joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d2a0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.140043ce0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r8, [0x1400815c8]
mov dword [rsp + 0x20], 0x104
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x30]
cmp ax, word [0x1400815c8]
je 0x14000d317
lea rcx, [rsp + 0x30]
call fcn.14004b99c
jmp 0x14000d319
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
Function at 0x140011fa0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test ecx, ecx
je 0x140012004
test edx, edx
je 0x140011fea
cmp qword [0x140096b68], 0
jne 0x140012072
xor eax, eax
lea r8, [0x140012080]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140096b68], rax
mov eax, 1
add rsp, 0x38
ret
cmp dword [0x140096734], 0
jne 0x140012072
mov dword [0x140096734], 1
mov ecx, 0x80000003
jmp 0x140012064
test edx, edx
je 0x14001204e
mov rcx, qword [0x140096b68]
test rcx, rcx
je 0x140012072
mov rax, qword [0x140096958]
test rax, rax
je 0x140012030
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [0x140096b68]
mov edx, 0x1f4
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
xor eax, eax
mov qword [0x140096b68], rax
mov eax, 1
add rsp, 0x38
ret
cmp dword [0x140096734], 0
je 0x140012072
xor eax, eax
mov ecx, 0x80000000
mov dword [0x140096734], eax
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_5.dll_SetThreadExecutionState]
test eax, eax
jne 0x140011fe0
xor eax, eax
add rsp, 0x38
ret

Function at 0x140012130
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x140012202
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
mov r9d, 1
mov dword [rsp + 0x28], 0x80030002
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_shutdown_l1_1_0.dll_InitiateSystemShutdownExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400121eb
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x58
ret
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x58
ret
Function at 0x140013400
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x480
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
mov rbp, r9
call fcn.140043ce0
mov r8, rbx
lea rcx, [rsp + 0x260]
mov edx, 0x104
call fcn.140049578
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140043ce0
mov r8, rdi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.140049578
mov ebx, dword [rsi]
lea r15, [0x1400815c8]
xor esi, esi
cmp dword [0x140096d88], 2
jne 0x140013587
mov rcx, qword [0x140093ba0]
lea rdi, [0x140093ba0]
cmp rcx, rdi
je 0x140013500
test byte [rcx + 0x1c], 1
mov qword [rsp + 0x4c8], r14
lea r14, str.StartMigrationFlow
je 0x1400134d6
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0xe]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call fcn.14001e200
mov rcx, qword [0x140093ba0]
cmp rcx, rdi
je 0x1400134f8
test byte [rcx + 0x44], 1
je 0x1400134f8
mov rcx, qword [rcx + 0x38]
mov edx, 0xf
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call fcn.14001e200
mov r14, qword [rsp + 0x4c8]
cmp dword [0x1400a0a44], esi
jne 0x140013587
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r15
lea r9, [rsp + 0x260]
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x1400a0a40]
call fcn.14000d5c0
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x14001a4c0]
mov dword [0x1400a1308], esi
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140013583
mov ebx, 1
mov qword [rsp + 0x20], r15
mov r9d, ebx
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call fcn.140019c90
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14001358c
mov ebx, esi
jmp 0x14001358c
mov ebx, 0xffffffff
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r15
lea rcx, str.SetMigrationOptions
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x260]
mov r8d, ebx
mov qword [rsp + 0x28], rax
mov edx, 0x2000
mov dword [rsp + 0x20], esi
call fcn.140013d10
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x480
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400145e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140043ce0
xor ebx, ebx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor edx, edx
lea rcx, [0x14006fa68]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x14001464f
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140049578
mov ebx, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001465f
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test ebx, ebx
je 0x140014697
lea rcx, str.ASUSASUS_System_Control_InterfaceAsusSwitchprogress
mov edx, 0x104
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov rcx, rdi
lea r8, str._s_s
call fcn.1400032c0
mov rcx, rdi
call fcn.140005f20
mov eax, 1
jmp 0x140014699
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001f4e0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x1400146c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov esi, r8d
mov rbx, rcx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140043ce0
xor edi, edi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
lea rcx, [0x14006fa68]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x140014737
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140049578
mov edi, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140014747
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test edi, edi
je 0x14001478b
lea rax, str.ASUSASUS_System_Control_InterfaceAsusSwitchprogresscache
mov edx, 0x104
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
mov rcx, rbx
call fcn.1400032c0
test esi, esi
je 0x140014784
mov rcx, rbx
call fcn.140004790
mov rcx, rbx
call fcn.140005f20
mov eax, 1
jmp 0x14001478d
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001f4e0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400156e0
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140043ce0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r8, [0x1400815c8]
mov dword [rsp + 0x20], 0x104
lea rdx, str.Size
lea rcx, str.Collection
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x30]
cmp ax, word [0x1400815c8]
je 0x140015757
lea rcx, [rsp + 0x30]
call fcn.14004b99c
jmp 0x140015759
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x250
pop rbx
ret
Function at 0x140016ad0
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x460
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.140043ce0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140043ce0
lea rcx, [rsp + 0x30]
call fcn.1400145e0
test eax, eax
je 0x140016b87
lea rax, str.targetinfo.ini
mov edx, 0x104
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [0x140080d48]
lea rcx, [rsp + 0x240]
call fcn.1400032c0
lea rax, [rsp + 0x240]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400815c8]
lea rdx, str._ComputerName_
mov dword [rsp + 0x20], 0x104
lea rcx, str.SourceMachine
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
mov eax, 1
jmp 0x140016b89
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x460
pop rbx
ret

Function at 0x140016bb0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.140043ce0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140043ce0
xor ebx, ebx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor edx, edx
lea rcx, [0x14006fa68]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x140016c2d
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140049578
mov ebx, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140016c3d
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test ebx, ebx
je 0x140016c7f
lea rcx, str.ASUSASUS_System_Control_InterfaceAsusSwitchuapmap
mov edx, 0x104
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x250]
lea r8, str._s_s
call fcn.1400032c0
lea rcx, [rsp + 0x250]
call fcn.140004790
mov eax, 1
jmp 0x140016c81
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x470
pop rbx
ret

Function at 0x140016ca0
Capabilities:
Read .ini file

Disassembly:
test edx, edx
jne 0x140016cbf
mov r9, rcx
lea rdx, str.Number
lea rcx, str.Complete
xor r8d, r8d
jmp qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
cmp edx, 1
jne case.default.0x140016cd8
mov r9, rcx
lea rdx, str.Number
lea rcx, str.Fail
xor r8d, r8d
jmp qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
cmp edx, 2
jne case.default.0x140016cf8
mov r9, rcx
lea rdx, str.Number
lea rcx, str.Cancel
xor r8d, r8d
jmp qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
xor eax, eax
ret
in eax, 0xf6
jno 0x1401008cb
mov bh, 0x43
sub al, 0x6f
add byte [rdi], ah
mov esp, 0xf45aedf9
vdivps xmm15, xmm8, xmmword [rax]
push rbx
movabs al, byte [0x1a985b36408c4925]
sbb dh, ch
pop rdx
hlt
sbb dh, ch
and dword [rbx], esp
cmp cl, cl
invalid
sub eax, 0x7d7d9ce2
loopne 0x1401008b1
wait
jnp 0x140100954
mov es, word [rax - 0x76]
push rsp
sahf
xchg rdx, rax
mov dl, byte [rsi + rbx*4 + 0x4c]
xchg edx, eax
invalid
jmp 0xf21d8848
jnp 0x1401008ee
mov dl, 0x7d
invalid
Function at 0x140017460
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea rax, str.SOFTWAREASUSASUS_Switch
cmp dword [0x140096714], edi
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSwitch
mov r9d, 0x20019
mov qword [rsp + 0x30], rdi
cmovne rdx, rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov ebx, 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001750d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.RemoveCacheComplete
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140017502
cmp dword [rsp + 0x3c], edi
cmove ebx, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001f4e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140018270
Capabilities:
Get system firmware table

Disassembly:
push rdi
sub rsp, 0x20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_0.dll_GetSystemFirmwareTable]
mov edi, eax
test eax, eax
je 0x14001834b
mov ecx, edi
mov qword [rsp + 0x30], rbx
call fcn.14001f888
mov rbx, rax
test rax, rax
je 0x14001831b
mov r9d, edi
mov r8, rax
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_0.dll_GetSystemFirmwareTable]
mov rcx, qword [0x1400a0a38]
mov eax, dword [rbx + 4]
mov dword [0x1400a0a30], eax
test rcx, rcx
je 0x1400182da
call fcn.14001f854
mov eax, dword [0x1400a0a30]
test eax, eax
je 0x140018308
mov ecx, eax
call fcn.14001f888
mov qword [0x1400a0a38], rax
test rax, rax
je 0x140018313
mov edx, dword [0x1400a0a30]
lea r8, [rbx + 8]
mov r9d, edx
mov rcx, rax
call fcn.1400022e0
jmp 0x140018313
mov qword [0x1400a0a38], 0
mov rcx, rbx
call fcn.14001f854
call fcn.140018360
mov rcx, qword [0x1400a0a38]
mov ebx, eax
test rcx, rcx
je 0x140018340
call fcn.14001f854
mov eax, ebx
mov qword [0x1400a0a38], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400198d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, edx
mov edi, ecx
mov rcx, qword [0x140093ba0]
lea rsi, [0x140093ba0]
cmp rcx, rsi
je 0x140019915
test byte [rcx + 0x1c], 1
je 0x140019915
mov rcx, qword [rcx + 0x10]
lea rax, str.SetProgressFromUIPage
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
call fcn.14001e2a0
cmp ebx, 1
jne 0x1400199ab
cmp dword [0x1400a0a44], 0x64
jl 0x14001995d
mov edx, ebx
mov ecx, edi
call fcn.14001bf20
lea rax, [0x1400815c8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call fcn.140019c90
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [0x140096d88], 1
jne 0x140019b13
cmp dword [0x1400a0a40], 3
jne 0x140019991
xor edx, edx
mov ecx, edi
call fcn.14001a110
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.140016bb0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp ebx, 2
jne 0x140019aa0
cmp dword [0x1400a0a44], 0x64
jle 0x140019b13
mov r9d, 1
lea rax, [0x1400815c8]
mov edx, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
call fcn.140019c90
mov rcx, qword [0x140093ba0]
cmp rcx, rsi
je 0x140019a31
test byte [rcx + 0x1c], 1
lea rbx, str.RestartMigrationFlow
je 0x140019a13
mov rcx, qword [rcx + 0x10]
mov edx, 0xb
mov qword [rsp + 0x20], rbx
call fcn.14001e170
mov rcx, qword [0x140093ba0]
cmp rcx, rsi
je 0x140019a31
test byte [rcx + 0x44], 1
je 0x140019a31
mov rcx, qword [rcx + 0x38]
mov edx, 0xc
mov qword [rsp + 0x20], rbx
call fcn.14001e170
cmp dword [0x1400a0a44], 1
jne 0x140019a8b
mov eax, dword [0x1400a0a40]
cmp eax, 3
je 0x140019a8b
cmp eax, 6
jae 0x140019a8b
cmp qword [0x1400a12d0], 0
jne 0x140019a8b
xor eax, eax
mov dword [0x1400a1308], 1
mov qword [rsp + 0x28], rax
lea r8, [0x14001a4c0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x140019a8b
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 2
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp ebx, 3
jne 0x140019aec
mov eax, dword [0x140096d88]
add eax, 0xfffffffe
cmp eax, 2
ja 0x140019b13
mov r9d, 1
lea rax, [0x1400815c8]
mov ecx, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbx + 0x64]
call fcn.140019c90
mov ecx, edi
call fcn.140019b30
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp ebx, 4
jne 0x140019b13
cmp dword [0x140096d88], 1
jne 0x140019b13
mov ecx, edi
call fcn.140019b30
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001a360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x68], r15
mov rdi, r9
mov rsi, r8
mov ebp, edx
mov ebx, ecx
mov rcx, qword [0x140093ba0]
lea r15, [0x140093ba0]
cmp rcx, r15
je 0x14001a3e5
test byte [rcx + 0x1c], 1
mov qword [rsp + 0x60], r14
lea r14, str.StartMigrationFlow
je 0x14001a3be
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
call fcn.14001e200
mov rcx, qword [0x140093ba0]
cmp rcx, r15
je 0x14001a3e0
test byte [rcx + 0x44], 1
je 0x14001a3e0
mov rcx, qword [rcx + 0x38]
mov edx, 0xf
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
call fcn.14001e200
mov r14, qword [rsp + 0x60]
cmp dword [0x1400a0a44], 0
mov r15, qword [rsp + 0x68]
jne 0x14001a4ae
cmp ebx, 3
je 0x14001a4ae
cmp ebx, 6
jae 0x14001a4ae
mov eax, dword [rsp + 0x88]
lea rcx, [0x1400a0a40]
mov dword [rsp + 0x30], eax
mov r9, rsi
mov rax, qword [rsp + 0x80]
mov r8d, ebp
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call fcn.14000d5c0
xor eax, eax
lea r8, [0x14001a4c0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov dword [0x1400a1308], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x14001a4a1
mov r9d, 1
lea rax, [0x1400815c8]
mov edx, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
call fcn.140019c90
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x70]
mov eax, 0xffffffff
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d0f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400a12d0], 0
mov rdi, rcx
je 0x14001d191
mov ecx, 0x630
call fcn.14004a5f8
mov rbx, rax
test rax, rax
je 0x14001d191
mov r8d, 0x630
mov rcx, rax
test rdi, rdi
je 0x14001d135
mov rdx, rdi
call fcn.140043f90
jmp 0x14001d14c
xor edx, edx
call fcn.140043ce0
call fcn.1400461c0
mov dword [rax], 0x16
call fcn.140046070
xor eax, eax
lea r8, [0x14001d1a0]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14001d189
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.14004a040
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14001d4d0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor esi, esi
lea rax, str.SOFTWAREASUSASUS_Switch
cmp dword [0x140096714], esi
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceAsusSwitch
mov r9d, 0x20019
mov qword [rsp + 0x30], rsi
cmovne rdx, rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov ebx, 1
mov edi, esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d5b0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.InstalledConfigAction
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d591
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
ja 0x14001d591
mov ebx, eax
lea edi, [rsi + 1]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x14001d5b0
test ebx, ebx
jne 0x14001d5b0
lea r8, [0x14001d720]
jmp 0x14001d6c8
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x208
call fcn.140043ce0
xor edx, edx
mov qword [rsp + 0x30], rsi
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140043ce0
lea r9, str.ASUSSwitch
mov edx, 0x104
lea r8, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rsp + 0x50]
call fcn.1400032c0
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d6c1
xor edx, edx
lea rcx, [rbp + 0x160]
mov r8d, 0x208
call fcn.140043ce0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rbp + 0x160]
mov dword [rsp + 0x3c], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Description
mov dword [rsp + 0x38], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d69c
lea r8, [rbp + 0x160]
mov edx, 0x104
lea rcx, [rbp + 0x370]
call fcn.140049578
mov ebx, 1
jmp 0x14001d69e
mov ebx, esi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
je 0x14001d6c1
movzx eax, word [rbp + 0x370]
cmp ax, word [0x1400815c8]
je 0x14001d6c1
xor eax, eax
jmp 0x14001d6f1
lea r8, [0x14001d810]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14001d6ec
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14001f4e0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret