joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a430
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14000a430
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
xor ebx, ebx
mov dword [rax + 0x18], 4
mov rdi, rcx
mov qword [rax - 0x18], rbx
lea rcx, str.Enter_SetIntelligentCoolingCreateSpcialCoolingTimeReg___n
mov dword [rax + 0x20], ebx
mov dword [rax + 0x10], ebx
call fcn.1400030c1
cmp dword [0x1400c22e0], ebx
jne 0x14000a477
lea rcx, str.SetIntelligentCoolingCreateSpcialCoolingTimeReg___does_not_support_system_n
call fcn.1400030c1
jmp 0x14000a570
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000a4ce
lea rcx, str.Error_SetIntelligentCoolingCreateSpcialCoolingTimeReg_RegCreateKeyEx_error____n
call fcn.1400030c1
jmp 0x14000a570
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.SPCT
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a513
mov edx, dword [rsp + 0x78]
lea rcx, str.SetIntelligentCoolingCreateSpcialCoolingTimeReg___already_have_than_read_the_value_read_value:__x_n
call fcn.1400030c1
jmp 0x14000a565
mov eax, dword [rsp + 0x80]
lea rdx, str.SPCT
mov rcx, qword [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000a559
mov edx, dword [rsp + 0x78]
lea rcx, str.SetIntelligentCoolingCreateSpcialCoolingTimeReg___Set_Key_value_read_value:__x_n
call fcn.1400030c1
jmp 0x14000a565
lea rcx, str.Error_SetIntelligentCoolingCreateSpcialCoolingTimeReg___Connot_set_value:_n
call fcn.1400030c1
mov eax, dword [rsp + 0x78]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000a580
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_SetIntelligentCoolingCreateSpcialCoolingTimeReg___n
call fcn.1400030c1
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14000a600
Capabilities:
Create thread

Disassembly:
jmp 0x14000a600
push rbx
sub rsp, 0x30
mov rdx, qword [0x1400c2388]
xor ebx, ebx
test rdx, rdx
je 0x14000a620
lea rcx, str.Error_IntelligentCoolingCreateWorkerThread_aready_have_0x_08x___n
call fcn.1400030c1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400c2390], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400c2398], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400c23a0], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400c23a8], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400c23b0], rax
xor r9d, r9d
lea r8, [0x140002cde]
xor edx, edx
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [rsp + 0x40]
lea rcx, str.IntelligentCoolingCreateWorkerThread___dwThreadId_0x_08x___n
mov qword [0x1400c2388], rax
call fcn.1400030c1
mov rcx, qword [0x1400c2390]
test rcx, rcx
je 0x14000a6e8
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [0x1400c2388], rbx
jne 0x14000a6ff
lea rcx, str.Error_IntelligentCoolingCreateWorkerThread_create_thread_error._n
call fcn.1400030c1
jmp 0x14000a704
mov ebx, 1
lea rcx, str.Exit_SetIntelligentCoolingCreateWorkerThread___n
call fcn.1400030c1
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14000f700
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x14000f700
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x50
xor ebx, ebx
lea rcx, str.Enter_SetIntelligentCoolingCurrentStatus___n
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x68], ebx
call fcn.1400030c1
cmp dword [0x1400c22e0], ebx
jne 0x14000f739
lea rcx, str.GetIntelligentCoolingCurrentStatus___does_not_support_n
call fcn.1400030c1
jmp 0x14000f7fc
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000f78a
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegCreateKeyEx_error____n
call fcn.1400030c1
jmp 0x14000f7fc
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000f7c9
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegSetValueEx_error____n
call fcn.1400030c1
jmp 0x14000f7fc
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000f7e9
cmp eax, 1
jne 0x14000f7fc
lea rcx, str.SetIntelligentCoolingSetCurrentStatusToReg___Mode_Enable_n
call fcn.1400030c1
call fcn.140001ec9
jmp 0x14000f7fa
lea rcx, str.SetIntelligentCoolingSetCurrentStatusToReg___Set_System_settings_Nominal_n
call fcn.1400030c1
call fcn.14000201d
mov ebx, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000f80c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.SetIntelligentCoolingCurrentStatus___n
call fcn.1400030c1
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x140010ed0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140010ed0
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rsi
xor ebx, ebx
mov qword [rsp + 0x38], rdi
mov rsi, rcx
mov qword [rsp + 0x30], r14
lea rcx, str.Enter_IntelligentCoolingGetRegKeyDwordValue___n
mov r14, r8
mov qword [rsp + 0x68], rbx
mov rdi, rdx
mov dword [rsp + 0x60], 4
call fcn.1400030c1
test r14, r14
jne 0x140010f1f
lea rcx, str.IntelligentCoolingGetRegKeyDwordValue__:_pdwValue_is_NULL_n
call fcn.1400030c1
jmp 0x140010fda
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rbp
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
je 0x140010f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebp
lea rcx, str.Error_IntelligentCoolingGetRegKeyDwordValue_RegCreateKeyEx_error___d__d__n
mov r8d, eax
call fcn.1400030c1
mov ecx, 0xe1100002
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140010fd5
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8, rdi
mov rdx, rsi
mov ebp, eax
test eax, eax
je 0x140010fc1
xor r9d, r9d
lea rcx, str.Error_IntelligentCoolingGetRegKeyDwordValue___already_have_the_key_but_open_fail:__s__s__Error_Code__d___n
call fcn.1400030c1
cmp ebp, 2
jne 0x140010fd5
mov ecx, 0xe1100003
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140010fd5
mov r9d, dword [r14]
lea rcx, str.IntelligentCoolingGetRegKeyDwordValue___Read_the_value:__s__s:__x_n
call fcn.1400030c1
mov ebx, 1
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x140010ff9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingGetRegKeyDwordValue___n
call fcn.1400030c1
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x140011060
Capabilities:
Set registry value

Disassembly:
jmp 0x140011060
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], r8d
push rdi
sub rsp, 0x60
mov rsi, rcx
xor ebx, ebx
lea rcx, str.Enter_IntelligentCoolingSetRegKeyDwordValue___n
mov qword [rax - 0x18], rbx
mov dword [rax + 0x20], ebx
mov rdi, rdx
call fcn.1400030c1
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400110e1
mov edx, eax
lea rcx, str.Error_IntelligentCoolingSetRegKeyDwordValue_RegCreateKeyEx_error___d__n
call fcn.1400030c1
jmp 0x140011140
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140011121
mov edx, eax
lea rcx, str.Error_IntelligentCoolingSetRegKeyDwordValue_RegSetValueEx_error___d__n
call fcn.1400030c1
jmp 0x140011140
mov r9d, dword [rsp + 0x80]
lea rcx, str.IntelligentCoolingSetRegKeyDwordValue___Set_the_value:_s_s___x__n
mov r8, rdi
mov rdx, rsi
call fcn.1400030c1
mov ebx, 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140011150
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingSetRegKeyDwordValue___n
call fcn.1400030c1
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140012e60
Capabilities:
Read file on windows

Disassembly:
jmp 0x140012e60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_GetSystemDockingTransformation_n
call fcn.1400030c1
xor ebx, ebx
lea rcx, [0x14009b1d0]
mov edi, ebx
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], ebx
mov esi, ebx
call fcn.140002667
mov rbp, rax
test rax, rax
je 0x140012f3c
mov rdx, rax
lea rcx, str.GetSystemDockingTransformation:_DevicePath____ws__n
call fcn.1400030c1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140012ef3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_CreateFile_Error__08d__n
jmp 0x140012f49
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x140012f26
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_ReadFile_Error__08d__n
jmp 0x140012f49
movzx edx, byte [rsp + 0x68]
lea rcx, str.GetSystemDockingTransformation:_ReadFile_0x_08x__n
mov dword [r14], edx
mov esi, 1
jmp 0x140012f4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_GetDevicePath_Error__08d__n
mov ebx, eax
mov edx, eax
call fcn.1400030c1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140012f68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_GetSystemDockingTransformation:_Status__08d__n
call fcn.1400030c1
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140013120
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013120
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_GetSystemTransformation_n
call fcn.1400030c1
xor ebx, ebx
lea rcx, [0x14009b1b8]
mov edi, ebx
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], ebx
mov esi, ebx
call fcn.140002667
mov rbp, rax
test rax, rax
je 0x1400131fc
mov rdx, rax
lea rcx, str.GetSystemTransformation:_DevicePath____ws__n
call fcn.1400030c1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400131b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_CreateFile_Error__08d__n
jmp 0x140013209
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x1400131e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_ReadFile_Error__08d__n
jmp 0x140013209
movzx edx, byte [rsp + 0x68]
lea rcx, str.GetSystemTransformation:_ReadFile_0x_08x__n
mov dword [r14], edx
mov esi, 1
jmp 0x14001320d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_GetDevicePath_Error__08d__n
mov ebx, eax
mov edx, eax
call fcn.1400030c1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140013228
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_GetSystemTransformation:_Status__08d__n
call fcn.1400030c1
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400135e0
Capabilities:
Create thread
Terminate thread

Disassembly:
jmp 0x1400135e0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov esi, r8d
mov r9d, r8d
mov r8d, edx
mov ebx, edx
mov edx, ecx
mov edi, ecx
lea rcx, str.bWakeup___x__bDisconnect___x__ulstate___x
call fcn.1400030c1
mov rcx, qword [0x1400c2540]
xor ebp, ebp
mov dword [rsp + 0x50], ebp
test rcx, rcx
je 0x140013638
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [0x1400c2540]
test eax, eax
cmove rcx, rbp
mov qword [0x1400c2540], rcx
test edi, edi
je 0x140013679
lea rax, [rsp + 0x50]
mov dword [0x1400c2400], esi
mov qword [rsp + 0x28], rax
lea r9, [0x1400c2400]
lea r8, [0x140001910]
mov dword [rsp + 0x20], ebp
xor edx, edx
mov dword [0x1400c2404], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400c2540], rax
test ebx, ebx
je 0x1400136f3
lea rcx, str.bBusDisconnetEvent_is_true
call fcn.1400030c1
cmp dword [0x1400c2404], ebp
je 0x1400136ed
lea rcx, str.bWakeupEvent_is_true
call fcn.1400030c1
mov rcx, qword [0x1400c2540]
mov dword [0x1400c2404], ebp
test rcx, rcx
je 0x1400136b7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x1400c22e8], ebp
mov qword [0x1400c2540], rbp
je 0x1400136d1
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400c2400]
sub eax, 3
je 0x1400136e8
cmp eax, 1
jne 0x1400136ed
call fcn.140003689
jmp 0x1400136ed
call fcn.14000327e
mov dword [0x1400c2400], ebp
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400138f0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1400138f0
push rbx
sub rsp, 0x40
call fcn.140003e40
call fcn.140002cc5
test al, al
jne 0x1400139c5
xor ebx, ebx
mov dword [rsp + 0x68], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
mov dword [rsp + 0x58], ebx
xor r8d, r8d
mov dword [rsp + 0x60], ebx
lea rdx, str.SoftwareIBMIBMPM
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013993
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HibFileCreation
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x68], ebx
je 0x1400139bb
xor r9d, r9d
mov byte [rsp + 0x50], 1
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], ebx
lea r8d, [r9 + 1]
lea ecx, [r9 + 0xa]
call fcn.140001154
test eax, eax
je 0x1400139c5
add rsp, 0x40
pop rbx
jmp fcn.14000327e
call fcn.140003e40
xor edx, edx
xor ecx, ecx
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
Function at 0x140013a80
Capabilities:
Create thread

Disassembly:
jmp 0x140013a80
sub rsp, 0x38
xor ecx, ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x1400021da]
xor r9d, r9d
mov dword [rsp + 0x20], ecx
xor edx, edx
mov dword [rsp + 0x40], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400c24d0], rax
add rsp, 0x38
ret
Function at 0x140014680
Capabilities:
Create thread

Disassembly:
jmp 0x140014680
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x140003f8a]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov dword [rsp + 0x40], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400c2428], rax
test rax, rax
jne 0x1400146d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_Initialize_PH_Thread__:_Fail_to_create_PHThread.___d__n
call fcn.1400030c1
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400029ff]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400c2430], rax
test rax, rax
jne 0x140014724
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_Initialize_PH_Thread__:_Fail_to_create_hPHOverrideThread.___d__n
call fcn.1400030c1
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1400150c0
Capabilities:
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
jmp 0x1400150c0
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xb50]
sub rsp, 0xc50
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rbp + 0xb40], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140002da1
movups xmm0, xmmword [str.SOFTWAREMicrosoft_]
xor edx, edx
mov r8d, 0x7d8
movups xmm1, xmmword [0x14009e158]
lea rcx, [rbp + 0x368]
movaps xmmword [rbp + 0x340], xmm0
movsd xmm0, qword [0x14009e168]
movsd qword [rbp + 0x360], xmm0
movaps xmmword [rbp + 0x350], xmm1
call fcn.140002da1
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x200
call fcn.140002da1
xor eax, eax
mov dword [rsp + 0x30], 0x100
lea rdx, str.Windows_NTCurrentVersionProfileList_
mov dword [rsp + 0x34], eax
lea rcx, [rbp + 0x340]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x340]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001528c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.ProfileImagePath
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001528c
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.140002da1
mov r8d, 0x100
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14001528c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14001524c
lea rdx, str._ntuser.dat
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14001528c
lea edx, [rax + 1]
lea rcx, str.SeRestorePrivilege
call fcn.140001131
test eax, eax
je 0x14001528c
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002905
test eax, eax
je 0x14001528c
mov eax, 1
jmp 0x14001528e
xor eax, eax
mov rcx, qword [rbp + 0xb40]
xor rcx, rsp
call fcn.140001e15
mov rbx, qword [rsp + 0xc68]
add rsp, 0xc50
pop rbp
ret
Function at 0x1400153a0
Capabilities:
Shutdown system

Disassembly:
jmp 0x1400153a0
sub rsp, 0x58
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140015437
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14001545a
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14001544b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001e15
add rsp, 0x58
ret
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14001542c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001e15
add rsp, 0x58
ret

Function at 0x1400154c0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x1400154c0
cmp ecx, 1
jb 0x1400155b7
push rbx
sub rsp, 0x30
xor eax, eax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Notification
mov qword [rsp + 0x58], rax
mov ebx, ecx
mov dword [rsp + 0x40], eax
mov r9d, 0xf003f
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400155b2
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type22
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400155a7
lea ecx, [rbx - 1]
mov eax, 1
shl eax, cl
mov ecx, dword [rsp + 0x40]
test ecx, eax
je 0x140015564
not eax
and eax, ecx
jmp 0x140015566
or eax, ecx
mov rcx, qword [rsp + 0x58]
lea rdx, str.Type22
mov dword [rsp + 0x40], eax
mov r9d, 4
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x140015600
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140015600
cmp ecx, 1
jb 0x1400156f7
push rbx
sub rsp, 0x30
xor eax, eax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov qword [rsp + 0x58], rax
mov ebx, ecx
mov dword [rsp + 0x40], eax
mov r9d, 0xf003f
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400156f2
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type2
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400156e7
lea ecx, [rbx - 1]
mov eax, 1
shl eax, cl
mov ecx, dword [rsp + 0x40]
test ecx, eax
je 0x1400156a4
not eax
and eax, ecx
jmp 0x1400156a6
or eax, ecx
mov rcx, qword [rsp + 0x58]
lea rdx, str.Type2
mov dword [rsp + 0x40], eax
mov r9d, 4
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret