joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180028090
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r8
mov rcx, qword [rcx + 0x4210]
mov rdi, rdx
test rcx, rcx
jne 0x1800280de
test dword [0x180058af0], 0x840
je 0x1800280e4
lea edx, [rcx + 0x7b]
mov r8d, 0x840
lea rcx, str.C:CodeklcpLAVFilterslibbluray_srcutilmutex.c
lea r9, str.bd_mutex_lock___failed___n
call fcn.180029220
jmp 0x1800280e4
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [rbx + 0x4200]
xor ecx, ecx
test edx, edx
je 0x180028118
mov r8, qword [rbx + 0x4208]
nop word [rax + rax]
mov eax, ecx
add rax, rax
cmp qword [r8 + rax*8], rsi
jne 0x180028112
cmp qword [r8 + rax*8 + 8], rdi
je 0x18002818a
inc ecx
cmp ecx, edx
jb 0x180028100
mov rcx, qword [rbx + 0x4208]
inc edx
shl rdx, 4
call fcn.18002c514
test rax, rax
je 0x180028160
mov ecx, dword [rbx + 0x4200]
add rcx, rcx
mov qword [rbx + 0x4208], rax
mov qword [rax + rcx*8 + 8], rdi
mov ecx, dword [rbx + 0x4200]
mov rax, qword [rbx + 0x4208]
add rcx, rcx
mov qword [rax + rcx*8], rsi
inc dword [rbx + 0x4200]
jmp 0x18002818a
test dword [0x180058af0], 0x840
je 0x18002818a
lea r9, str.bd_psr_register_cb__:_realloc_failed_n
mov edx, 0xf7
mov r8d, 0x840
lea rcx, str.C:CodeklcpLAVFilterslibbluray_srclibbluray_register.c
call fcn.180029220
mov rcx, qword [rbx + 0x4210]
test rcx, rcx
jne 0x1800281cf
test dword [0x180058af0], 0x840
je 0x1800281d5
lea r9, str.bd_mutex_unlock___failed___n
mov r8d, 0x840
mov edx, 0x84
lea rcx, str.C:CodeklcpLAVFilterslibbluray_srcutilmutex.c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180029220
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180028330
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x4210]
test rcx, rcx
jne 0x18002836f
test dword [0x180058af0], 0x840
je 0x180028375
lea edx, [rcx + 0x7b]
mov r8d, 0x840
lea rcx, str.C:CodeklcpLAVFilterslibbluray_srcutilmutex.c
lea r9, str.bd_mutex_lock___failed___n
call fcn.180029220
jmp 0x180028375
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movaps xmm0, xmmword [0x18004b6d0]
movups xmmword [rbx + 0x90], xmm0
mov eax, dword [0x18004b6e0]
mov dword [rbx + 0xa0], eax
movsd xmm0, qword [0x18004b6e8]
movsd qword [rbx + 0xa8], xmm0
mov eax, dword [0x18004b6f0]
mov dword [rbx + 0xb0], eax
mov rcx, qword [rbx + 0x4210]
test rcx, rcx
jne 0x1800283e6
test dword [0x180058af0], 0x840
je 0x1800283f2
lea r9, str.bd_mutex_unlock___failed___n
mov edx, 0x84
mov r8d, 0x840
lea rcx, str.C:CodeklcpLAVFilterslibbluray_srcutilmutex.c
add rsp, 0x20
pop rbx
jmp fcn.180029220
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x20
pop rbx
ret
Function at 0x180029220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
mov eax, 0x1048
call fcn.180040240
sub rsp, rax
mov rax, qword [0x180058008]
xor rax, rsp
mov qword [rsp + 0x1030], rax
cmp dword [0x180059df8], 0
mov esi, r8d
mov ebp, edx
mov rdi, rcx
jne 0x180029324
mov ecx, 2
mov dword [0x180059df8], 1
call fcn.18002c48c
mov qword [0x180059e00], rax
mov ecx, 0x800
mov eax, dword [0x180058af0]
cmp eax, 0xffffffff
cmove eax, ecx
lea rcx, str.BD_DEBUG_MASK
mov dword [0x180058af0], eax
call fcn.18002e978
test rax, rax
je 0x1800292b3
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.180030e04
mov dword [0x180058af0], eax
lea rcx, str.BD_DEBUG_FILE
call fcn.18002e978
mov rbx, rax
test rax, rax
je 0x180029324
lea rdx, [0x1800502b0]
mov rcx, rax
call fcn.18002f898
test rax, rax
je 0x1800292ff
xor r9d, r9d
mov qword [0x180059e00], rax
xor edx, edx
mov rcx, rax
lea r8d, [r9 + 4]
call fcn.18002f9c4
mov dword [0x180059dec], 1
jmp 0x180029324
mov rcx, qword [0x180059e00]
lea r8, str.C:CodeklcpLAVFilterslibbluray_srcutillogging.c
mov r9d, 0x4e
mov qword [rsp + 0x20], rbx
lea rdx, str._s:_d:_Error_opening_log_file__s_n
call fcn.180001180
test dword [0x180058af0], esi
je 0x180029407
mov edx, 0x5c
mov rcx, rdi
call fcn.18002a5f0
test rax, rax
je 0x180029346
lea rdi, [rax + 1]
mov r9d, ebp
lea rdx, str._s:_d:
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.180024be0
movsxd rsi, eax
test eax, eax
js 0x180029407
mov edi, 0xfff
lea rbx, [rsp + 0x30]
sub rdi, rsi
lea rbp, [rsp + 0x1090]
add rbx, rsi
call fcn.180001170
mov r9, qword [rsp + 0x1088]
mov r8, rdi
mov qword [rsp + 0x28], rbp
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
or rcx, 2
call fcn.18002e634
mov ebx, eax
mov eax, 0xffffffff
test ebx, ebx
cmovs ebx, eax
test ebx, ebx
js 0x180029407
mov rdx, qword [0x180059df0]
test rdx, rdx
je 0x1800293e1
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x102f], 0
call rdx
cmp dword [0x180059dec], 0
je 0x180029407
mov r9, qword [0x180059e00]
lea rcx, [rsp + 0x30]
add esi, ebx
mov eax, 0x1000
cmp esi, eax
mov r8d, 1
cmovae esi, eax
movsxd rdx, esi
call fcn.18002f680
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.180029820
add rsp, 0x1048
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140005174
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x140061550]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov rbx, rdx
mov qword [r11 - 0x18], rdx
xor dil, dil
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x40]
call fcn.14001dda0
mov r11d, dword [rbx + 0x1c0]
mov dword [rsp + 0x58], r11d
movzx eax, word [rbx + 4]
mov word [rsp + 0x7c], ax
movzx eax, word [rbx + 8]
mov word [rsp + 0x7e], ax
movzx eax, word [rbx + 0x10]
mov word [rsp + 0x82], ax
movzx eax, word [rbx + 0xc]
mov word [rsp + 0x80], ax
movzx eax, word [rbx + 0x34]
mov word [rsp + 0x8c], ax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x5c], eax
mov eax, dword [rbx]
mov dword [rsp + 0x60], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x64], eax
mov eax, dword [rbx + 0x24]
mov dword [rsp + 0x90], eax
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x98], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x16c], eax
mov eax, dword [rbx + 0x14]
mov dword [rsp + 0x17c], eax
mov eax, dword [rbx + 0x38]
mov dword [rsp + 0x18c], eax
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x19c], eax
movzx eax, word [rbx + 0x74]
mov word [rsp + 0xc0], ax
movzx eax, word [rbx + 0x78]
mov word [rsp + 0xc2], ax
movzx eax, word [rbx + 0x80]
mov word [rsp + 0xc6], ax
movzx eax, word [rbx + 0x7c]
mov word [rsp + 0xc4], ax
movzx eax, word [rbx + 0xa4]
mov word [rsp + 0xd0], ax
mov eax, dword [rbx + 0xa0]
mov dword [rsp + 0xa0], eax
mov eax, dword [rbx + 0x70]
mov dword [rsp + 0xa4], eax
mov eax, dword [rbx + 0x8c]
mov dword [rsp + 0xa8], eax
mov eax, dword [rbx + 0x94]
mov dword [rsp + 0xd4], eax
mov eax, dword [rbx + 0x90]
mov dword [rsp + 0xdc], eax
mov eax, dword [rbx + 0x88]
mov dword [rsp + 0x170], eax
mov eax, dword [rbx + 0x84]
mov dword [rsp + 0x180], eax
mov eax, dword [rbx + 0xa8]
mov dword [rsp + 0x190], eax
mov eax, dword [rbx + 0xac]
mov dword [rsp + 0x1a0], eax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x14004d770]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [0x14004d7d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140005359
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000536f
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x178
call qword [rax + 0x190]
movzx edi, dil
mov ecx, 1
test eax, eax
cmovns edi, ecx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000536f
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x30], 0
lea rcx, [rbx + 0x190]
call fcn.140004b94
nop
lea rcx, [rbx + 0x120]
call fcn.140004b94
nop
lea rcx, [rbx + 0xb0]
call fcn.140004b94
nop
lea rcx, [rbx + 0x40]
call fcn.140004b94
mov al, dil
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.14001e4a0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
Function at 0x140005e80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140061550]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
xor ebx, ebx
mov dword [rsp + 0x40], 0x104
xor edx, edx
mov r8d, 0x104
lea rcx, [r11 - 0x128]
call fcn.14001dda0
mov dil, 1
and qword [rsp + 0x70], rbx
mov qword [rsp + 0x98], 0xf
and qword [rsp + 0x90], rbx
mov byte [rsp + 0x80], bl
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140005fe6
test dil, dil
je 0x140005f5f
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xa0]
call fcn.14001d750
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.140004fa8
xor dil, dil
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x140005fa0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xa0]
call fcn.14001d750
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.140004fa8
inc ebx
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140005f2b
lea rax, str..ConfigPersist.cpp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0xc36
mov r8d, ebx
lea rdx, str.Total_available_cofigurations_as_of_now_are___d__n
lea rcx, [rsp + 0x58]
call fcn.140002184
cmp dword [0x140062e2c], ebx
jne 0x14000603a
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
lea rcx, [rsp + 0x70]
call fcn.140004b94
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14001e4a0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000a904
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14000a945
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x14004f770]
lea ecx, [r9 + 2]
mov r8d, 0x1476
mov qword [rsp + 0x20], rax
call fcn.14001f620
cmp eax, 1
jne 0x14000a945
int3
cmp byte [0x140063060], 0
jne 0x14000a989
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000a979
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140063058], rax
jmp 0x14000a980
mov rax, qword [0x140063058]
mov byte [0x140063060], 1
jmp 0x14000a990
mov rax, qword [0x140063058]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000a9a6
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14000a9ac
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ab9c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14000abe2
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x14004f770]
lea ecx, [r9 + 2]
mov r8d, 0x1615
mov qword [rsp + 0x20], rax
call fcn.14001f620
cmp eax, 1
jne 0x14000abe2
int3
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ac14
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov ebx, r9d
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
jne 0x14000ac64
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x14004f770]
lea ecx, [r9 + 2]
mov r8d, 0x1621
mov qword [r11 - 0x18], rax
call fcn.14001f620
cmp eax, 1
jne 0x14000ac64
int3
xor eax, eax
test rdi, rdi
setne al
test eax, eax
jne 0x14000aca2
xor r9d, r9d
lea rax, str.__atl_condVal
lea rdx, [0x14004f770]
lea ecx, [r9 + 2]
mov r8d, 0x1622
mov qword [rsp + 0x20], rax
call fcn.14001f620
cmp eax, 1
jne 0x14000ac9b
int3
mov eax, 0xd
jmp 0x14000acfd
cmp ebx, 1
je 0x14000acd7
cmp ebx, 2
je 0x14000acd7
xor r9d, r9d
lea rax, str._dwType____1______dwType____2___
lea rdx, [0x14004f770]
lea ecx, [r9 + 2]
mov r8d, 0x1623
mov qword [rsp + 0x20], rax
call fcn.14001f620
cmp eax, 1
jne 0x14000acd7
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsi]
mov r9d, ebx
inc eax
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000ad14
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov r12, rdx
mov rbp, rcx
mov edi, 2
cmp qword [rcx], rbx
jne 0x14000ad6a
lea rax, str.m_hKey___0
lea rdx, [0x14004f770]
xor r9d, r9d
mov r8d, 0x162e
mov ecx, edi
mov qword [r11 - 0x18], rax
call fcn.14001f620
cmp eax, 1
jne 0x14000ad6a
int3
cmp rsi, rbx
mov eax, ebx
setne al
cmp eax, ebx
jne 0x14000ada6
lea rax, str.__atl_condVal
lea rdx, [0x14004f770]
xor r9d, r9d
mov r8d, 0x162f
mov ecx, edi
mov qword [rsp + 0x20], rax
call fcn.14001f620
cmp eax, 1
jne 0x14000ad9f
int3
mov eax, 0xd
jmp 0x14000addd
mov rdi, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, eax
add ebx, eax
add rdi, rcx
cmp eax, 1
jne 0x14000ada9
mov rcx, qword [rbp]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x14000b2b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
xor ebx, ebx
lea rcx, [r11 + 0x18]
mov rax, rdx
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x40], rbx
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], rbx
mov qword [r11 - 0x58], rcx
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
xor edx, edx
mov dword [r11 + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
je 0x14000b357
mov rdx, qword [0x140063140]
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
lea r9, str.Should_not_be_here___n
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3f3
call fcn.14000a6e8
lea r11, [0x14004f580]
lea rdx, [0x14004f8f0]
lea ecx, [rbx + 2]
xor r9d, r9d
mov r8d, 0x3f4
mov qword [rsp + 0x20], r11
call fcn.14001f620
cmp eax, 1
jne 0x14000b353
int3
xor eax, eax
jmp 0x14000b363
cmp dword [rsp + 0x90], ebx
seta bl
mov eax, ebx
add rsp, 0x70
pop rbx
ret
Function at 0x14000bca4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140061550]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edi, edi
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x58], edi
call fcn.14001dda0
lea r11, [rsp + 0x5c]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareinteldisplayigfxcuiprofilesCurrent
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x14000bdc8
cmp qword [rsp + 0x50], rdi
je 0x14000bdc8
lea rdx, str.Select_Profile
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], 3
call fcn.14001e3d0
mov rcx, qword [rsp + 0x50]
lea r9d, [rdi + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
lea rdx, str.CurrentPresetProfileType
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
lea esi, [rdi + 1]
lea rdx, str.CurrentPresetProfileName
xor r8d, r8d
add eax, esi
mov r9d, esi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp ebx, edi
jne 0x14000bdbd
cmp eax, edi
cmove edi, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14001e4a0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000d338
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rdi
sub rsp, 0x88
and qword [rax + 0x20], 0
and qword [rax - 0x60], 0
and dword [rax + 8], 0
and dword [rax + 0x18], 0
and qword [rax - 0x68], 0
xor edx, edx
mov dword [rax + 0x10], 4
lea rax, [rax - 0x68]
lea r8d, [rdx + 0x15]
lea r9, [0x14004f448]
lea rcx, [0x14004f4a8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea r8, [rsp + 0xb8]
lea rdx, str.SoftwareIntelDisplayigfxcui3D
mov rcx, 0xffffffff80000002
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareIntelDisplayigfxcui3D
mov rcx, 0xffffffff80000001
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test ebx, ebx
je 0x14000d3ca
test eax, eax
jne 0x14000d5b0
cmp qword [rsp + 0x30], 0
je 0x14000d5b0
test edi, edi
js 0x14000d5b0
mov edi, 0x40
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, rdi
call fcn.14001dda0
mov rcx, qword [rsp + 0xb8]
lea r11, [rsp + 0xa8]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0xb0]
lea rdx, str.Basic
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ebx, [rdi - 0x3f]
lea r9, [rsp + 0xb0]
test eax, eax
mov ecx, ebx
lea rax, [rsp + 0xa8]
cmove ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x58], ecx
mov rcx, qword [rsp + 0xb8]
lea rdx, str.VertexProcessing
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, ebx
lea r9, [rsp + 0xb0]
test eax, eax
lea rax, [rsp + 0xa8]
lea rdx, str.TextureQuality
cmove ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0xb8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0xb8]
test eax, eax
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0xb0]
cmove ebx, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
lea rdx, str.AnisotropicFiltering
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0xb0]
cmove ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0xb8]
lea rdx, str.VSync
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
lea r8, [rsp + 0x40]
test eax, eax
mov edx, edi
cmove ecx, dword [rsp + 0xa0]
mov dword [rsp + 0x78], ecx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d58d
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14000d5a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d5b0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x88
pop rdi
pop rbx
ret
Function at 0x14000d9a0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x140061550]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbp, rcx
xor ecx, ecx
mov r12, r8
mov rdi, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 0x5c
mov rcx, rdi
call fcn.14001f560
xor r13d, r13d
mov rsi, rax
cmp rax, r13
je 0x14000db99
mov rcx, rdi
call fcn.140021ec0
mov rcx, rsi
mov rbx, rax
call fcn.140021ec0
lea rcx, [rsp + 0x270]
sub rbx, rax
mov rdx, rdi
mov r8, rbx
call fcn.140021e10
mov rcx, rdi
call fcn.140021ec0
mov rcx, rsi
mov rbx, rax
call fcn.140021ec0
lea rdx, [0x140050068]
sub rbx, rax
lea rcx, [rsp + 0x270]
mov word [rsp + rbx*2 + 0x270], r13w
call fcn.14001e4c0
lea rdx, [rsp + 0x270]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, r13d
je 0x14000da77
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000db99
lea rax, [rsp + 0x40]
mov esi, 1
lea r9, [0x140052a60]
lea rcx, [0x140052a80]
xor edx, edx
mov r8d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r13d
mov ebx, eax
jl 0x14000dafd
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r13
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + LoadRegTypeLib]
mov ebx, eax
cmp eax, r13d
je 0x14000db04
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x14000dafd
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x14000db9e
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x160]
mov qword [rsp + 0x30], r13
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
cmp eax, r13d
jne 0x14000daf2
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x140052a70]
call qword [rax]
cmp eax, r13d
mov ebx, eax
jl 0x14000db89
mov rcx, qword [rsp + 0x48]
mov r8d, esi
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000dafd
mov eax, 0x80070057
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14001e4a0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret