joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004075
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14007fee8
sub rsp, 0x58
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9, rdx
cmp rax, 0x20
mov r8, rcx
jae 0x14007ff80
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x14007ff07
mov al, byte [rdx]
jmp 0x14007ff3a
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
inc r9
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r9]
test al, al
jne 0x14007ff1b
jmp 0x14007ff5f
movzx eax, r9b
mov edx, 1
movzx ecx, r9b
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x14007ff7b
inc r8
mov r9b, byte [r8]
test r9b, r9b
jne 0x14007ff40
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x58
ret
mov rax, r8
jmp 0x14007ff69
call fcn.140002c3e
int3

Function at 0x14000407f
Capabilities:
Terminate process

Disassembly:
jmp 0x140059600
sub rsp, 0x28
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140059619
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.1400041d8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140004093
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140025f70
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov dword [rsp + 0x30], 0x80
xor ebx, ebx
mov dword [rsp + 0x34], 1
lea rcx, str.Enter_SystemTransformationCreateReg___n
mov qword [rsp + 0x38], rbx
call fcn.140003224
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140025ff6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_SystemTransformationCreateReg_RegCreateKeyEx_error____d_n
call fcn.140003224
jmp 0x140026060
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002603e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_SystemTransformationCreateReg_RegQueryValueEx_error____d_n
call fcn.140003224
jmp 0x140026060
lea rdx, [rsp + 0x40]
lea rcx, str.SystemTransformationCreateReg___already_have_than_read_the_dwCurrentSetting_read_value:__s_n
call fcn.140003224
lea rcx, [rsp + 0x40]
call fcn.140003bde
mov dword [rdi], eax
mov ebx, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140026070
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_SystemTransformationCreateReg___n
call fcn.140003224
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x14000420f
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140024c30
sub rsp, 0x38
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
call fcn.140004651
test eax, eax
je 0x140024c74
mov eax, dword [rsp + 0x40]
sub eax, 2
je 0x140024c6c
cmp eax, 1
je 0x140024c62
mov dword [rsp + 0x40], 0
jmp 0x140024c74
mov dword [rsp + 0x40], 2
jmp 0x140024c74
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024cde
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
lea r9d, [rax + 4]
mov rcx, qword [rsp + 0x48]
lea rdx, [0x1400a9c60]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x38
ret

Function at 0x140004219
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14000e710
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov dword [rsp + 0x70], 4
xor ebx, ebx
lea rcx, str.Enter_GetIntelligentCoolingGetCurrentSettingsStatusFromReg___n
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x68], ebx
call fcn.140003224
cmp dword [0x1400d4158], ebx
jne 0x14000e755
lea rcx, str.GetIntelligentCoolingGetCurrentSettingsStatusFromReg___does_not_support_n
call fcn.140003224
jmp 0x14000e7f6
test rdi, rdi
jne 0x14000e76b
lea rcx, str.GetIntelligentCoolingGetCurrentSettingsStatusFromReg__:_pdwCurrentSetting_is_NULL_n
call fcn.140003224
jmp 0x14000e7f6
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000e7bc
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x14000e7f6
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.CurrentSetting
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rdi]
lea rcx, str.SetIntelligentCoolingCurrentStatus__:_0x_08x____n
call fcn.140003224
mov ebx, 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000e806
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.GetIntelligentCoolingCurrentStatus___n
call fcn.140003224
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140004237
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140032338
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1400bb300]
mov ecx, 2
lea r8, [0x1400bb2f8]
lea rdx, [0x1400bb308]
call fcn.140031ce8
mov ecx, ebx
test rax, rax
je 0x140032372
add rsp, 0x20
pop rbx
jmp qword [case.0x140027caa.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1400042e1
Capabilities:
Write file on windows

Disassembly:
jmp 0x140024470
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rcx, [0x1400a92d8]
call fcn.140002766
xor ebx, ebx
mov rbp, rax
mov byte [rsp + 0x50], bl
mov edi, ebx
mov esi, ebx
test rax, rax
je 0x140024539
mov rdx, rax
lea rcx, str.ToggleConversionIndicator:_DevicePath____ws__n
call fcn.140003224
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400244f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.RotationLockButtonPress:_CreateFile_Error__08d__n
jmp 0x140024546
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x50]
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
jne 0x140024521
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ToggleConversionIndicator:_WriteFile_Error__08d__n
jmp 0x140024546
movzx edx, byte [rsp + 0x50]
lea rcx, str.ToggleConversionIndicator:_WriteFile_0x_08x__n
call fcn.140003224
mov esi, 1
jmp 0x14002454f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ToggleConversionIndicator:_GetDevicePath_Error__08d__n
mov edx, eax
mov ebx, eax
call fcn.140003224
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140024565
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_ToggleConversionIndicator:_Status__08d__n
call fcn.140003224
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140004313
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140026990
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 0x100
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140026a1b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemFamily
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026a1b
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140026a10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400043cc
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001a350
push rbx
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, r8
mov dword [rsp + 0x30], r9d
mov rdi, rdx
mov dword [rsp + 0x38], 0
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140002eeb
lea r9, str.IWTPAUTO.PMHELPER
mov qword [rsp + 0x20], rbx
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14000441c
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a414
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a414
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000448f
Capabilities:
Set registry value

Disassembly:
jmp 0x14001af20
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], r8d
push rdi
sub rsp, 0x60
mov rsi, rcx
xor ebx, ebx
lea rcx, str.Enter_IntelligentCoolingSetRegKeyDwordValue___n
mov qword [rax - 0x18], rbx
mov dword [rax + 0x20], ebx
mov rdi, rdx
call fcn.140003224
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001afa1
mov edx, eax
lea rcx, str.Error_IntelligentCoolingSetRegKeyDwordValue_RegCreateKeyEx_error___d__n
call fcn.140003224
jmp 0x14001b000
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001afe1
mov edx, eax
lea rcx, str.Error_IntelligentCoolingSetRegKeyDwordValue_RegSetValueEx_error___d__n
call fcn.140003224
jmp 0x14001b000
mov r9d, dword [rsp + 0x80]
lea rcx, str.IntelligentCoolingSetRegKeyDwordValue___Set_the_value:_s_s___x__n
mov r8, rdi
mov rdx, rsi
call fcn.140003224
mov ebx, 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001b010
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingSetRegKeyDwordValue___n
call fcn.140003224
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1400046a6
Capabilities:
Query environment variable

Disassembly:
jmp 0x140071d90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x140071e0f
jmp 0x140071dcb
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x140071dba
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], si
jne 0x140071db6
sub rax, rbx
add rax, 2
sar rax, 1
lea rbp, [rax + rax]
mov rcx, rbp
call fcn.140003017
mov rdi, rax
test rax, rax
je 0x140071dff
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.140003d50
mov rsi, rdi
xor ecx, ecx
call fcn.140002c61
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400047be
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140023e40
push rbx
sub rsp, 0x30
lea rcx, str.Inside_SetTNSPMode___n
call fcn.140003224
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCConfigurationsScreenRotation
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023ec5
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov ebx, 1
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.TNSPMode
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [rsp + 0x40]
lea rcx, str.SetTNSPMode__:_Enable_Tanner_BIOS_Flag_:__d_n
call fcn.140003224
jmp 0x140023ed1
lea rcx, str.Error_:_RegOpenKeyEx_:_SetTNSPMode__._n
call fcn.140003224
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140023ee1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14000480e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140026410
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, str.Enter_UpdatePrevMultimode__._n
call fcn.140003224
xor eax, eax
lea r9, [rsp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rdx, [0x1400b8128]
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026504
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov rcx, rbx
lea rdx, [0x1400b8128]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026504
mov ecx, dword [rsp + 0x30]
lea r8d, [rax + 0xa]
lea rdx, [rsp + 0x40]
call fcn.140001b40
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0xa
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.PrevMode
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140026504
lea rcx, str.Exit_UpdatePrevMultimode__._n
call fcn.140003224
mov eax, 1
jmp 0x140026506
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140004831
Capabilities:
Get common file path

Disassembly:
jmp 0x140018870
push rbx
sub rsp, 0x250
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, str.ENTER_GetRunDLLPath__
call fcn.140003224
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140002eeb
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8025
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400188d1
xor al, al
jmp 0x140018907
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, str._ls_rundll32.exe
mov rcx, rbx
call fcn.14000441c
mov rdx, rbx
lea rcx, str.GetRunDLLPath:__ls
call fcn.140003224
lea rcx, str.EXIT_GetRunDLLPath__
call fcn.140003224
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x250
pop rbx
ret

Function at 0x140004886
Capabilities:
Stop service

Disassembly:
jmp 0x140018d30
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rcx, str.Enter_StopPMService___n
call fcn.140003224
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140018dd3
mov r8d, 0xf003f
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140018dbc
lea r8, [rsp + 0x20]
mov rcx, rax
lea edx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test eax, eax
jne 0x140018dbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StopPMService___ControlService_failed:__d_n
call fcn.140003224
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140018dd3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Exit_StopPMService___n
call fcn.140003224
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000b7c0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14000b7c0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov dword [rsp + 0x50], 4
mov rdi, r9
mov rax, r8
mov r10, rdx
mov rbx, rcx
mov dword [rsp + 0x70], esi
cmp qword [rcx], rsi
jne 0x14000b81f
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rdx, rax
mov dword [rsp + 0x28], 0x20019
mov rcx, r10
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000b88d
mov rcx, qword [rbx]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b88d
mov rcx, qword [rbx]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov rax, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b88d
mov eax, 1
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x78]
xor eax, eax
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x14000b8e0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14000b8e0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov dword [rsp + 0x58], 1
xor edx, edx
mov rbx, rcx
mov rcx, qword [rcx]
mov rsi, r8
mov dword [rsp + 0x40], edx
test rcx, rcx
je 0x14000b96e
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b96e
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x58]
mov rcx, qword [rbx]
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b96e
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000bba0
Capabilities:
Set registry value

Disassembly:
jmp 0x14000bba0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov r10, rdx
mov qword [rsp + 0x40], rcx
mov rdi, r9
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000bc27
mov rcx, qword [rbx]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000bc27
mov eax, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x14000d310
Capabilities:
Create thread
Terminate thread

Disassembly:
jmp 0x14000d310
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400d4180], rax
test rax, rax
je 0x14000d445
call fcn.140003fe4
test eax, eax
je 0x14000d427
lea rcx, str.Got_driver_handle
call fcn.140003224
mov rcx, qword [0x1400d4150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Close_driver_handle
call fcn.140003224
lea rcx, str.calling_connect
call fcn.140003224
mov ecx, 1
call fcn.140001e42
call fcn.1400027a7
call fcn.140002b9e
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140003d46]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400d4188], rax
test rax, rax
je 0x14000d404
mov rcx, qword [0x1400d4180]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400d4188]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
call fcn.140001e42
mov rcx, qword [0x1400d4188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400010f5
mov rcx, qword [0x1400d4180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
lea rcx, str.Fail_to_create_Thread
call fcn.140003224
call fcn.1400010f5
mov rcx, qword [0x1400d4180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
lea rcx, str.Fail_to_connect_to_Driver
call fcn.140003224
mov rcx, qword [0x1400d4180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
lea rcx, str.Fail_to_create_event
call fcn.140003224
add rsp, 0x38
ret
Function at 0x14000e490
Capabilities:
Check mutex on windows
Check os version

Disassembly:
jmp 0x14000e490
push rbx
sub rsp, 0x170
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, r8
mov qword [0x1400d41b0], rcx
mov r8d, 0x110
lea rcx, [rsp + 0x44]
xor edx, edx
call fcn.140002eeb
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000e613
mov ecx, dword [rsp + 0x50]
xor eax, eax
cmp ecx, 2
mov dword [0x1400d4160], 0
sete al
mov dword [0x1400d415c], eax
jne 0x14000e514
cmp dword [rsp + 0x44], 5
jbe 0x14000e534
mov ecx, 1
mov dword [0x1400d4160], ecx
jmp 0x14000e534
cmp ecx, 1
jne 0x14000e534
cmp dword [rsp + 0x44], 4
jne 0x14000e534
mov eax, dword [0x1400d4164]
cmp dword [rsp + 0x48], 0xa
cmove eax, ecx
mov dword [0x1400d4164], eax
cmp word [rbx], 0
je 0x14000e5de
mov rdx, rbx
lea rcx, str.Cmd_Line__s_n
call fcn.140003224
lea rdx, str._PnPTask
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000e584
call fcn.1400039ae
test al, al
jne 0x14000e613
lea rcx, str.Uninstall_PM_driver_n
call fcn.140003224
call fcn.1400014ec
jmp 0x14000e613
lea rdx, str._helper
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000e5de
lea r8, str.HELPERMUTEX
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e5ce
cmp dword [0x1400d415c], 0
je 0x14000e5c9
call fcn.1400036ca
jmp 0x14000e5ce
call fcn.140001285
test rbx, rbx
je 0x14000e613
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000e613
lea rax, [0x14008d388]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [0x140002d29]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x170
pop rbx
ret