joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003ef70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor ebp, ebp
lea rcx, [rax - 0x28]
mov rsi, r8
mov qword [rax - 0x28], rbp
mov r8, qword [rdx]
mov rbx, r9
mov rdi, rdx
mov dword [rax - 0x20], ebp
lea r9d, [rbp + 2]
mov qword [rax - 0x18], rbp
mov rdx, 0xffffffff80000002
call fcn.140024490
test eax, eax
je 0x14003eff2
mov r8, qword [rdi]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebp
call fcn.14002e590
test eax, eax
je 0x14003eff2
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003f02e
jmp 0x14003f028
mov eax, dword [rsp + 0x90]
mov r9d, 3
mov rdx, qword [rsi]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003f06d
test rbx, rbx
je 0x14003f02e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
mov ebx, 0xffffffff
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003f04f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14003f069
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14003f0bb
test rbx, rbx
je 0x14003f07b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
mov ebx, 0xffffffff
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003f09c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14003f0b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14003f1b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, qword [rsp + 0x80]
mov rdi, r8
mov r8, qword [rdx]
mov rbp, r9
mov rsi, rdx
test rbx, rbx
jne 0x14003f1eb
lea rdx, [r8 - 0x18]
jmp 0x14003f2bb
xor eax, eax
lea rcx, [rsp + 0x30]
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], rax
lea r9d, [rax + 1]
call fcn.140024490
test eax, eax
je 0x14003f227
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14003f2b4
jmp 0x14003f2ae
mov rdx, qword [rdi]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003f2a6
cmp dword [rsp + 0x60], 3
jne 0x14003f2a6
test rbx, rbx
je 0x14003f263
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsi]
mov ebx, 0xffffffff
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003f284
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14003f29f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
jmp 0x14003f2f1
test rbx, rbx
je 0x14003f2b4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsi]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003f2d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14003f2ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003fd40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
movzx eax, word [rcx]
cmp ax, word [0x140393240]
jne 0x14003fd5e
lea rdx, [rcx - 0x18]
jmp 0x14003fd70
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rbx]
sub rdx, 0x18
cmp eax, 0xffffffff
jne 0x14003fd90
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003fd88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003fda8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140040050
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rdi, r8
mov rsi, rcx
test rcx, rcx
jne 0x140040086
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
je 0x140040074
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x38]
call fcn.14003bcd0
mov dword [rsp + 0x80], ebp
mov ebx, 1
mov r9d, ebx
mov r8, rsi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140024490
test eax, eax
jne 0x14004011f
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004011f
cmp dword [rsp + 0x30], 4
jne 0x14004011f
mov eax, dword [rsp + 0x80]
mov dword [rdi], eax
jmp 0x140040121
mov ebx, ebp
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040144
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140040154
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140040170
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov rbx, rdx
test rcx, rcx
jne 0x140040192
mov rdx, qword [rdx]
jmp 0x14004027c
test rsi, rsi
jne 0x14004019f
mov rdx, qword [rdx]
jmp 0x14004027c
xor eax, eax
mov r8, rcx
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rax
lea r9d, [rax + 1]
mov dword [rsp + 0x60], eax
call fcn.140024490
test eax, eax
je 0x1400401e2
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140040279
jmp 0x140040273
mov rdi, qword [rsp + 0x38]
lea rax, [rsp + 0x78]
mov rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov dword [rsp + 0x78], 4
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004026b
cmp dword [rsp + 0x30], 4
jne 0x14004026b
mov eax, dword [rsp + 0x60]
mov dword [rsi], eax
test rdi, rdi
je 0x140040236
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
mov eax, 0xffffffff
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040256
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
je 0x140040279
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040298
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400402b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
mov rdx, qword [rdx]
mov esi, r8d
mov rbx, rcx
test rcx, rcx
jne 0x1400402d9
add rdx, 0xffffffffffffffe8
jmp 0x140040389
movzx eax, word [rdx]
cmp ax, word [0x140393240]
jne 0x1400402ee
add rdx, 0xffffffffffffffe8
jmp 0x140040389
xor eax, eax
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], rax
call fcn.140042540
test eax, eax
jne 0x140040316
mov rdx, rbx
call fcn.140042490
test eax, eax
je 0x140040382
mov r9d, 2
lea rcx, [rsp + 0x30]
mov r8, rbx
mov rdx, 0xffffffff80000002
call fcn.140024490
test eax, eax
je 0x140040340
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140040382
jmp 0x14004037c
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov rdx, qword [rdi]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400403b3
test rbx, rbx
je 0x140040382
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400403a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rbx, rbx
je 0x1400403c1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
mov eax, 0xffffffff
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400403e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x68]
mov eax, 1
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140040400
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov esi, r8d
mov rdi, rcx
test rcx, rcx
jne 0x140040436
xor eax, eax
lea r11, [r11 - 8]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x40]
call fcn.14003bcd0
mov dword [rsp + 0x80], ebx
lea r9d, [rbx + 3]
mov r8, rdi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140024490
test eax, eax
jne 0x140040501
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400404cb
cmp dword [rsp + 0x30], 4
jne 0x1400404cb
cmp dword [rsp + 0x80], esi
je 0x1400404fc
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140040501
mov ebx, 1
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040524
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140040534
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140040550
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov esi, r8d
mov rdi, rcx
test rcx, rcx
jne 0x140040583
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
add rsp, 0x60
pop rdi
ret
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x88]
call fcn.14003bcd0
lea r9d, [rbx + 2]
mov r8, rdi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140024490
test eax, eax
je 0x1400405ed
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, rdi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14002e590
test eax, eax
jne 0x140040626
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140040626
lea ebx, [rax + 1]
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004064c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14004065c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140040680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x10090
call fcn.1402ed7b0
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x100c8], rbx
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x10080], rax
mov r15, r9
mov r14, r8
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
xor ebp, ebp
mov dword [rsp + 0x34], ebp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140040865
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, [0x140393240]
mov rdx, rsi
mov rcx, rdi
call fcn.1400168b0
lea rbx, [rbp - 1]
test al, al
jne 0x140040739
mov rax, rbx
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x140040720
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.140016ad0
nop
mov dword [rsp + 0x34], 1
mov r9d, 1
mov r8, qword [r14]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140024490
mov rsi, qword [rsp + 0x40]
test eax, eax
jne 0x1400407f4
mov dword [rsp + 0x30], 0xfffe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400407f4
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x1400407f4
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400407c3
test al, 1
jne 0x1400407f4
shr rax, 1
cmp word [rsp + rax*2 + 0x7e], 0
je 0x1400407cb
jmp 0x1400407f4
mov word [rsp + 0x80], bp
lea rcx, [rsp + 0x80]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400407d6
mov r8d, eax
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.140016ad0
nop
test rsi, rsi
je 0x140040803
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040820
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004083b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1402ecc20
mov rbx, qword [rsp + 0x100c8]
add rsp, 0x10090
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140012800
int3
Function at 0x140041080
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rdi
mov eax, 0x10060
call fcn.1402ed7b0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x10078], rbx
mov qword [rsp + 0x10080], rbp
mov qword [rsp + 0x10088], rsi
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x10050], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x1400411e6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, [0x140393240]
mov rdx, rsi
mov rcx, rdi
call fcn.1400168b0
lea rbx, [rbp - 1]
test al, al
jne 0x140041129
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140041110
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.140016ad0
nop
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x50]
call fcn.1402ef020
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400411ba
lea rcx, [rsp + 0x50]
mov rax, rbx
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140041170
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x140041198
lea rax, [rax*2 - 2]
cmp rax, 0xfffe
jae 0x1400411f1
mov word [rsp + rax + 0x50], bp
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400411a0
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140016ad0
mov rax, rdi
mov rcx, qword [rsp + 0x10050]
xor rcx, rsp
call fcn.1402ecc20
lea r11, [rsp + 0x10060]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140012800
int3
call fcn.1402ed414
int3
Function at 0x140041200
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rdi
mov eax, 0x10060
call fcn.1402ed7b0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x10078], rbx
mov qword [rsp + 0x10080], rbp
mov qword [rsp + 0x10088], rsi
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x10050], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140041366
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, [0x140393240]
mov rdx, rsi
mov rcx, rdi
call fcn.1400168b0
lea rbx, [rbp - 1]
test al, al
jne 0x1400412a9
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140041290
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.140016ad0
nop
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x50]
call fcn.1402ef020
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14004133a
lea rcx, [rsp + 0x50]
mov rax, rbx
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400412f0
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x140041318
lea rax, [rax*2 - 2]
cmp rax, 0xfffe
jae 0x140041371
mov word [rsp + rax + 0x50], bp
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140041320
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140016ad0
mov rax, rdi
mov rcx, qword [rsp + 0x10050]
xor rcx, rsp
call fcn.1402ecc20
lea r11, [rsp + 0x10060]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140012800
int3
call fcn.1402ed414
int3
Function at 0x140041380
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rdi
mov eax, 0x10060
call fcn.1402ed7b0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x10078], rbx
mov qword [rsp + 0x10080], rbp
mov qword [rsp + 0x10088], rsi
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x10050], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140041502
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, [0x140393240]
mov rdx, rsi
mov rcx, rdi
call fcn.1400168b0
lea rbx, [rbp - 1]
test al, al
jne 0x140041429
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140041410
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.140016ad0
nop
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x50]
call fcn.1402ef020
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400414d6
lea rcx, [rsp + 0x50]
mov rax, rbx
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140041470
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x140041498
lea rax, [rax*2 - 2]
cmp rax, 0xfffe
jae 0x14004150d
mov word [rsp + rax + 0x50], bp
lea rcx, [rsp + 0x50]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400414a0
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140016ad0
lea rdx, str.RealtekAudioHDA_
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400414c1
mov r8d, ebx
mov rcx, rdi
call fcn.140016630
mov rax, rdi
mov rcx, qword [rsp + 0x10050]
xor rcx, rsp
call fcn.1402ecc20
lea r11, [rsp + 0x10060]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140012800
int3
call fcn.1402ed414
int3
Function at 0x140041bb0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
add rcx, 0x1ac8
xor edx, edx
call fcn.1400f23c0
mov rbx, rax
test rax, rax
jne 0x140041be1
add rsp, 0x80
pop rbx
ret
cmp dword [rax + 0xc8], 9
jne 0x140041bf1
xor ebx, ebx
jmp 0x140041d16
lea rcx, [rsp + 0x30]
call fcn.140101690
lea rax, vtable.CDolbySetting.0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x58], 3
mov qword [rsp + 0x60], rbx
mov rax, qword [rbx]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [rax + 0x28]
mov rdx, qword [rsp + 0x60]
xor ebx, ebx
mov dword [rsp + 0x7c], ebx
test dword [rdx + 0x1cc], 0x100
jne 0x140041c45
test dword [rdx + 0x1d0], 0x1000000
je 0x140041c4d
mov dword [rsp + 0x68], 1
mov eax, dword [rdx + 0x1d0]
mov ecx, eax
and ecx, 0x2000
jne 0x140041c6f
bt eax, 0x15
jb 0x140041c6f
bt eax, 0x17
jb 0x140041c6f
bt eax, 0x16
jae 0x140041cbe
test ecx, ecx
je 0x140041c7e
mov ecx, eax
test byte [rdx + 0x1cc], 0x40
jne 0x140041ca7
mov ecx, eax
bt eax, 0x16
jb 0x140041ca7
mov r8d, dword [rdx + 0xc8]
cmp r8d, 1
je 0x140041ca7
cmp r8d, 3
je 0x140041ca7
mov dword [rsp + 0x68], 1
mov ecx, dword [rdx + 0x1d0]
bt ecx, 0xd
lea rcx, [rsp + 0x30]
jae 0x140041cb9
call fcn.14006ee40
jmp 0x140041cbe
call fcn.14006f8b0
lea rcx, [rsp + 0x30]
call fcn.14006f170
test eax, eax
jne 0x140041cda
lea rcx, [rsp + 0x30]
call fcn.14006f460
test eax, eax
je 0x140041cdf
mov ebx, 1
lea rax, vtable.CPropSetting.0
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041d0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x30]
call fcn.14010eb70
mov r9d, ebx
lea r8, str.DolbyPcee3
lea rdx, str.Others
lea rcx, [0x14046a640]
add rsp, 0x80
pop rbx
jmp fcn.14016a2dc