joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014440
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x4530
call fcn.14002b130
sub rsp, rax
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x4520], rax
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
lea rcx, [rsp + 0x100]
mov r8d, 0x208
mov rbx, rax
call fcn.14002d0c0
mov dword [rsp + 0xf0], 0x104
test rbx, rbx
je 0x14001452d
lea r9, [rsp + 0xf0]
xor edx, edx
lea r8, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14001452d
lea rax, str._EnableDGPUOffMode
mov edx, 0x1fff
lea r9, [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r8, str.__ls___s
lea rcx, [rsp + 0x520]
call fcn.1400126d0
lea rdx, [rsp + 0x520]
lea rcx, str.StartDGPUProcess__:_Command_Line:__ls_n
call fcn.14000fcd0
xor ebx, ebx
lea rcx, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x60], rbx
lea r8d, [rbx + 1]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x140014552
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov rcx, qword [rsp + 0x4520]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x4560]
add rsp, 0x4530
pop rdi
pop rsi
pop rbp
ret
lea r8, str.winsta0default
mov edx, 0x104
lea rcx, [rsp + 0x310]
call fcn.140035914
xor eax, eax
lea rdi, [rsp + 0x80]
mov ecx, 0x68
lea r8, [rsp + 0x520]
rep stosb byte [rdi], al
lea rax, [rsp + 0x310]
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x90], rax
lea rdi, [rsp + 0x68]
xor eax, eax
mov word [rsp + 0xc0], bx
mov ecx, 0x18
xor r9d, r9d
rep stosb byte [rdi], al
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x50], rax
mov rcx, rbp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test eax, eax
jne 0x140014603
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001460b
mov rax, qword [rsp + 0x68]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne al
jmp 0x14001452f
Function at 0x140015980
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ecx, 0x55f0
call fcn.14000fbc0
test al, al
jne 0x1400159d6
call fcn.1400247b0
test al, al
je 0x140015a45
mov ecx, 6
call fcn.140023f20
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14002a740
add rsp, 0xa8
ret
xorps xmm0, xmm0
lea rax, str.open
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
lea rax, str.ms_settings:batterysaver
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x20], 0x70
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x50], 1
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140015a45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14002a740
add rsp, 0xa8
ret

Function at 0x140015a60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor edx, edx
mov r8d, 0xf0
lea rcx, [rsp + 0x40]
call fcn.14002d0c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140015b41
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140015b41
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140015b41
lea rdx, [0x140076028]
lea rcx, [rsp + 0x40]
call fcn.140004a20
movzx ebx, al
jmp 0x140015b43
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140015b53
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x140
pop rbx
ret
Function at 0x140019630
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx edi, dl
lea rcx, str.Sensor64.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140019674
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140019759
lea rdx, str.ShockproofSetThermalFeatureSetting
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400763c8], rax
test rax, rax
je 0x140019750
mov ecx, 2
test dil, dil
jne 0x1400196a3
mov ecx, 1
call rax
test eax, eax
je 0x140019750
xor ecx, ecx
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICCQL
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov qword [rsp + 0x58], rcx
xor r8d, r8d
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140019739
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140019739
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov bl, 1
jmp 0x14001973b
xor bl, bl
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001974b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x14001975b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140019d30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICTIO
mov qword [rsp + 0x40], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140019e87
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.CurrentSetting
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140019e87
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.CurrentSetting
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140019e87
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov edx, 0x222728
mov r8d, 0x200
lea rcx, [rsp + 0x48]
movdqu xmmword [rsp + 0x48], xmm0
call fcn.14001ec30
test eax, eax
je 0x140019e65
cmp dword [rsp + 0x34], ebx
je 0x140019e3d
mov ecx, dword [rsp + 0x30]
mov eax, ecx
and eax, 0x10001
cmp eax, 0x10001
jne 0x140019e35
mov ebx, 1
jmp 0x140019e3d
not cl
movzx ebx, cl
and ebx, 1
mov edx, 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9d, [rdx + 0xe]
lea r8d, [rdx + 1]
call fcn.1400191f0
test al, al
je 0x140019e65
mov bl, 1
jmp 0x140019e67
xor bl, bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140019e77
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140019e87
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140019e97
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x60
pop rbx
ret
Function at 0x14001a740
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r9
lea rax, [rsp + 0x30]
mov rbx, r8
mov qword [rsp + 0x20], rax
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a7e2
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a7e2
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
jmp 0x14001a7e4
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001a7f4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001b840
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx eax, dl
lea rcx, [rsp + 0x50]
mov edi, 1
mov qword [rsp + 0x28], rcx
mov ebx, r8d
mov dword [rsp + 0x20], eax
mov r9d, r8d
mov edx, edi
lea r8d, [rdi + 0xa]
call fcn.1400191f0
test al, al
je 0x14001b930
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
cmp ebx, 2
jne 0x14001b89e
lea eax, [rcx + 3]
jmp 0x14001b8a5
cmp ebx, edi
mov eax, ecx
cmove eax, edi
mov qword [rsp + 0x40], rcx
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICMMC
mov dword [rsp + 0x50], eax
xor r9d, r9d
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001b8eb
xor bl, bl
jmp 0x14001b91d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001b92d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14001b950
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor esi, esi
movzx edi, dl
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rbx, rcx
mov dword [rsp + 0x20], esi
lea edx, [rsi + 3]
call fcn.1400191f0
test al, al
je 0x14001ba8b
mov edx, dword [rsp + 0x30]
mov rcx, rbx
call fcn.140019310
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rsi
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICCONFIG
mov dword [rsp + 0x34], esi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ba44
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x140068048]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ba44
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x140068048]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ba44
cmp dword [rsp + 0x34], esi
je 0x14001ba76
cmp byte [rbx + 0x14], sil
je 0x14001ba76
mov edx, 1
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
lea r9d, [rdx + 0xe]
lea r8d, [rdx + 0xb]
call fcn.1400191f0
test al, al
jne 0x14001ba76
xor bl, bl
jmp 0x14001ba78
mov bl, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ba88
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001c1c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
test dl, dl
je 0x14001c23c
xor r9d, r9d
mov dword [rsp + 0x30], 0
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140075e58], rax
mov r9, rbx
lea r8, [0x14001dbf0]
xor edx, edx
lea rax, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call fcn.1400355e8
mov qword [0x140075e60], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x40
pop rbx
ret
mov rcx, qword [0x140075e58]
test rcx, rcx
je 0x14001c284
cmp qword [0x140075e60], 0
je 0x14001c284
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140075e60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140075e60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140075e58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x40
pop rbx
ret
Function at 0x14001d3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rcx + 0xd0]
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 0xd8]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
cmp qword [rax], 0
je 0x14001d5b8
add rax, 8
lea rcx, [rbp - 8]
cmp rax, rcx
jne 0x14001d3e1
lea rax, [rbp - 0x40]
mov qword [rsp + 0x88], rbx
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x30], rbx
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov qword [rbp - 0x28], rbx
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 0x11]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d576
mov r9, qword [rbp - 0x10]
lea r8d, [rbx + 4]
mov rcx, qword [rbp - 0x40]
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x14001d576
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rbp - 0x18]
mov r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14001d5ac
cmp eax, 1
jne 0x14001d57c
lea rax, [rbp - 0x30]
mov dword [rbp - 0x38], ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d54c
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x24]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140068238]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d54c
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x24]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
lea rax, [rbp - 0x38]
xor r8d, r8d
lea rdx, [0x140068238]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d54c
cmp dword [rbp - 0x38], 2
lea rcx, [rbp - 0x20]
mov edx, 1
mov qword [rsp + 0x28], rcx
mov eax, ebx
mov dword [rbp - 0x20], ebx
setne al
mov dword [rsp + 0x20], eax
lea r9d, [rdx + 0xe]
lea r8d, [rdx + 4]
call fcn.1400191f0
test al, al
je 0x14001d583
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x14001d552
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rbp - 0x10]
xor edx, edx
mov rcx, qword [rbp - 0x40]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x14001d460
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call fcn.1400356bc
mov rcx, qword [rbp - 0x30]
mov rbx, qword [rsp + 0x88]
test rcx, rcx
je 0x14001d5bf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x70
pop rbp
ret
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x14001d57c
xor ecx, ecx
call fcn.1400356bc
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x70
pop rbp
ret
Function at 0x14001ed30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001edde
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Type2
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001edde
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.Type2
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001edee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x14001ee10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001eebe
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Type13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001eebe
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.Type13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001eece
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14001eef0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Notification
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ef9e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Type22
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ef9e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.Type22
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001efae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14001f730
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
call fcn.14001f0e0
test al, al
je 0x14001f93f
mov rcx, rbx
call fcn.14001f1a0
test al, al
je 0x14001f93f
xor eax, eax
mov qword [rsp + 0x78], rbp
xor ebp, ebp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov ecx, 4
mov qword [rsp + 0x30], rbp
lea rdi, [rsp + 0x40]
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x40]
lea r8d, [rbp + 1]
and eax, 0xffe00f00
mov dword [rsp + 0x28], ebp
xor r9d, r9d
mov dword [rsp + 0x50], eax
mov edx, 0x80000000
mov dword [rsp + 0x40], ebp
lea rcx, str..IBMPmDrv
mov dword [rsp + 0x20], 3
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x14001f92a
cmp rax, 0xffffffffffffffff
je 0x14001f921
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea r9d, [rbp + 4]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov edx, 0x22270c
mov dword [rsp + 0x48], ebp
mov rcx, rdi
mov dword [rsp + 0x44], ebp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14001f91b
mov r8d, dword [rsp + 0x44]
test r8, r8
je 0x14001f842
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14002c910
mov esi, dword [rsp + 0x40]
shr esi, 0x1c
mov rcx, rdi
mov dword [rbx + 0x68], esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x14001f92a
cmp dword [rbx + 0x74], ebp
lea rax, [rbx + 0x74]
jne 0x14001f89a
mov qword [rsp + 0x28], rax
lea r8, [0x140020090]
mov r9, rbx
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x38], rax
cmp dword [rbx + 0x70], ebp
lea rax, [rbx + 0x70]
jne 0x14001f8c4
mov qword [rsp + 0x28], rax
lea r8, [0x14001fae0]
mov r9, rbx
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x30], rax
cmp dword [rbx + 0x78], ebp
lea rax, [rbx + 0x78]
jne 0x14001f8ee
mov qword [rsp + 0x28], rax
lea r8, [0x14001fcb0]
mov r9, rbx
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x40], rax
mov rcx, qword [rbx + 0x28]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14001f960
jmp 0x14001f92a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x60
pop rbx
ret