joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e710
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14000e710
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov dword [rsp + 0x70], 4
xor ebx, ebx
lea rcx, str.Enter_GetIntelligentCoolingGetCurrentSettingsStatusFromReg___n
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x68], ebx
call fcn.140003224
cmp dword [0x1400d4158], ebx
jne 0x14000e755
lea rcx, str.GetIntelligentCoolingGetCurrentSettingsStatusFromReg___does_not_support_n
call fcn.140003224
jmp 0x14000e7f6
test rdi, rdi
jne 0x14000e76b
lea rcx, str.GetIntelligentCoolingGetCurrentSettingsStatusFromReg__:_pdwCurrentSetting_is_NULL_n
call fcn.140003224
jmp 0x14000e7f6
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000e7bc
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x14000e7f6
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.CurrentSetting
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rdi]
lea rcx, str.SetIntelligentCoolingCurrentStatus__:_0x_08x____n
call fcn.140003224
mov ebx, 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000e806
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.GetIntelligentCoolingCurrentStatus___n
call fcn.140003224
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14000ed60
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14000ed60
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
mov dword [rax + 0x18], 4
xor ebx, ebx
mov dword [rax + 0x10], 0x14
lea rcx, str.Enter_IntelligentCoolingCreateInitTimeFromReg___n
mov qword [rax - 0x18], rbx
mov dword [rax + 0x20], ebx
call fcn.140003224
cmp dword [0x1400d4158], ebx
jne 0x14000edab
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___does_not_support_system_n
call fcn.140003224
jmp 0x14000eea4
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000ee02
lea rcx, str.Error_IntelligentCoolingCreateInitTimeFromReg_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x14000eea4
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.INIT
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ee47
mov edx, dword [rsp + 0x78]
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___already_have_than_read_the_value_read_value:__x_n
call fcn.140003224
jmp 0x14000ee99
mov eax, dword [rsp + 0x80]
lea rdx, str.INIT
mov rcx, qword [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000ee8d
mov edx, dword [rsp + 0x78]
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___Set_Key_value_read_value:__x_n
call fcn.140003224
jmp 0x14000ee99
lea rcx, str.Error_IntelligentCoolingCreateInitTimeFromReg___Connot_set_value:_n
call fcn.140003224
mov eax, dword [rsp + 0x78]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000eeb4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingCreateInitTimeFromReg___n
call fcn.140003224
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14000ef30
Capabilities:
Create thread

Disassembly:
jmp 0x14000ef30
push rbx
sub rsp, 0x30
xor ebx, ebx
lea rcx, str.Enter_IntelligentCoolingCreateInitilizeWorkerThread___n
mov dword [rsp + 0x40], ebx
call fcn.140003224
cmp qword [0x1400d4248], rbx
je 0x14000ef64
mov rdx, qword [0x1400d4210]
lea rcx, str.Error_IntelligentCoolingCreateWorkerThread_aready_have_0x_08x___n
call fcn.140003224
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400d4250], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400d4258], rax
xor r9d, r9d
lea r8, [0x140002851]
xor edx, edx
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [rsp + 0x40]
lea rcx, str.IntelligentCoolingCreateWorkerThread___dwThreadId_0x_08x___n
mov qword [0x1400d4248], rax
call fcn.140003224
mov rcx, qword [0x1400d4250]
test rcx, rcx
je 0x14000efe1
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [0x1400d4248], rbx
jne 0x14000eff8
lea rcx, str.Error_IntelligentCoolingCreateWorkerThread_create_thread_error._n
call fcn.140003224
jmp 0x14000effd
mov ebx, 1
lea rcx, str.Exit_IntelligentCoolingCreateInitilizeWorkerThread___n
call fcn.140003224
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14000f050
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14000f050
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
xor ebx, ebx
mov dword [rax + 0x18], 4
mov rdi, rcx
mov qword [rax - 0x18], rbx
lea rcx, str.Enter_SetIntelligentCoolingCreateSpcialCoolingTimeReg___n
mov dword [rax + 0x20], ebx
mov dword [rax + 0x10], ebx
call fcn.140003224
cmp dword [0x1400d4158], ebx
jne 0x14000f097
lea rcx, str.SetIntelligentCoolingCreateSpcialCoolingTimeReg___does_not_support_system_n
call fcn.140003224
jmp 0x14000f190
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000f0ee
lea rcx, str.Error_SetIntelligentCoolingCreateSpcialCoolingTimeReg_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x14000f190
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.SPCT
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000f133
mov edx, dword [rsp + 0x78]
lea rcx, str.SetIntelligentCoolingCreateSpcialCoolingTimeReg___already_have_than_read_the_value_read_value:__x_n
call fcn.140003224
jmp 0x14000f185
mov eax, dword [rsp + 0x80]
lea rdx, str.SPCT
mov rcx, qword [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000f179
mov edx, dword [rsp + 0x78]
lea rcx, str.SetIntelligentCoolingCreateSpcialCoolingTimeReg___Set_Key_value_read_value:__x_n
call fcn.140003224
jmp 0x14000f185
lea rcx, str.Error_SetIntelligentCoolingCreateSpcialCoolingTimeReg___Connot_set_value:_n
call fcn.140003224
mov eax, dword [rsp + 0x78]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000f1a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_SetIntelligentCoolingCreateSpcialCoolingTimeReg___n
call fcn.140003224
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14000f220
Capabilities:
Create thread

Disassembly:
jmp 0x14000f220
push rbx
sub rsp, 0x30
mov rdx, qword [0x1400d4210]
xor ebx, ebx
test rdx, rdx
je 0x14000f240
lea rcx, str.Error_IntelligentCoolingCreateWorkerThread_aready_have_0x_08x___n
call fcn.140003224
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400d4218], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400d4220], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400d4228], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400d4230], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400d4238], rax
xor r9d, r9d
lea r8, [0x140002e3c]
xor edx, edx
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [rsp + 0x40]
lea rcx, str.IntelligentCoolingCreateWorkerThread___dwThreadId_0x_08x___n
mov qword [0x1400d4210], rax
call fcn.140003224
mov rcx, qword [0x1400d4218]
test rcx, rcx
je 0x14000f308
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [0x1400d4210], rbx
jne 0x14000f31f
lea rcx, str.Error_IntelligentCoolingCreateWorkerThread_create_thread_error._n
call fcn.140003224
jmp 0x14000f324
mov ebx, 1
lea rcx, str.Exit_SetIntelligentCoolingCreateWorkerThread___n
call fcn.140003224
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1400143e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x1400143e0
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x50
xor ebx, ebx
lea rcx, str.Enter_SetIntelligentCoolingCurrentStatus___n
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x68], ebx
call fcn.140003224
cmp dword [0x1400d4158], ebx
jne 0x140014419
lea rcx, str.GetIntelligentCoolingCurrentStatus___does_not_support_n
call fcn.140003224
jmp 0x1400144dc
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001446a
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x1400144dc
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400144a9
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegSetValueEx_error____n
call fcn.140003224
jmp 0x1400144dc
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400144c9
cmp eax, 1
jne 0x1400144dc
lea rcx, str.SetIntelligentCoolingSetCurrentStatusToReg___Mode_Enable_n
call fcn.140003224
call fcn.140001f82
jmp 0x1400144da
lea rcx, str.SetIntelligentCoolingSetCurrentStatusToReg___Set_System_settings_Nominal_n
call fcn.140003224
call fcn.1400020bd
mov ebx, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400144ec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.SetIntelligentCoolingCurrentStatus___n
call fcn.140003224
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x1400183a0
Capabilities:
Get common file path

Disassembly:
jmp 0x1400183a0
push rbx
sub rsp, 0x250
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140002eeb
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8025
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400183f5
xor al, al
jmp 0x14001842b
lea rax, str.IBMPMDRV.INF
mov edx, 0x104
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str._ls_ls
mov rcx, rbx
call fcn.14000441c
mov rdx, rbx
lea rcx, str.GetINFPath:__ls
call fcn.140003224
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x250
pop rbx
ret

Function at 0x1400186d0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1400186d0
sub rsp, 0x38
lea rcx, str.ENTER_GetPMDRVInstallStatus__
call fcn.140003224
lea rax, [rsp + 0x50]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVC
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018747
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, str.Owners
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001874e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret
mov rax, qword gs:[0x58]
mov ecx, dword [0x1400d4bc0]
mov edx, 0x104
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1400d446c], eax
jg 0x1400187dd
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
mov rax, qword [0x1400d4460]
lea rdx, str.Owners
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x140018741
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1400d4460]
call fcn.140003b98
lea rcx, str.EXIT_GetPMDRVInstallStatus__
movzx ebx, al
call fcn.140003224
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rcx, [0x1400d446c]
call fcn.14000380f
cmp dword [0x1400d446c], 0xffffffff
jne 0x140018771
movzx ecx, byte [rsp + 0x40]
call fcn.140003710
lea rcx, [0x1400d446c]
mov qword [0x1400d4460], rax
call fcn.140002ec3
jmp 0x140018771
Function at 0x140018870
Capabilities:
Get common file path

Disassembly:
jmp 0x140018870
push rbx
sub rsp, 0x250
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, str.ENTER_GetRunDLLPath__
call fcn.140003224
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140002eeb
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8025
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400188d1
xor al, al
jmp 0x140018907
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, str._ls_rundll32.exe
mov rcx, rbx
call fcn.14000441c
mov rdx, rbx
lea rcx, str.GetRunDLLPath:__ls
call fcn.140003224
lea rcx, str.EXIT_GetRunDLLPath__
call fcn.140003224
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x250
pop rbx
ret

Function at 0x140018a20
Capabilities:
Check if file exists
Get common file path

Disassembly:
jmp 0x140018a20
push rbx
sub rsp, 0x460
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
lea rcx, str.ENTER_IsINFFileExits__
call fcn.140003224
cmp word [rbx], 0
je 0x140018b0c
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140002eeb
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8024
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140018b33
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.140002eeb
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
lea r8, str._lsINF_ls
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.14000441c
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140018b33
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140018af0
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x140018a60
lea rcx, str.EXIT_IsINFFileExists__
call fcn.140003224
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x460
pop rbx
ret
mov al, 1
jmp 0x140018b1a
Function at 0x140018d30
Capabilities:
Stop service

Disassembly:
jmp 0x140018d30
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rcx, str.Enter_StopPMService___n
call fcn.140003224
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140018dd3
mov r8d, 0xf003f
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140018dbc
lea r8, [rsp + 0x20]
mov rcx, rax
lea edx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test eax, eax
jne 0x140018dbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StopPMService___ControlService_failed:__d_n
call fcn.140003224
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140018dd3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Exit_StopPMService___n
call fcn.140003224
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140018ff0
Capabilities:
Create process on windows
Self delete

Disassembly:
jmp 0x140018ff0
sub rsp, 0x728
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x710], rax
lea rcx, str.ENTER_DeleteServiceFiles__
call fcn.140003224
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400191f3
mov qword [rsp + 0x720], rbx
xor r9d, r9d
xor ebx, ebx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
lea edx, [rbx - 1]
mov dword [rsp + 0x20], 4
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x1400191eb
lea rcx, [0x14008d388]
call fcn.140004886
lea rcx, str.LPLATSVC
call fcn.140004886
call fcn.140003e5e
call fcn.140017990
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmove rcx, rbx
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0xe0]
call fcn.140003e9f
test al, al
je 0x1400191c9
lea rcx, [rsp + 0xe0]
call fcn.140004435
test al, al
je 0x1400191c9
lea rcx, [rsp + 0x500]
call fcn.140004831
test al, al
je 0x1400191c9
xor edx, edx
lea r8d, [rbx + 0x64]
lea rcx, [rsp + 0x74]
call fcn.140002eeb
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x70], 0x68
lea r9, [rsp + 0x500]
mov qword [rsp + 0x20], rax
lea r8, str.__s__setupapi_InstallHinfSection_DefaultUninstall_128__s
mov edx, 0x104
lea rcx, [rsp + 0x2f0]
call fcn.140001f96
test eax, eax
js 0x1400191c9
lea rdx, [rsp + 0x2f0]
lea rcx, str.DeleteServiceFiles___CreateProceess:__s
call fcn.140003224
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x2f0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x500]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400191a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_Failed__d
call fcn.140003224
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400191b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400191c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400191d9
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.EXIT_DeleteServiceFiles__
call fcn.140003224
mov rbx, qword [rsp + 0x720]
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x728
ret
Function at 0x14001a350
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001a350
push rbx
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, r8
mov dword [rsp + 0x30], r9d
mov rdi, rdx
mov dword [rsp + 0x38], 0
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140002eeb
lea r9, str.IWTPAUTO.PMHELPER
mov qword [rsp + 0x20], rbx
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14000441c
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a414
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a414
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001a640
Capabilities:
Set registry value

Disassembly:
jmp 0x14001a640
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x288
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, r8
mov dword [rsp + 0x50], 0
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
mov ebp, r9d
call fcn.140002eeb
lea r9, str.IWTPAUTO.PMHELPER
mov qword [rsp + 0x20], rbx
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14000441c
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001a71c
mov rcx, qword [rsp + 0x58]
lea r9d, [rax + 3]
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001a71c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x288
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001ad90
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001ad90
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rsi
xor ebx, ebx
mov qword [rsp + 0x38], rdi
mov rsi, rcx
mov qword [rsp + 0x30], r14
lea rcx, str.Enter_IntelligentCoolingGetRegKeyDwordValue___n
mov r14, r8
mov qword [rsp + 0x68], rbx
mov rdi, rdx
mov dword [rsp + 0x60], 4
call fcn.140003224
test r14, r14
jne 0x14001addf
lea rcx, str.IntelligentCoolingGetRegKeyDwordValue__:_pdwValue_is_NULL_n
call fcn.140003224
jmp 0x14001ae9a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rbp
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
je 0x14001ae31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebp
lea rcx, str.Error_IntelligentCoolingGetRegKeyDwordValue_RegCreateKeyEx_error___d__d__n
mov r8d, eax
call fcn.140003224
mov ecx, 0xe1100002
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001ae95
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8, rdi
mov rdx, rsi
mov ebp, eax
test eax, eax
je 0x14001ae81
xor r9d, r9d
lea rcx, str.Error_IntelligentCoolingGetRegKeyDwordValue___already_have_the_key_but_open_fail:__s__s__Error_Code__d___n
call fcn.140003224
cmp ebp, 2
jne 0x14001ae95
mov ecx, 0xe1100003
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001ae95
mov r9d, dword [r14]
lea rcx, str.IntelligentCoolingGetRegKeyDwordValue___Read_the_value:__s__s:__x_n
call fcn.140003224
mov ebx, 1
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x14001aeb9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingGetRegKeyDwordValue___n
call fcn.140003224
mov eax, ebx
add rsp, 0x40
pop rbx
ret