joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ca8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140074384
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r10d, r10d
lea r11, [0x1400c4698]
test r9, r9
lea rdi, [0x1400aacec]
mov rax, rdx
mov r15, rdx
cmovne r11, r9
test rdx, rdx
lea ebp, [r10 + 1]
cmovne rdi, rdx
mov r14d, ebp
cmovne r14, r8
neg rax
sbb rsi, rsi
and rsi, rcx
test r14, r14
jne 0x1400743ed
mov rax, 0xfffffffffffffffe
jmp 0x14007453b
cmp word [r11 + 6], r10w
jne 0x14007445c
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x140074417
test rsi, rsi
je 0x140074408
mov dword [rsi], r9d
test r9b, r9b
setne r10b
mov rax, r10
jmp 0x14007453b
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x140074425
mov r8b, 2
jmp 0x140074443
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x140074433
mov r8b, 3
jmp 0x140074443
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x140074529
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x140074485
mov r8b, byte [r11 + 4]
mov edx, dword [r11]
mov bl, byte [r11 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x140074529
cmp bl, bpl
jb 0x140074529
cmp bl, r8b
jae 0x140074529
movzx ebp, bl
cmp rbp, r14
mov r9d, ebp
cmovae r9, r14
jmp 0x1400744b2
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x140074529
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r15
cmp rax, r9
jb 0x140074494
cmp r9, rbp
jae 0x1400744de
movzx eax, r8b
sub bl, r9b
mov word [r11 + 4], ax
movzx eax, bl
mov word [r11 + 6], ax
mov dword [r11], edx
jmp 0x1400743e1
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x140074529
cmp edx, 0x110000
jae 0x140074529
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x140074529
test rsi, rsi
je 0x14007451c
mov dword [rsi], edx
neg edx
mov qword [r11], r10
sbb rax, rax
and rax, rbp
jmp 0x14007453b
mov qword [r11], r10
call fcn.140001f46
mov dword [rax], 0x2a
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001e15
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001da2
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14005c7c0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400ae830]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x1400ae828]
call fcn.14005bd60
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14005c800
call qword [0x1400ce010]
jmp 0x14005c806
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002275
Capabilities:
Set registry value

Disassembly:
jmp 0x140019a30
push rbx
sub rsp, 0x70
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rcx, str.Enter_UpdateTimeStampRegValue___n
call fcn.1400030c1
xorps xmm0, xmm0
xor eax, eax
mov rcx, rbx
mov word [rsp + 0x60], ax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.140001b6d
mov edx, 0x19
lea rcx, [rsp + 0x30]
call fcn.1400024ff
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x19
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ModeChangeTimeStamp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, str.Exit_UpdateTimeStampRegValue___n
mov ebx, eax
call fcn.1400030c1
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001e15
add rsp, 0x70
pop rbx
ret

Function at 0x1400023ce
Capabilities:
Read file on windows

Disassembly:
jmp 0x140012e60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_GetSystemDockingTransformation_n
call fcn.1400030c1
xor ebx, ebx
lea rcx, [0x14009b1d0]
mov edi, ebx
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], ebx
mov esi, ebx
call fcn.140002667
mov rbp, rax
test rax, rax
je 0x140012f3c
mov rdx, rax
lea rcx, str.GetSystemDockingTransformation:_DevicePath____ws__n
call fcn.1400030c1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140012ef3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_CreateFile_Error__08d__n
jmp 0x140012f49
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x140012f26
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_ReadFile_Error__08d__n
jmp 0x140012f49
movzx edx, byte [rsp + 0x68]
lea rcx, str.GetSystemDockingTransformation:_ReadFile_0x_08x__n
mov dword [r14], edx
mov esi, 1
jmp 0x140012f4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_GetDevicePath_Error__08d__n
mov ebx, eax
mov edx, eax
call fcn.1400030c1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140012f68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_GetSystemDockingTransformation:_Status__08d__n
call fcn.1400030c1
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140002595
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400621c4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x140062296
mov rsi, rax
cmp word [rax], r14w
je 0x140062217
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1400621ff
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x1400621fb
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140003c6a
movsxd rbp, eax
test eax, eax
je 0x140062296
mov rcx, rbp
call fcn.140002ed7
mov rdi, rax
test rax, rax
je 0x140062289
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140003c6a
test eax, eax
je 0x140062289
mov rsi, rdi
mov rdi, r14
jmp 0x14006228c
mov rsi, r14
mov rcx, rdi
call fcn.140002b0d
jmp 0x140062299
mov rsi, r14
test rbx, rbx
je 0x1400622a7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140002856
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140019540
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x50
xor ebx, ebx
lea rcx, str.Enter_SystemTransformationSetCurrentStatusToReg___n
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x68], ebx
call fcn.1400030c1
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400195b1
lea rcx, str.Error_SystemTransformationSetCurrentStatusToReg_RegCreateKeyEx_error____n
call fcn.1400030c1
jmp 0x140019607
mov rdx, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x60]
call fcn.140003760
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, [0x1400a78a8]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400195fe
lea rcx, str.Error_SystemTransformationSetCurrentStatusToReg_RegSetValueEx_error____n
call fcn.1400030c1
jmp 0x140019607
mov ecx, dword [rsp + 0x60]
call fcn.14000326a
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140019617
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.SystemTransformationSetCurrentStatusToReg___n
call fcn.1400030c1
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140002b26
Capabilities:
Write file on windows

Disassembly:
jmp 0x140017330
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_SetSystemTransformation_n
call fcn.1400030c1
lea rcx, [0x14009b1b8]
call fcn.140002667
xor ebx, ebx
mov rbp, rax
mov byte [rsp + 0x68], bl
mov edi, ebx
mov esi, ebx
test rax, rax
je 0x14001740e
mov rdx, rax
lea rcx, str.SetSystemTransformation_DevicePath____ws__n
call fcn.1400030c1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400173bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetSystemTransformation:_CreateFile_Error__08d__n
jmp 0x14001741b
movzx eax, byte [r14]
lea rdx, [rsp + 0x68]
xor r9d, r9d
mov byte [rsp + 0x68], al
mov rcx, rdi
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
jne 0x1400173f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Inside_SetSystemTransformation:_WriteFile_Error__08d__n
jmp 0x14001741b
movzx edx, byte [rsp + 0x68]
lea rcx, str.SetSystemTransformation:_WriteFile_0x_08x__n
call fcn.1400030c1
mov esi, 1
jmp 0x140017424
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetSystemTransformation:_GetDevicePath_Error__08d__n
mov edx, eax
mov ebx, eax
call fcn.1400030c1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14001743a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_SetSystemTransformation:_Status__08d__n
call fcn.1400030c1
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140002c2f
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x1400154c0
cmp ecx, 1
jb 0x1400155b7
push rbx
sub rsp, 0x30
xor eax, eax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Notification
mov qword [rsp + 0x58], rax
mov ebx, ecx
mov dword [rsp + 0x40], eax
mov r9d, 0xf003f
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400155b2
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type22
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400155a7
lea ecx, [rbx - 1]
mov eax, 1
shl eax, cl
mov ecx, dword [rsp + 0x40]
test ecx, eax
je 0x140015564
not eax
and eax, ecx
jmp 0x140015566
or eax, ecx
mov rcx, qword [rsp + 0x58]
lea rdx, str.Type22
mov dword [rsp + 0x40], eax
mov r9d, 4
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x140002ce8
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140015600
cmp ecx, 1
jb 0x1400156f7
push rbx
sub rsp, 0x30
xor eax, eax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov qword [rsp + 0x58], rax
mov ebx, ecx
mov dword [rsp + 0x40], eax
mov r9d, 0xf003f
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400156f2
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type2
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400156e7
lea ecx, [rbx - 1]
mov eax, 1
shl eax, cl
mov ecx, dword [rsp + 0x40]
test ecx, eax
je 0x1400156a4
not eax
and eax, ecx
jmp 0x1400156a6
or eax, ecx
mov rcx, qword [rsp + 0x58]
lea rdx, str.Type2
mov dword [rsp + 0x40], eax
mov r9d, 4
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x140002d4c
Capabilities:
Set registry value

Disassembly:
jmp 0x140008530
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov r10, rdx
mov qword [rsp + 0x40], rcx
mov rdi, r9
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400085b7
mov rcx, qword [rbx]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400085b7
mov eax, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rdi
ret

Function at 0x140002dab
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14002cf38
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400abc68]
xor ecx, ecx
lea r8, [0x1400abc60]
lea rdx, str.FlsAlloc
call fcn.14002ca8c
test rax, rax
je 0x14002cf71
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400ce010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140002f7c
Capabilities:
Shutdown system

Disassembly:
jmp 0x1400153a0
sub rsp, 0x58
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140015437
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14001545a
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14001544b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001e15
add rsp, 0x58
ret
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14001542c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001e15
add rsp, 0x58
ret
Function at 0x14000326a
Capabilities:
Set registry value

Disassembly:
jmp 0x1400196f0
mov dword [rsp + 8], ecx
sub rsp, 0x38
lea rcx, str.ENTER_UpdateDolbyMultimodeRegistry___n
call fcn.1400030c1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREDolbyDAX
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140019785
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.MultimodeFormFactor
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x14001978c
test rcx, rcx
je 0x140019779
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.EXIT_Error_UpdateDolbyMultimodeRegistry___n
call fcn.1400030c1
xor eax, eax
add rsp, 0x38
ret
test rcx, rcx
je 0x140019797
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.EXIT_UpdateDolbyMultimodeRegistry___n
call fcn.1400030c1
mov eax, 1
add rsp, 0x38
ret
Function at 0x14000341d
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14000a140
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
mov dword [rax + 0x18], 4
xor ebx, ebx
mov dword [rax + 0x10], 0x14
lea rcx, str.Enter_IntelligentCoolingCreateInitTimeFromReg___n
mov qword [rax - 0x18], rbx
mov dword [rax + 0x20], ebx
call fcn.1400030c1
cmp dword [0x1400c22e0], ebx
jne 0x14000a18b
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___does_not_support_system_n
call fcn.1400030c1
jmp 0x14000a284
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000a1e2
lea rcx, str.Error_IntelligentCoolingCreateInitTimeFromReg_RegCreateKeyEx_error____n
call fcn.1400030c1
jmp 0x14000a284
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.INIT
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a227
mov edx, dword [rsp + 0x78]
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___already_have_than_read_the_value_read_value:__x_n
call fcn.1400030c1
jmp 0x14000a279
mov eax, dword [rsp + 0x80]
lea rdx, str.INIT
mov rcx, qword [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000a26d
mov edx, dword [rsp + 0x78]
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___Set_Key_value_read_value:__x_n
call fcn.1400030c1
jmp 0x14000a279
lea rcx, str.Error_IntelligentCoolingCreateInitTimeFromReg___Connot_set_value:_n
call fcn.1400030c1
mov eax, dword [rsp + 0x78]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000a294
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingCreateInitTimeFromReg___n
call fcn.1400030c1
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140003567
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013120
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_GetSystemTransformation_n
call fcn.1400030c1
xor ebx, ebx
lea rcx, [0x14009b1b8]
mov edi, ebx
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], ebx
mov esi, ebx
call fcn.140002667
mov rbp, rax
test rax, rax
je 0x1400131fc
mov rdx, rax
lea rcx, str.GetSystemTransformation:_DevicePath____ws__n
call fcn.1400030c1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400131b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_CreateFile_Error__08d__n
jmp 0x140013209
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x1400131e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_ReadFile_Error__08d__n
jmp 0x140013209
movzx edx, byte [rsp + 0x68]
lea rcx, str.GetSystemTransformation:_ReadFile_0x_08x__n
mov dword [r14], edx
mov esi, 1
jmp 0x14001320d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_GetDevicePath_Error__08d__n
mov ebx, eax
mov edx, eax
call fcn.1400030c1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140013228
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_GetSystemTransformation:_Status__08d__n
call fcn.1400030c1
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140003602
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
jmp 0x1400150c0
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xb50]
sub rsp, 0xc50
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rbp + 0xb40], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140002da1
movups xmm0, xmmword [str.SOFTWAREMicrosoft_]
xor edx, edx
mov r8d, 0x7d8
movups xmm1, xmmword [0x14009e158]
lea rcx, [rbp + 0x368]
movaps xmmword [rbp + 0x340], xmm0
movsd xmm0, qword [0x14009e168]
movsd qword [rbp + 0x360], xmm0
movaps xmmword [rbp + 0x350], xmm1
call fcn.140002da1
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x200
call fcn.140002da1
xor eax, eax
mov dword [rsp + 0x30], 0x100
lea rdx, str.Windows_NTCurrentVersionProfileList_
mov dword [rsp + 0x34], eax
lea rcx, [rbp + 0x340]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x340]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001528c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.ProfileImagePath
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001528c
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.140002da1
mov r8d, 0x100
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14001528c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14001524c
lea rdx, str._ntuser.dat
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14001528c
lea edx, [rax + 1]
lea rcx, str.SeRestorePrivilege
call fcn.140001131
test eax, eax
je 0x14001528c
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002905
test eax, eax
je 0x14001528c
mov eax, 1
jmp 0x14001528e
xor eax, eax
mov rcx, qword [rbp + 0xb40]
xor rcx, rsp
call fcn.140001e15
mov rbx, qword [rsp + 0xc68]
add rsp, 0xc50
pop rbp
ret