joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001910
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x38
xor eax, eax
mov word [0x140039b40], ax
mov eax, dword [0x140039d70]
test al, 1
jne 0x14000193e
or eax, 1
mov dword [0x140039d70], eax
call fcn.140001c80
mov qword [0x140039d78], rax
jmp 0x140001945
mov rax, qword [0x140039d78]
mov qword [rsp + 0x28], rax
lea r9, [0x140039b40]
lea r8, str._LocalAppData_DynabookDSDDSDTabSysSvc.txt
lea rdx, [0x14002b9f8]
lea rcx, [0x14002ba30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [0x140039b40]
add rsp, 0x38
ret

Function at 0x140001980
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140039d48]
test al, 1
jne 0x1400019e3
or eax, 1
mov dword [0x140039d48], eax
mov eax, dword [0x140039d70]
test al, 1
jne 0x1400019b8
or eax, 1
mov dword [0x140039d70], eax
call fcn.140001c80
mov qword [0x140039d78], rax
jmp 0x1400019bf
mov rax, qword [0x140039d78]
lea rdx, str.Level
lea rcx, [0x14002ba30]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140039d4c], eax
jmp 0x1400019e9
mov ecx, dword [0x140039d4c]
test ecx, ecx
je 0x140001a15
dec ecx
je 0x140001a0b
dec ecx
je 0x140001a01
dec ecx
jne 0x140001a15
lea eax, [rcx + 3]
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001a20
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140039d50]
test al, 1
jne 0x140001a86
or eax, 1
mov dword [0x140039d50], eax
mov eax, dword [0x140039d70]
test al, 1
jne 0x140001a58
or eax, 1
mov dword [0x140039d70], eax
call fcn.140001c80
mov qword [0x140039d78], rax
jmp 0x140001a5f
mov rax, qword [0x140039d78]
lea rdx, str.Destination
lea rcx, [0x14002ba30]
mov r9, rax
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140039d54], eax
jmp 0x140001a8c
mov ecx, dword [0x140039d54]
test ecx, ecx
je 0x140001ac6
dec ecx
je 0x140001abc
dec ecx
je 0x140001ab2
dec ecx
je 0x140001aa8
dec ecx
jne 0x140001ab2
lea eax, [rcx + 4]
add rsp, 0x28
ret
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001ad0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140039d58]
test al, 1
jne 0x140001b33
or eax, 1
mov dword [0x140039d58], eax
mov eax, dword [0x140039d70]
test al, 1
jne 0x140001b08
or eax, 1
mov dword [0x140039d70], eax
call fcn.140001c80
mov qword [0x140039d78], rax
jmp 0x140001b0f
mov rax, qword [0x140039d78]
lea rdx, str.SourceFileFormat
lea rcx, [0x14002ba30]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140039d5c], eax
jmp 0x140001b39
mov ecx, dword [0x140039d5c]
test ecx, ecx
je 0x140001b4b
dec ecx
jne 0x140001b4b
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001b60
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140039d60]
test al, 1
jne 0x140001bc4
or eax, 1
mov dword [0x140039d60], eax
mov eax, dword [0x140039d70]
test al, 1
jne 0x140001b98
or eax, 1
mov dword [0x140039d70], eax
call fcn.140001c80
mov qword [0x140039d78], rax
jmp 0x140001b9f
mov rax, qword [0x140039d78]
lea rdx, str.TimeDateFormat
lea rcx, [0x14002ba30]
mov r9, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x140039d64], eax
jmp 0x140001bca
mov eax, dword [0x140039d64]
test eax, eax
je 0x140001bf8
dec eax
je 0x140001bee
dec eax
je 0x140001be4
dec eax
jne 0x140001bee
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001c00
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140039d68]
test al, 1
jne 0x140001c63
or eax, 1
mov dword [0x140039d68], eax
mov eax, dword [0x140039d70]
test al, 1
jne 0x140001c38
or eax, 1
mov dword [0x140039d70], eax
call fcn.140001c80
mov qword [0x140039d78], rax
jmp 0x140001c3f
mov rax, qword [0x140039d78]
lea rdx, str.Flush
lea rcx, [0x14002ba30]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140039d6c], eax
jmp 0x140001c69
mov ecx, dword [0x140039d6c]
test ecx, ecx
je 0x140001c78
dec ecx
jne 0x140001c78
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x1400040d0
Capabilities:
Create thread

Disassembly:
mov eax, 0x2048
call fcn.140019a60
sub rsp, rax
mov rax, qword [0x1400363c8]
xor rax, rsp
mov qword [rsp + 0x2030], rax
xor ecx, ecx
lea rax, [0x1400399c4]
mov qword [0x140039a10], r8
mov qword [rsp + 0x28], rax
lea r9, [0x140039960]
lea r8, [0x1400040c0]
xor edx, edx
mov dword [rsp + 0x20], ecx
mov qword [0x1400399b0], rcx
mov dword [0x140039a18], 1
mov dword [0x1400399ac], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400399c8], rax
test rax, rax
jne 0x14000416c
lea rdx, str.HCI_Server
lea rcx, [rsp + 0x30]
call fcn.140004420
xor eax, eax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140010f60
add rsp, 0x2048
ret
mov eax, 1
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140010f60
add rsp, 0x2048
ret
Function at 0x140006730
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push r14
sub rsp, 0x90
mov rbx, rcx
lea r8, str.CSARConfig::OpenTabletModeMonitor
lea rsi, str.SARConfig.cpp
lea rbp, str.__CSARConfig::OpenTabletModeMonitor_
lea r14, [0x14002b804]
lea rcx, [rax - 0x38]
lea rdx, str.ENTER__s
mov qword [rax - 0x40], r8
mov qword [rax - 0x38], rsi
mov qword [rax - 0x28], rbp
mov qword [rax - 0x20], r14
mov dword [rax - 0x30], 0x1c8
mov dword [rax - 0x18], 3
call fcn.1400012a0
lea r8, [0x1400047b0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x1400067f9
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_x
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x38], 0x1cc
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], eax
call fcn.1400012a0
jmp 0x1400067fb
xor ebx, ebx
mov r8, qword [rsp + 0x58]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x60]
call fcn.1400012a0
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret

Function at 0x140006830
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x50
lea rax, str.SARConfig.cpp
mov rbx, rcx
lea r8, str.CSARConfig::CloseTabletModeMonitor
mov qword [rsp + 0x28], rax
lea rax, str.__CSARConfig::CloseTabletModeMonitor_
lea rdx, str.ENTER__s
mov qword [rsp + 0x38], rax
lea rax, [0x14002b804]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x30], 0x1d5
mov dword [rsp + 0x48], 3
mov qword [rsp + 0x40], rax
call fcn.1400012a0
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1400068ad
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x58], 0
mov r8, qword [rsp + 0x20]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x28]
call fcn.1400012a0
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x140007fb0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov edi, 1
lea r8, str.TABSYSSVC_MUTEX_FLAG_9D750095_9C61_4FF4_ACF3_D5226E439618
xor ecx, ecx
mov edx, edi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1400390d8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.False
cmp eax, 0xb7
lea rax, str.TabSysWnd.cpp
lea r8, str.bRunning
mov qword [rsp + 0x20], rax
lea rax, str.__IsWindowRunning_
cmove ebx, edi
mov qword [rsp + 0x30], rax
lea rax, [0x14002b804]
test ebx, ebx
mov qword [rsp + 0x38], rax
lea rax, str.True
lea rdx, str._s___s
lea rcx, [rsp + 0x20]
cmovne r9, rax
mov dword [rsp + 0x28], 0xb9
mov dword [rsp + 0x40], 3
call fcn.1400012a0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140008060
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
lea rax, [rbp + 0x38]
mov edi, ecx
mov edx, ecx
mov ebx, 1
lea r9, [rbp + 0x40]
xor ecx, ecx
lea r8d, [rbx + 4]
mov qword [rbp + 0x40], 0
mov dword [rbp + 0x38], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
lea r14, str.TabSysWnd.cpp
lea r15, str.__IsSession0Connected_
lea r12, [0x14002b804]
test eax, eax
je 0x14000810e
mov rcx, qword [rbp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400080c6
test rax, rax
je 0x140008108
mov r8, rcx
lea rdx, str.WTSUserName_:__s
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], 0xcc
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r12
mov dword [rbp - 0x10], 3
call fcn.1400012a0
mov rcx, qword [rbp + 0x40]
xor ebx, ebx
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea r8, str.dwSessionID
lea rdx, str._s___d
lea rcx, [rbp - 0x30]
mov r9d, edi
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], 0xd2
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r12
mov dword [rbp - 0x10], 3
call fcn.1400012a0
lea rax, [0x14002e468]
test ebx, ebx
lea r8, [0x14002e470]
lea rdx, str.Session0_Connected_:__s
lea rcx, [rbp - 0x30]
cmovne r8, rax
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], 0xd3
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r12
mov dword [rbp - 0x10], 3
call fcn.1400012a0
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400084c0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1400363c8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea r8, str.CheckPreviousServiceStatus
lea r14, str.TOSTABSYSSVC.cpp
lea r15, str.__CheckPreviousServiceStatus_
lea r12, [0x14002b804]
lea rdx, str.ENTER__s
lea rcx, [rbp - 9]
mov qword [rbp - 0x11], r8
mov qword [rbp - 9], r14
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r12
mov dword [rbp - 1], 0x14a
mov dword [rbp + 0x17], 3
call fcn.1400012a0
xor eax, eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov dword [rbp + 0x37], eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140008594
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0x153
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400012a0
jmp 0x140008668
lea rdx, str.TOSTABSYSSVC
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0xc0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
lea rcx, [rbp - 0x39]
mov rdi, rax
test rax, rax
jne 0x1400085ea
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_x
mov dword [rbp - 0x31], 0x156
mov r8d, ebx
mov dword [rbp - 0x19], eax
call fcn.1400012a0
jmp 0x140008657
lea r8, str.TOSTABSYSSVC
lea rdx, str.The_service___s__exist
mov dword [rbp - 0x31], 0x157
mov dword [rbp - 0x19], 3
call fcn.1400012a0
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000864c
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0x159
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400012a0
jmp 0x14000864e
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xc0]
mov r8, qword [rbp - 0x11]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 9]
call fcn.1400012a0
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140010f60
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140009da0
Capabilities:
Create service
Persist via windows service

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400363c8]
xor rax, rsp
mov qword [rbp + 0x30], rax
lea r8, str.InstallService
mov qword [rsp + 0x78], r8
lea r15, str.TOSTABSYSSVC.cpp
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], 0x438
lea r12, str.__InstallService_
mov qword [rbp - 0x70], r12
lea r13, [0x14002b804]
mov qword [rbp - 0x68], r13
mov dword [rbp - 0x60], 3
lea rdx, str.ENTER__s
lea rcx, [rbp - 0x80]
call fcn.1400012a0
nop
call fcn.140004550
mov rdx, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140009e48
mov ecx, 0x80004005
call fcn.140004450
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
movups xmm0, xmmword [str.DSDTabletControlService]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x14002e5e0]
movups xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [0x14002e5f0]
movups xmmword [rbp + 0x20], xmm0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140009eca
mov edi, 0x80004003
mov qword [rbp - 0x58], r15
mov dword [rbp - 0x50], 0x441
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r13
mov dword [rbp - 0x38], r14d
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x58]
call fcn.1400012a0
mov rax, qword [rsp + 0x70]
jmp 0x140009f71
lea r9, [0x14002f8b8]
lea r8, [0x140039150]
lea rdx, str.__s_s_
lea rcx, [rsp + 0x70]
call fcn.1400070b0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
lea r8, [rbp]
lea rdx, str.DSDTabletControlService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140009f6e
mov edi, 0x80004003
mov qword [rbp - 0x30], r15
mov dword [rbp - 0x28], 0x448
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r13
mov dword [rbp - 0x10], r14d
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x30]
call fcn.1400012a0
jmp 0x140009f7f
mov edi, r14d
test rax, rax
je 0x140009f7f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x140009f8e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140009fa4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
nop
mov r8, qword [rsp + 0x78]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 0x80]
call fcn.1400012a0
mov eax, edi
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140010f60
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000a350
Capabilities:
Query service status
Start service

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0xb8
mov rax, qword [0x1400363c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], r14
lea r8, str.StartTheService
mov qword [r11 - 0x18], r15
lea rbp, str.TOSTABSYSSVC.cpp
mov qword [r11 - 0x78], rbp
mov qword [r11 - 0x80], r8
mov dword [rsp + 0x58], 0x4bc
lea r15, [0x14002b804]
lea r14, str.__StartTheService_
lea rdx, str.ENTER__s
mov qword [r11 - 0x68], r14
mov qword [r11 - 0x60], r15
lea rcx, [r11 - 0x78]
mov dword [rsp + 0x70], 3
call fcn.1400012a0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000a41d
mov esi, 0x80004003
lea rdx, str.Error_Code:_0x_x
lea rcx, [rsp + 0x20]
mov r8d, esi
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x28], 0x4c3
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], eax
call fcn.1400012a0
mov rbx, qword [rsp + 0x78]
jmp 0x14000a49c
lea rdx, str.DSDTabletControlService
mov r8d, 0xf003f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000a471
mov esi, 0x80004003
lea rdx, str.Error_Code:_0x_x
lea rcx, [rsp + 0x20]
mov r8d, esi
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x28], 0x4c6
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], eax
call fcn.1400012a0
jmp 0x14000a4aa
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x84], 1
jne 0x14000a49a
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xor esi, esi
test rbx, rbx
je 0x14000a4aa
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
test rdi, rdi
je 0x14000a4d8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8, qword [rsp + 0x48]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x50]
call fcn.1400012a0
mov eax, esi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140010f60
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x14000b9b0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xb0
mov ebx, ecx
lea r8, str.TSSRegWrite_Convertible
lea rdi, str.TOSTABSYSSVC.cpp
lea rsi, str.__TSSRegWrite_Convertible_
lea rbp, [0x14002b804]
lea rcx, [rax - 0x48]
lea rdx, str.ENTER__s
mov qword [rax - 0x50], r8
mov qword [rax - 0x48], rdi
mov qword [rax - 0x38], rsi
mov qword [rax - 0x30], rbp
mov dword [rax - 0x40], 0x66f
mov dword [rax - 0x28], 3
call fcn.1400012a0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xe0]
mov dword [rsp + 0xd8], ebx
mov qword [rsp + 0x38], rax
xor ebx, ebx
lea rdx, str.SOFTWAREDynabookDynabook_System_DriverDynabook_Tablet_System_Service
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000ba95
mov dword [rsp + 0x70], ebx
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_x
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], 0x680
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbp
call fcn.1400012a0
jmp 0x14000baf1
mov eax, dword [rsp + 0xd0]
dec eax
cmp eax, 1
ja 0x14000bad6
mov rcx, qword [rsp + 0xe0]
lea rax, [rsp + 0xd8]
lea rdx, str.Convertible
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14000baf1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xe0], rbx
mov r8, qword [rsp + 0x78]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x80]
call fcn.1400012a0
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000bb20
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
lea r8, str.TSSRegWrite_WorkAround
lea rdi, str.TOSTABSYSSVC.cpp
lea rsi, str.__TSSRegWrite_WorkAround_
lea r14, [0x14002b804]
lea rdx, str.ENTER__s
lea rcx, [rbp + 7]
mov qword [rbp - 1], r8
mov qword [rbp + 7], rdi
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], r14
mov dword [rbp + 0xf], 0x69e
mov dword [rbp + 0x27], 3
call fcn.1400012a0
xor ebx, ebx
lea rax, [rbp + 0x67]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x77]
lea rdx, str.SOFTWAREDynabookDynabook_System_DriverDynabook_Tablet_System_Service
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov qword [rbp + 0x77], rbx
mov dword [rbp + 0x6f], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000bbfb
mov dword [rbp - 9], ebx
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x29]
mov r8d, ebx
mov qword [rbp - 0x29], rdi
mov dword [rbp - 0x21], 0x6ae
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], r14
call fcn.1400012a0
jmp 0x14000bc3f
cmp dword [rbp + 0x67], 1
jne 0x14000bc2c
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x6f]
lea rdx, str.NoWorkaround
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000bc3f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x77], rbx
mov r8, qword [rbp - 1]
lea rdx, str.LEAVE__s
lea rcx, [rbp + 7]
call fcn.1400012a0
mov eax, ebx
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000bc70
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
lea r8, str.TSSRegWrite_PIDVID
lea rdi, str.TOSTABSYSSVC.cpp
lea rsi, str.__TSSRegWrite_PIDVID_
lea r14, [0x14002b804]
lea rdx, str.ENTER__s
lea rcx, [rbp + 7]
mov qword [rbp - 1], r8
mov qword [rbp + 7], rdi
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], r14
mov dword [rbp + 0xf], 0x6cd
mov dword [rbp + 0x27], 3
call fcn.1400012a0
xor ebx, ebx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x77]
lea rdx, str.SOFTWAREDynabookDynabook_System_DriverDynabook_Tablet_System_Service
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0x77], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000bd47
mov dword [rbp - 9], ebx
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x29]
mov r8d, ebx
mov qword [rbp - 0x29], rdi
mov dword [rbp - 0x21], 0x6dc
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], r14
call fcn.1400012a0
jmp 0x14000bd8b
cmp dword [rbp + 0x6f], 1
jne 0x14000bd78
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x67]
lea rdx, str.KeyboardPidVid
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000bd8b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x77], rbx
mov r8, qword [rbp - 1]
lea rdx, str.LEAVE__s
lea rcx, [rbp + 7]
call fcn.1400012a0
mov eax, ebx
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret