joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038e7c
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x1400dbf70], 0
jne 0x140038eac
lea rcx, str.HandleDevChangedNotification:_no_bt_device_n
call fcn.1400300fc
jmp 0x14003903d
lea rcx, [0x1400db7d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 0x1d4c0
mov ecx, 0x3e8
mov edx, edi
call fcn.1400365bc
call fcn.140037b4c
test eax, eax
jne 0x140038ee4
lea rcx, str.HandleDevChangedNotification:_isDongleAttached_returns_FALSE_n
call fcn.1400300fc
jmp 0x140039030
call fcn.14005010c
test eax, eax
je 0x140038f00
call fcn.140037f0c
mov edx, edi
mov ecx, 0x3e8
call fcn.1400365bc
jmp 0x140038f0c
lea rcx, str.HandleDevChangedNotification:_BT_is_not_under_IT_policy_n
call fcn.1400300fc
call fcn.140030b3c
test eax, eax
je 0x140038f26
lea rcx, str.HandleDevChangedNotification:_BTW_is_not_installed_yet_n
call fcn.1400300fc
jmp 0x140039024
lea rax, [rsp + 0x30]
lea r8, [0x140093c2f]
lea rdx, str.SoftwareWIDCOMMInstallTurnedOffDevs
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x14003900a
cmp eax, 2
je 0x140038f80
lea rcx, str._HandleDevChangedNotification:_SHGetValue_failed._err_d_n
mov edx, eax
call fcn.1400300fc
jmp 0x140039016
lea rcx, str.HandleDevChangedNotification:_dongle_attached_first_time_n
call fcn.1400300fc
lea rcx, str.BTWPP_ArePdosPresent
call fcn.14003786c
test eax, eax
jne 0x140038fb6
lea rcx, str.HandleDevChangedNotification:_Update_drivers_for_PDOs._n
call fcn.1400300fc
lea rcx, str.BTWPP_UpdatePdoDrivers
call fcn.14003786c
jmp 0x140038fc7
lea rcx, str.HandleDevChangedNotification:_install_PDOs_n
call fcn.1400300fc
call fcn.1400375bc
mov edx, edi
mov ecx, 0x1388
call fcn.1400365bc
call fcn.140037b2c
mov edx, edi
mov ecx, 0x3e8
call fcn.1400365bc
lea rcx, str.BTWPP_DiscoveryAllPairedDevices
call fcn.14003786c
lea rcx, str.BTWPP_EnableAllServicesOfPairedDevices
call fcn.14003786c
mov edx, edi
mov ecx, 0x3e8
call fcn.1400365bc
jmp 0x140039016
lea rcx, str.HandleDevChangedNotification:_dongle_initialized_already_n
call fcn.1400300fc
lea rcx, str.BTWPP_SetupAllMyCompItems
xor edx, edx
call fcn.14003770c
lea rcx, [0x1400dbeb9]
call fcn.140045e84
lea rcx, [0x1400db7d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005ba20
add rsp, 0x50
pop rdi
ret
Function at 0x140039fb0
Capabilities:
Create service
Modify service
Persist via windows service
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push rbp
lea rbp, [rax - 0x618]
sub rsp, 0x710
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rbp + 0x600], rax
xor ebx, ebx
mov rdi, rcx
lea r12d, [rbx + 1]
mov rcx, rdi
call fcn.14002f1cc
test eax, eax
je 0x14003a007
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r12d
cmp ebx, 5
jl 0x140039fe8
cmp ebx, 5
je 0x14003a1d4
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor ecx, ecx
mov rbx, rax
test rax, rax
jne 0x14003a048
xor r9d, r9d
lea rdx, str.Couldnt_open_service_manager
lea r8, [0x1400db800]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14003a1d7
mov edi, 0x104
lea rdx, [rbp + 0x1e0]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rbp + 0x1e0]
lea r8, str.__s_
lea rcx, [rbp - 0x30]
mov edx, edi
call fcn.14005ce1c
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x30]
lea r8, str.Bluetooth_Service
lea rdx, [0x1400db800]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov r9d, 0xf01ff
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], socket
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14003a0f1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r9d, r9d
xor ecx, ecx
lea rdx, str.Couldnt_create_service
jmp 0x14003a034
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareWidcommBtConfigGeneral
mov r9d, r12d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003a179
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
lea rdx, str.BTWDINSDescription
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3f0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003a16e
lea rax, [rbp + 0x3f0]
lea r8, [rbp - 0x80]
mov edx, r12d
mov rcx, rdi
mov qword [rbp - 0x80], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [rbp - 0x40], 0
and dword [rbp - 0x78], 0
and qword [rbp - 0x70], 0
and qword [rbp - 0x68], 0
mov eax, 0xea60
lea r8, [rbp - 0x78]
mov dword [rbp - 0x4c], eax
mov dword [rbp - 0x44], eax
mov dword [rbp - 0x3c], eax
lea rax, [rbp - 0x50]
mov edx, 2
mov rcx, rdi
mov dword [rbp - 0x50], r12d
mov dword [rbp - 0x48], r12d
mov dword [rbp - 0x60], 3
mov qword [rbp - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, r12d
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.14005ba20
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14003a200
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.14002f1cc
test eax, eax
jne 0x14003a231
mov eax, 1
jmp 0x14003a2d5
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14003a252
lea rdx, str.Couldnt_open_service_manager
jmp 0x14003a2c1
lea rdx, [0x1400db800]
mov r8d, 0x10020
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14003a282
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, str.Couldnt_open_service
jmp 0x14003a2c1
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x14003a227
lea rdx, str.Service_could_not_be_deleted
lea r8, [0x1400db800]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005ba20
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14003a3ac
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14003a40f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003a423
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003a423
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14003a428
cmp dword [rcx + 8], 0
je 0x14003a423
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14003a428
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14003a540
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14003a566
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14003a3ac
jmp 0x14003a5cd
cmp byte [0x1400dbfe0], 0
jne 0x14003a5aa
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003a59a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400dbfd8], rax
jmp 0x14003a5a1
mov rax, qword [0x1400dbfd8]
mov byte [0x1400dbfe0], 1
jmp 0x14003a5b1
mov rax, qword [0x1400dbfd8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14003a5c7
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14003a5cd
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c038
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x14003c066
lea eax, [rdi + 0xd]
jmp 0x14003c09d
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x14003c069
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14003f4a8
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
xor ecx, ecx
mov r12d, r8d
mov r13d, edx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x14003f655
mov rcx, rsi
call fcn.14003a200
mov r11, qword [rsi]
xor r9d, r9d
lea edx, [r9 + 0x64]
lea r8d, [r9 + 1]
mov rcx, rsi
call qword [r11 + 0x40]
and qword [rbp - 0x30], 0
and dword [rbp - 0x28], 0
and qword [rbp - 0x20], 0
mov edi, 0x20006
lea r8, str.AppID
lea rcx, [rbp - 0x30]
mov r9d, edi
mov rdx, 0xffffffff80000000
call fcn.14003a60c
mov ebx, eax
test eax, eax
je 0x14003f542
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14003f53b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14003f655
mov rbx, qword [rbp - 0x30]
and qword [rbp - 0x18], 0
and dword [rbp - 0x10], 0
and qword [rbp - 8], 0
lea r8, str.F6B856DA_AB94_4355_A42F_EC493BEA79DE
lea rcx, [rbp - 0x18]
mov rdx, rbx
mov r9d, edi
call fcn.14003a60c
mov edi, eax
test eax, eax
je 0x14003f594
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14003f57f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14003f58d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x14003f655
mov rdi, qword [rbp - 0x18]
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test r12d, r12d
je 0x14003f621
lea r12, str.btwdins
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.LocalService
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r12, str._Service
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.ServiceParameters
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call fcn.140039fb0
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
call fcn.14003f2c0
mov esi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
test rdi, rdi
je 0x14003f645
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14003f653
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x14003f6bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14003f730
call fcn.14002efd8
mov ebx, eax
jmp 0x14003f83f
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x14003f751
call fcn.14002efd8
jmp 0x14003f833
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14003f747
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x14003f78c
mov ebx, 0x8007000e
jmp 0x14003f835
mov ecx, eax
test eax, eax
je 0x14003f7c9
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14003f7bf
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14003f7c9
lea rcx, [rsp + 0x70]
call fcn.14003c920
mov rax, qword [rsp + 0x70]
jmp 0x14003f7d3
mov ecx, 0x80070216
call fcn.14002ee18
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14003f7ea
test rax, rax
je 0x14003f782
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14003f747
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14003f160
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14003f856
lea rcx, [rsp + 0x70]
call fcn.14003c908
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14005ba20
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret

Function at 0x14004049c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, VarUI4FromDisp
call fcn.14005bab0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x1400404f5
cmp dword [rsp + 0x24], 5
mov eax, 1
ja 0x1400404f7
jne 0x1400404f5
cmp dword [rsp + 0x28], eax
jae 0x1400404f7
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005ba20
add rsp, 0x158
ret
Function at 0x140040bdc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x38], 0
cmp dword [0x1400dc068], 0
mov esi, edx
mov rbx, rcx
jne 0x140040c23
call fcn.140040b7c
mov dword [0x1400dc068], 1
mov dword [0x1400dc06c], eax
jmp 0x140040c29
mov eax, dword [0x1400dc06c]
test eax, eax
mov ecx, 0x103
mov r9d, 3
cmovne r9d, ecx
lea rax, [rbp - 0x38]
lea rdx, str.SOFTWAREMicrosoftDriver_Signing
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140040ca0
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x3c]
lea r9, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
lea rdx, str.Policy
xor r8d, r8d
mov dword [rbp - 0x3c], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140040ca0
mov eax, dword [rbp - 0x3c]
cmp eax, 1
jae 0x140040cba
mov edi, socket
mov ebx, dword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140040cb2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140040cf3
mov eax, ebx
jmp 0x140040cfe
movzx ebx, byte [rbp - 0x30]
test esi, esi
js 0x140040ca3
cmp esi, ebx
je 0x140040ca3
mov r9d, dword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x30]
lea rdx, str.Policy
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov byte [rbp - 0x30], sil
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x140040ca3
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14005ba20
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x140040d2c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test ecx, ecx
js 0x140040d45
movzx edx, cl
sar ecx, 8
movzx edi, cl
jmp 0x140040d4a
or edi, 0xffffffff
or edx, edi
mov rcx, 0xffffffff80000002
call fcn.140040bdc
mov ebx, eax
test eax, eax
jns 0x140040d61
or eax, 0xffffffff
jmp 0x140040d8b
mov edx, edi
mov rcx, 0xffffffff80000001
call fcn.140040bdc
test eax, eax
jns 0x140040d80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140040d5c
mov eax, ebx
movzx eax, al
movzx ecx, bl
shl eax, 8
or eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400413ac
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x14004121c]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x20], 0
je 0x140041428
cmp qword [rsp + 0x28], 0
je 0x140041428
lea rcx, str.Found_SP2_Not_Now_dialog_n
call fcn.1400300fc
mov rcx, qword [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf5
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf5
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
jmp 0x14004142a
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400414fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edi, r8d
mov rsi, rcx
mov r8d, r8d
mov edx, 5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14004157f
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140041570
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140041561
movsxd rcx, dword [rsp + 0x50]
lea rdx, [rax + rcx*2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [rsp + 0x40]
jmp 0x140041598
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LockResource__u_failed_0x_X._n
jmp 0x14004158c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadResource__u_failed_0x_X._n
jmp 0x14004158c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.FindResource__u_failed_0x_X._n
mov r8d, eax
mov edx, edi
mov ebx, eax
call fcn.1400300fc
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140041a8c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1400dbc48], 0
je 0x140041b48
lea rcx, str.Start_WaitAndKillNewDeviceFoundWizard_n
call fcn.1400300fc
and qword [rsp + 0x30], 0
xor edi, edi
call fcn.1400413ac
lea rdx, [rsp + 0x30]
lea rcx, [0x14004163c]
mov ebx, eax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140041b24
cmp edi, 0xbb8
jge 0x140041b16
test ebx, ebx
jne 0x140041aed
call fcn.1400413ac
mov ebx, eax
lea rdx, [rsp + 0x30]
lea rcx, [0x14004163c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x30]
inc edi
test rcx, rcx
je 0x140041ada
test rcx, rcx
jne 0x140041b24
lea rcx, str.Found_New_Hardware_Wizard_dialog_window_not_found_n
jmp 0x140041b43
call fcn.1400417bc
test eax, eax
je 0x140041b3c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rcx, str.End_WaitAndKillNewDeviceFoundWizard_n
call fcn.1400300fc
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004242c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rbp + 0x380], rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x1400dcd04]
xor ebx, ebx
test r8d, r8d
je 0x14004249e
cmp r8d, dword [rsp + 0x20]
jne 0x14004249e
lea rdx, str.g_dwIBMProcID_is_IBM__d_n
lea rcx, [rbp + 0x170]
call fcn.14002d41c
lea rcx, [rbp + 0x170]
call fcn.1400300fc
lea eax, [rbx + 1]
jmp 0x14004256e
mov r8d, dword [rsp + 0x20]
lea rdx, str.GetWindowThreadProcessId__d_n
lea rcx, [rbp + 0x170]
call fcn.14002d41c
lea rcx, [rbp + 0x170]
call fcn.1400300fc
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x234
mov rdi, rax
call fcn.14005bab0
mov dword [rsp + 0x30], 0x238
cmp rdi, 0xffffffffffffffff
je 0x14004256c
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140042563
mov r9d, dword [rsp + 0x38]
lea r8, [rsp + 0x5c]
lea rdx, str.Process_name__s__id__d_n
lea rcx, [rbp + 0x170]
call fcn.14002d41c
lea rcx, [rbp + 0x170]
call fcn.1400300fc
lea rdx, str.PkgMgr
lea rcx, [rsp + 0x5c]
call fcn.1400604d4
test rax, rax
je 0x140042549
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x38], eax
je 0x140042558
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
jmp 0x1400424fc
mov dword [0x1400dcd04], eax
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.14005ba20
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400429a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov r8d, 0x190
xor edx, edx
mov rbx, rcx
call fcn.14005bab0
lea r11, [rsp + 0x58]
lea rdx, str.SoftwareWidcommBTConfigBtwdins
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140042a22
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x50], 0x18e
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140042a30
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
and qword [r11 - 0x18], 0
lea rax, [r11 + 0x18]
mov rdi, rdx
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
mov rbx, rcx
lea rdx, str.SoftwareWidcommBTConfigBtwdins
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140042ab6
mov rcx, rbx
call fcn.14005d25c
mov r9d, 1
xor r8d, r8d
lea ecx, [rax + rax + 2]
mov rdx, rdi
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140043f70
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov rbx, rcx
jne 0x140043fab
lea rax, [rsp + 0x40]
movsxd r9, edx
lea r8, [0x140043f40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.14005b918
mov qword [rbx + 0x10], rax
add rsp, 0x30
pop rbx
ret