rax + rax]
mov r8d, dword [rsp + rbx*4 + 0x260]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14002dc02
mov edx, 9
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
inc rbx
cmp rbx, 0x10
jl 0x14002dbd0
mov eax, 1
jmp 0x14002dc14
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140032e60
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002dc40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebx, ebx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
xor edx, edx
call fcn.140027750
test eax, eax
je 0x14002dcef
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x68], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NKeyRollover
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002dcc1
mov esi, dword [rsp + 0x3c]
lea edi, [rbx + 1]
jmp 0x14002dcc7
mov esi, dword [rsp + 0x40]
mov edi, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
mov rdi, qword [rsp + 0x68]
je 0x14002dcef
test r14, r14
je 0x14002dce8
test esi, esi
setne bl
mov dword [r14], ebx
mov eax, 1
jmp 0x14002dcf1
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140032e60
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x14002dd10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebx, ebx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
xor edx, edx
call fcn.140027750
test eax, eax
je 0x14002ddc0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x68], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ArrowKeySwitch
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002dd91
mov esi, dword [rsp + 0x3c]
lea edi, [rbx + 1]
jmp 0x14002dd97
mov esi, dword [rsp + 0x40]
mov edi, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
mov rdi, qword [rsp + 0x68]
je 0x14002ddc0
test r14, r14
je 0x14002ddb9
cmp esi, 1
sete bl
mov dword [r14], ebx
mov eax, 1
jmp 0x14002ddc2
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140032e60
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret