joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fe10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, r8
mov r15, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140067170
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x40]
mov r8, rbx
sete sil
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14004fe90
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.14000a2d0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14004ff5b
test sil, sil
jne 0x14004ff5b
mov ecx, eax
mov qword [rsp + 0x2a8], rdi
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140064e98
mov rdi, rax
test rax, rax
je 0x14004ff30
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete sil
test eax, eax
jne 0x14004ff28
nop
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14004ff10
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.14000a2d0
mov rcx, rdi
call fcn.140064808
mov rdi, qword [rsp + 0x2a8]
movzx eax, sil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140064920
add rsp, 0x260
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
movzx eax, sil
jmp 0x14004ff3c

Function at 0x14004ff70
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
sub rsp, 0x38
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x14004ffa0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x14004ffe0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x140050020
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [r8 + 0x10]
add rax, rax
cmp qword [r8 + 0x18], 8
jb 0x140050035
mov r8, qword [r8]
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x140050060
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
xor r10d, r10d
test r8, r8
je 0x1400500a0
mov r9d, r9d
mov rax, r8
shr r9, 1
mov r11, r9
je 0x140050090
nop word [rax + rax]
cmp word [rax], r10w
je 0x140050090
add rax, 2
sub r9, 1
jne 0x140050080
sub r11, r9
test r9, r9
cmove r11, r10
je 0x1400500a0
lea r10, [r11 + r11]
add r10, 2
mov r9d, 1
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x140050e60
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
mov qword [0x1400c4a40], rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov edx, 0x3ff
and cx, dx
cmp cx, 9
jne 0x140050e9b
mov ecx, 0xfc00
mov byte [0x1400c4a48], 1
and ax, cx
mov ecx, 0x400
cmp ax, cx
je 0x140050ea2
mov byte [0x1400c4a48], 0
add rsp, 0x28
ret
Function at 0x1400515f0
Capabilities:
Enumerate process modules

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x270
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 0x20], rbp
mov rsi, rcx
mov qword [r11 - 0x20], r14
lea rcx, [rsp + 0x30]
mov qword [r11 - 0x28], r15
mov r14d, edx
movzx r15d, r8b
xor edx, edx
mov r8d, 0x208
call fcn.140067170
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140051849
lea rdx, [rsi + 0x234]
mov qword [rsp + 0x260], r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor r12d, r12d
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], r12
mov rcx, rbp
mov dword [rsp + 0x20], r12d
lea r8d, [r12 + 8]
call sub.KERNEL32.dll_K32EnumProcessModules
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x140051838
mov qword [rsp + 0x268], rdi
lea r8, [rsp + 0x30]
mov edi, 0x104
mov rcx, rbp
mov r9d, edi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x140051830
lea r8d, [r12 + 1]
mov qword [rsp + 0x290], rbx
lea rdx, [0x1400957f0]
lea rcx, [rsi + 0x210]
call fcn.14000a2d0
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x1400516f0
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x210]
call fcn.14000baf0
mov r8d, 1
lea rdx, [0x1400957f0]
lea rcx, [rsi + 0x210]
call fcn.14000baf0
mov rcx, rdi
lea rax, [rsp + 0x30]
lea rbx, [rsi + 4]
cmp word [rax], r12w
je 0x140051740
add rax, 2
sub rcx, 1
jne 0x140051730
mov rdx, rdi
mov rax, r12
sub rdx, rcx
test rcx, rcx
lea rcx, [rsp + 0x30]
cmove rdx, r12
cmovne rax, rdx
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x30]
cmp rcx, rax
jbe 0x140051781
cmp word [rcx], 0x5c
je 0x14005177d
sub rcx, 2
lea rax, [rsp + 0x30]
cmp rcx, rax
ja 0x140051767
jmp 0x140051781
add rcx, 2
mov r8, rdi
mov rdx, rbx
sub rcx, rbx
nop word [rax + rax]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x1400517b2
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400517b2
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x140051790
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r12w
test rbx, rbx
je 0x1400517ec
mov rcx, rdi
mov rax, rbx
nop dword [rax]
cmp word [rax], r12w
je 0x1400517e0
add rax, 2
sub rcx, 1
jne 0x1400517d0
sub rdi, rcx
test rcx, rcx
cmove rdi, r12
jne 0x1400517ef
mov rdi, r12
lea rax, [rbx + rdi*2]
cmp rax, rbx
jbe 0x14005180d
cmp word [rax], 0x2e
je 0x140051809
sub rax, 2
cmp rax, rbx
ja 0x1400517f8
jmp 0x14005180d
mov word [rax], r12w
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharLowerW]
lea rcx, [rsi + 0x20c]
mov rdx, rbx
call fcn.140051d20
mov rbx, qword [rsp + 0x290]
mov dword [rsi], r14d
mov rdi, qword [rsp + 0x268]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x260]
mov r14, qword [rsp + 0x258]
test r15b, r15b
mov r15, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x298]
je 0x140051878
cmp dword [rsi], 0
je 0x14005187b
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400518a0
cmp dword [rsi], 0
seta al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140064920
add rsp, 0x270
pop rsi
ret
Function at 0x1400518a0
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rsp + 0x60], 0
mov rbp, rcx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x140051936
mov ecx, edi
mov qword [rsp + 0x50], rbx
call fcn.140064e98
mov rbx, rax
test rax, rax
je 0x140051931
mov r9, rax
mov qword [rsp + 0x20], 0
mov r8d, edi
mov dword [rsp + 0x68], 0
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x68]
mov rcx, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x1400ae83c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140051929
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 8]
mov dword [rbp + 0x230], ecx
mov rcx, rbx
call fcn.140064808
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x140051970
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 4]
mov rbx, rcx
lea rdx, [0x14009b230]
mov rcx, rdi
mov r9d, 0x208
call fcn.14004ff70
lea r8, [rbx + 0x210]
mov rcx, rdi
lea rdx, str.commandline
call fcn.14004fe10
lea r8, [rbx + 0x20c]
mov rcx, rdi
lea rdx, str.apphash
call fcn.14004fd40
lea r8, [rbx + 0x230]
mov rcx, rdi
lea rdx, str.version
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14004fd40

Function at 0x1400519f0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.140067170
xor r9d, r9d
lea r8d, [rdi + 0x23]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x140051a60
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000a2d0
mov dword [rsp + 0x20], 1
mov r8d, 0x19
lea rdx, str.NVIDIA_Corporation_nView
mov rcx, rbx
call fcn.14000baf0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140064920
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140051ac0
Capabilities:
Get common file path
Get installed programs
Get program files directory
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9d, dword [0x1400c4a4c]
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x140051b3d
mov dword [0x1400c4a4c], 0x20019
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140051b36
cmp dword [rsp + 0x30], r14d
je 0x140051b36
mov r9d, dword [0x1400c4a4c]
bts r9d, 8
mov dword [0x1400c4a4c], r9d
jmp 0x140051b3d
mov r9d, dword [0x1400c4a4c]
test rsi, rsi
je 0x140051d18
test rdi, rdi
je 0x140051d18
lea rax, [rsp + 0x38]
mov qword [rsp + 0x298], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2FE1952_0186_46C3_BAEC_A80AA35AC5B8_Display.NView
mov qword [rsp + 0x38], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140051bfb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallLocation
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov qword [rsp + 0x290], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
mov ebx, eax
sete bpl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x290]
jne 0x140051bfb
movzx eax, bpl
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140064920
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140067170
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
shr rdi, 1
mov r9d, 0x7ffffffe
lea rax, [rdi - 1]
cmp rax, r9
ja 0x140051c78
sub r9, rdi
lea r8, [rsp + 0x40]
sub r8, rsi
mov rdx, rdi
mov rcx, rsi
lea rax, [r9 + rdx]
test rax, rax
je 0x140051c64
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140051c64
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140051c44
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, rdi
mov word [rax], r14w
jmp 0x140051c9a
test rdi, rdi
je 0x140051d11
mov word [rsi], r14w
cmp rdi, 0x7fffffff
ja 0x140051d11
mov rcx, rdi
test rdi, rdi
je 0x140051cb0
mov rax, rsi
nop dword [rax]
cmp word [rax], r14w
je 0x140051cb0
add rax, 2
sub rcx, 1
jne 0x140051ca0
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x140051d11
mov rdx, rdi
lea rcx, [rsi + rax*2]
sub rdx, rax
je 0x140051d02
sub rax, rdi
lea r9, str.NVIDIA_Corporation_nView
add rax, 0x7ffffffe
add rax, rdx
sub r9, rcx
test rax, rax
je 0x140051d02
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140051d02
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140051ce1
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov al, 1
jmp 0x140051bd7
xor al, al
jmp 0x140051bdf
Function at 0x140051e70
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ecx, dword [0x1400c4a50]
test ecx, ecx
jne 0x140051f91
lea rcx, [0x14009b378]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x140051eca
call rax
jmp 0x140051ed0
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x140051f8b
mov edx, dword [rsp + 0x24]
cmp edx, 5
jne 0x140051efa
xor ecx, ecx
cmp dword [rsp + 0x28], ecx
seta cl
inc ecx
mov dword [0x1400c4a50], ecx
jmp 0x140051f91
cmp edx, 6
jne 0x140051f59
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x140051f14
mov ecx, 3
mov dword [0x1400c4a50], ecx
jmp 0x140051f91
cmp eax, 1
jne 0x140051f26
mov ecx, 4
mov dword [0x1400c4a50], ecx
jmp 0x140051f91
cmp eax, 2
jne 0x140051f38
mov ecx, 5
mov dword [0x1400c4a50], ecx
jmp 0x140051f91
cmp eax, 3
jne 0x140051f4a
mov ecx, 6
mov dword [0x1400c4a50], ecx
jmp 0x140051f91
jbe 0x140051f8b
mov ecx, 8
mov dword [0x1400c4a50], ecx
jmp 0x140051f91
cmp edx, 0xa
jne 0x140051f73
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x140051f4c
mov ecx, 7
mov dword [0x1400c4a50], ecx
jmp 0x140051f91
mov eax, dword [0x1400c4a50]
mov ecx, 8
cmova eax, ecx
mov ecx, eax
mov dword [0x1400c4a50], eax
jmp 0x140051f91
mov ecx, dword [0x1400c4a50]
mov eax, ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140064920
add rsp, 0x158
ret

Function at 0x140051fb0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ecx, dword [0x1400c4a50]
test ecx, ecx
jne 0x1400520d1
lea rcx, [0x14009b378]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x14005200a
call rax
jmp 0x140052010
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x1400520cb
mov edx, dword [rsp + 0x24]
cmp edx, 5
jne 0x14005203a
xor ecx, ecx
cmp dword [rsp + 0x28], ecx
seta cl
inc ecx
mov dword [0x1400c4a50], ecx
jmp 0x1400520d1
cmp edx, 6
jne 0x140052099
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x140052054
mov ecx, 3
mov dword [0x1400c4a50], ecx
jmp 0x1400520d1
cmp eax, 1
jne 0x140052066
mov ecx, 4
mov dword [0x1400c4a50], ecx
jmp 0x1400520d1
cmp eax, 2
jne 0x140052078
mov ecx, 5
mov dword [0x1400c4a50], ecx
jmp 0x1400520d1
cmp eax, 3
jne 0x14005208a
mov ecx, 6
mov dword [0x1400c4a50], ecx
jmp 0x1400520d1
jbe 0x1400520cb
mov ecx, 8
mov dword [0x1400c4a50], ecx
jmp 0x1400520d1
cmp edx, 0xa
jne 0x1400520b3
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14005208c
mov ecx, 7
mov dword [0x1400c4a50], ecx
jmp 0x1400520d1
mov eax, dword [0x1400c4a50]
mov ecx, 8
cmova eax, ecx
mov ecx, eax
mov dword [0x1400c4a50], eax
jmp 0x1400520d1
mov ecx, dword [0x1400c4a50]
cmp ecx, 7
setge al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140064920
add rsp, 0x158
ret
Function at 0x14005c490
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14, rcx
xor r15d, r15d
mov rax, rdx
mov dword [rsp + 0x50], r15d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x40], rcx
lea rdx, str.DisplayConfig
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rcx, rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x123
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.14004ed00
test eax, eax
jne 0x14005c643
mov rcx, qword [rsp + 0x60]
lea rbp, [r14 + 8]
mov dword [rsp + 0x28], 4
lea r9d, [r15 + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.pathInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, r15d
cmp dword [rbp], r15d
jbe 0x14005c63f
nop
mov r8d, esi
mov qword [rsp + 0x58], r15
lea rdx, str.pathInfo_d
lea rcx, [rsp + 0x70]
call fcn.14005ad40
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x12f
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.14004ed00
test eax, eax
jne 0x14005c643
mov rdx, qword [rsp + 0x58]
mov eax, esi
imul rdi, rax, 0x38
mov rcx, qword [rdi + r14 + 0x28]
call fcn.14005e440
mov rcx, qword [rsp + 0x58]
lea rbx, [r14 + 0x18]
add rbx, rdi
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, str.targetInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x58]
mov edx, dword [rbx]
mov rcx, qword [rdi + r14 + 0x20]
call fcn.14005d2c0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [rbp]
jb 0x14005c560
mov al, 1
jmp 0x14005c645
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140064920
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f800
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov rdi, rdx
mov rsi, rcx
call fcn.14005f1e0
xor r15d, r15d
mov dword [rsp + 0x40], 0x50
mov r14, rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x240]
mov qword [rsp + 0x30], r15
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov ebx, r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005f985
mov r9d, 0xf003f
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.14004fc40
test eax, eax
jne 0x14005f943
xor edx, edx
mov dword [rsp + 0x68], r15d
mov r8d, 0xa0
mov qword [rsp + 0x70], r15
lea rcx, [rbp + 0x1a0]
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], r15
mov dword [rsp + 0x78], r15d
mov word [rsp + 0x7c], r15w
mov dword [rbp + 0x184], r15d
call fcn.140067170
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0x1a0]
mov r9d, 0xa0
lea rdx, str.Action
call fcn.14004ff70
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call fcn.14005f0c0
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x14005f938
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.14005f9b0
test al, al
je 0x14005f938
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14005f470
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x50
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x240]
inc ebx
mov qword [rsp + 0x28], r15
mov edx, ebx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14005f880
mov al, 1
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.140064920
mov rbx, qword [rsp + 0x430]
add rsp, 0x3f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140060a50
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x10], dl
mov rbx, rcx
mov rdx, rcx
lea rcx, [0x140060b20]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, rbx
lea rcx, [0x140060a90]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_EnumWindows]

Function at 0x140060b60
Capabilities:
Enumerate gui resources

Disassembly:
test rcx, rcx
je 0x140060cd9
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, r8
mov ebp, edx
mov rdi, rcx
test edx, edx
jne 0x140060bbb
call fcn.140060e20
cmp rax, rdi
je 0x140060ba9
test rax, rax
je 0x140060cc5
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, rdi
call fcn.140061040
mov ecx, 1
test al, al
cmove ebp, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rcx, qword [rsp + 0x20]
call fcn.140061250
mov dword [rsp + 0x2c], eax
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rsp + 0x40]
je 0x140060c03
mov qword [rdx], rdi
add qword [rsp + 0x38], 8
jmp 0x140060c12
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140023c60
test ebp, ebp
jne 0x140060c1f
lea rcx, [0x140060310]
jmp 0x140060c39
cmp ebp, 1
jne 0x140060c2d
lea rcx, [0x140060270]
jmp 0x140060c39
cmp ebp, 2
jne 0x140060c44
lea rcx, [0x1400601f0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 3
test eax, eax
jle 0x140060caf
mov rdi, rsi
nop dword [rax]
mov rcx, qword [rdi + rcx]
call fcn.140061010
test al, al
jne 0x140060c94
mov r8, qword [rsp + 0x30]
add r8, rdi
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140060c8c
mov rax, qword [r8]
mov qword [rdx], rax
add qword [rbx + 8], 8
jmp 0x140060c94
mov rcx, rbx
call fcn.140023c60
inc esi
add rdi, 8
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 3
cmp esi, eax
jl 0x140060c60
test rcx, rcx
je 0x140060cc5
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
call fcn.14000c080
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140060ce0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rcx
mov rdx, rcx
lea rcx, [0x140060390]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [r14 + 8]
xor r13d, r13d
mov rbx, qword [r14]
xor r12b, r12b
sub rax, rbx
mov ebp, r13d
sar rax, 3
test eax, eax
jle 0x140060e0f
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r15
mov r15d, r13d
mov qword [rsp + 0x58], rdi
mov rcx, qword [r15 + rbx]
mov edx, 4
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
je 0x140060d73
mov rdi, qword [r14]
mov rbx, qword [r14 + 8]
mov rcx, rdi
cmp rdi, rbx
je 0x140060d62
cmp qword [rcx], rax
je 0x140060d62
add rcx, 8
cmp rcx, rbx
jne 0x140060d54
call fcn.1400083f0
cmp rax, rbx
je 0x140060d73
mov qword [r15 + rdi], r13
mov r12b, 1
mov rsi, qword [r14 + 8]
inc ebp
mov rbx, qword [r14]
mov rax, rsi
sub rax, rbx
add r15, 8
sar rax, 3
cmp ebp, eax
jl 0x140060d31
mov r15, qword [rsp + 0x60]
test r12b, r12b
je 0x140060e05
cmp rbx, rsi
je 0x140060de2
nop dword [rax]
mov rcx, qword [rbx]
call fcn.140061150
test al, al
jne 0x140060db5
add rbx, 8
cmp rbx, rsi
jne 0x140060da0
cmp rbx, rsi
je 0x140060de2
lea rdi, [rbx + 8]
cmp rdi, rsi
je 0x140060de2
mov rbp, qword [rdi]
mov rcx, rbp
call fcn.140061150
test al, al
jne 0x140060dd9
mov qword [rbx], rbp
add rbx, 8
add rdi, 8
cmp rdi, rsi
jne 0x140060dc3
mov rdi, qword [r14 + 8]
mov rcx, rbx
call fcn.1400083f0
cmp rax, rdi
je 0x140060e05
mov r8, rax
mov rdx, rdi
mov rcx, rdi
call fcn.14002dcc0
mov qword [r14 + 8], rax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x140061160
Capabilities:
Enumerate gui resources

Disassembly:
mov dword [rcx + 0x10], edx
mov rdx, rcx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r9
lea rcx, [0x1400611f0]
jmp qword [sym.imp.USER32.dll_EnumWindows]