joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002230
Capabilities:
Create directory
Get common file path
Get session user name
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x140046350]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
lea rcx, [rsp + 0x32]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.140018400
lea rcx, [rsp + 0x242]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], di
call fcn.140018400
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov dword [rsp + 0x28], 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [rdi + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.14001632c
test rax, rax
je 0x1400022b5
mov word [rax], di
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.14001632c
test rax, rax
je 0x1400022e3
lea r8, str.Intelgp_
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov word [rax + 2], di
call fcn.140016238
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x240]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140002399
lea r8, str.profile_
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140016238
lea r8, [rsp + 0x240]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140016238
lea r8, str..dat
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140016238
lea r8, [0x140030c8c]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
call fcn.14001684c
test eax, eax
jne 0x140002399
mov r9, qword [rsp + 0x20]
lea edx, [rax + 1]
lea rcx, [0x140049a70]
mov r8d, 0x35c8
call fcn.140016bf4
mov rcx, qword [rsp + 0x20]
call fcn.1400169fc
mov rcx, rbx
call fcn.140002a80
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400183d0
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rdi
ret
Function at 0x140002e10
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov r14, rcx
mov ebp, 0x80004005
mov ecx, 0x10
call fcn.1400159e0
mov rbx, rax
mov qword [rsp + 0x60], rax
xor edi, edi
test rax, rax
je 0x140002e88
mov rax, qword [r14]
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rax]
mov rsi, qword [0x14004d050]
cmp rsi, rcx
je 0x140002e8b
mov qword [0x14004d050], rcx
test rcx, rcx
je 0x140002e78
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rsi, rsi
je 0x140002e8b
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
jmp 0x140002e8b
mov rbx, rdi
lea rax, [0x140049a68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x140001cc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14 + 8], rax
test rax, rax
cmovne ebp, edi
mov eax, ebp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140002ed0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x140046350]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rcx
mov rcx, qword [0x140049a60]
test rcx, rcx
jne 0x14000300b
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.140018400
lea rcx, [rsp + 0x252]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x250], bx
call fcn.140018400
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x250]
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140002fff
lea r8, str.SOFTWAREIntelDisplayigfxcuiprofiles_app
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.1400162c0
lea r8, [0x140030a48]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140016238
lea r8, [rsp + 0x250]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140016238
mov rcx, qword [0x140049a60]
mov ebx, 3
test rcx, rcx
jne 0x14000300b
lea rsi, [0x140049a60]
nop dword [rax + rax]
test ebx, ebx
je 0x140003006
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140049a60]
dec ebx
test rcx, rcx
je 0x140002fc0
jmp 0x14000300b
mov rcx, qword [0x140049a60]
test rcx, rcx
je 0x14000304a
cmp qword [rdi], 0
jne 0x140003030
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x14000304a
mov rcx, qword [0x140049a60]
mov r9, qword [rdi]
mov edx, 1
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400183d0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003070
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140002160
cmp dword [0x140049a70], 0
je 0x14000309a
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.140002230
call fcn.140002cb0
cmp dword [0x140049a74], 0
je 0x1400030bd
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140002ed0
add rsp, 0x20
pop rbx
ret
Function at 0x140005c70
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140005c9e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140007750
cmp byte [0x14004d110], 0
jne 0x140005ce9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005cd9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14004d110], 1
mov qword [0x14004d108], rax
jmp 0x140005cf0
mov rax, qword [0x14004d108]
mov byte [0x14004d110], 1
jmp 0x140005cf0
mov rax, qword [0x14004d108]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140005d0f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400077c4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400077df
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400077df
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400077df
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
div byte [rax]
invalid
sahf
xchg esi, eax
or bpl, spl
jrcxz 0x1400755b6
jmp 0x14b76c8bc
cmc
mov dword [rbp - 0x22bd43e], ecx
xchg dword [rax], ecx
sub eax, 0x732de9f8
pop rbp
ja 0x1400755d4
jp 0x140075511
dec byte [0x14a9aa3b3]
mov esi, 0xc98fbbcd
je 0x140075582
cld
pop rdi
in eax, dx
xchg edx, eax
adc cl, byte [rbx]
fbld tbyte [rbx - 0x61ab0543]
std
shl dword [rdx], 1
jg 0x1400755ee
and bh, byte [rdi + 0x69]
or dh, byte [rdx + 0x160febf3]
mov dh, 0xdc
mov ecx, 0x88164b73
out 5, al
sbb al, 0x49
call qword fs:[rsi + 0x54]
iretd
loope 0x1400755cc
invalid
outsd dx, dword [rsi]
jp 0x140075553
invalid
invalid
sti
xlatb
movabs eax, dword [0x7612daa81eeaf8ed]
sub byte [rcx + 0x4ab42a64], al
jne 0x140075620
pushfq
invalid
in eax, dx
iretd
Function at 0x140007600
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140046350]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
call fcn.140007050
mov ebx, eax
test eax, eax
jne 0x140007717
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400076f1
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140007600
mov ebx, eax
test eax, eax
jne 0x140007717
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400076a0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007706
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x50], ebp
call int.140005c70
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007727
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400183d0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007750
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140005c9e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140007750
cmp byte [0x14004d110], 0
jne 0x140005ce9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005cd9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14004d110], 1
mov qword [0x14004d108], rax
jmp 0x140005cf0
mov rax, qword [0x14004d108]
mov byte [0x14004d110], 1
jmp 0x140005cf0
mov rax, qword [0x14004d108]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140005d0f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400077c4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400077df
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400077df
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400077df
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
div byte [rax]
invalid
sahf
xchg esi, eax
or bpl, spl
jrcxz 0x1400755b6
jmp 0x14b76c8bc
cmc
mov dword [rbp - 0x22bd43e], ecx
xchg dword [rax], ecx
sub eax, 0x732de9f8
pop rbp
ja 0x1400755d4
jp 0x140075511
dec byte [0x14a9aa3b3]
mov esi, 0xc98fbbcd
je 0x140075582
cld
pop rdi
in eax, dx
xchg edx, eax
adc cl, byte [rbx]
fbld tbyte [rbx - 0x61ab0543]
std
shl dword [rdx], 1
jg 0x1400755ee
and bh, byte [rdi + 0x69]
or dh, byte [rdx + 0x160febf3]
mov dh, 0xdc
mov ecx, 0x88164b73
out 5, al
sbb al, 0x49
call qword fs:[rsi + 0x54]
iretd
loope 0x1400755cc
invalid
outsd dx, dword [rsi]
jp 0x140075553
invalid
invalid
sti
xlatb
movabs eax, dword [0x7612daa81eeaf8ed]
sub byte [rcx + 0x4ab42a64], al
jne 0x140075620
pushfq
invalid
in eax, dx
iretd
Function at 0x1400079e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140046350]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140007a6e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140007a6e
call fcn.140004fd0
mov ebx, eax
jmp 0x140007b96
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140007a8f
call fcn.140004fd0
jmp 0x140007b85
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140007ab2
call fcn.140004fd0
jmp 0x140007b85
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140007ad4
mov ebx, 0x8007000e
jmp 0x140007b87
mov ecx, eax
test eax, eax
je 0x140007b0c
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140007b02
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140007b0c
lea rcx, [rsp + 0x70]
call fcn.140004eb0
jmp 0x140007b16
mov ecx, 0x80070216
call fcn.1400051e0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140007b29
cmp qword [rsp + 0x70], 0
jne 0x140007b38
mov ebx, 0x8007000e
jmp 0x140007b87
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140007b62
call fcn.140004fd0
jmp 0x140007b85
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140007800
mov ebx, eax
test rdi, rdi
je 0x140007b96
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140007bad
lea rcx, [rsp + 0x70]
call fcn.140006220
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400183d0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140008500
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140008540
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x140008558
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140008564
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x140008560
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140008fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rbx, rdx
mov r14, rcx
call fcn.140011810
xor edi, edi
lea r8d, [rdi + 5]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400090b9
mov r8d, 0xf0
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15d, edi
test rax, rax
je 0x140009017
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x60], rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000909b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14000909b
mov rdx, r15
mov rcx, rax
call fcn.140010420
mov r9, r12
mov r8, r13
mov rsi, rax
mov rax, qword [rsp + 0x80]
mov rcx, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x14000907d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rbp
je 0x1400090a3
test rsi, rsi
je 0x1400090a3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400090a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r15, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
test ebx, ebx
je 0x1400090b9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400107c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x1400107e8
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x40]
lea r8, [0x14000d920]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140010829
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x140010cb0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14004d0a1], 0
mov esi, edx
mov rdi, rcx
je 0x140010cd6
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x140010d18
cmp eax, 0x80010106
jne 0x140010d54
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140010d1c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rax
call fcn.14000e2a0
cmp al, 1
jne 0x140010d44
mov edx, esi
mov rcx, rdi
call fcn.140010030
mov ebx, eax
jmp 0x140010d48
mov ebx, dword [rsp + 0x40]
cmp byte [rdi + 0x62], 0
je 0x140010d54
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400119f0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea r8, str.EM47D2CDD9E9E7
xor ecx, ecx
lea edx, [rbx + 1]
mov esi, r9d
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140011a42
lea ecx, [rbx + 1]
call fcn.14000d750
test al, al
je 0x140011a42
lea rcx, [0x14004d1f0]
mov edx, esi
call fcn.140010cb0
mov ebx, eax
test rdi, rdi
je 0x140011a50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140012020
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140046350]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rdx, str.Intel_R__HD_Graphics_Control_Panel___Hot_Key_Panel
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x14001207f
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.Intel_R__Graphics_Control_Panel
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x1400120bc
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.Intel_R__Display_Port_Topology_Viewer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400120e3
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.Intel_R__Display_Custom_Resolutions
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14001210a
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.igfxtrayWindow
lea rcx, str.igfxtrayClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140012137
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1989
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rdi
call fcn.1400122c0
mov rbx, qword [rdi + 0x68]
test rbx, rbx
je 0x140012264
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0
call qword [rax + 0x2b8]
test eax, eax
jns 0x14001217a
lea r8, [0x140030920]
mov rdx, rbx
mov ecx, eax
call fcn.140015580
lea rcx, [rsp + 0x30]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [0x140030a48]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, [0x140030a48]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, [0x140030a48]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
cmp dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
je 0x1400121f4
lea rdx, str.Gfxv4_0.exe
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, str.DPTopologyApp.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, str.CustomModeApp.exe
jmp 0x14001221a
lea rdx, str.Gfxv2_0.exe
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, str.DPTopologyAppv2_0.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, str.CustomModeAppv2_0.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rcx, [rsp + 0x30]
call fcn.1400150a0
lea rcx, [rsp + 0x30]
call fcn.1400150a0
lea rcx, [rsp + 0x30]
call fcn.1400150a0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400183d0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
mov ecx, 0x80004003
call fcn.140015570
int3