joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e220
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x848
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.14001d250
lea rdi, [rsp + 0x868]
call fcn.140001030
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x7fffffff
mov rcx, qword [rax]
call fcn.1400217b8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x848
pop rdi
pop rbx
ret

Function at 0x14000e2c0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
mov edx, ebx
call fcn.14000e220
mov r8d, ebx
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
mov ecx, 2
call fcn.1400197e0
test ebx, ebx
je case.default.0x14000e337
call fcn.140009810
cmp eax, 0x32
jl case.default.0x14000e337
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableRadioHandler__dont_send_check_msg_n
mov ecx, 2
call fcn.1400197e0
mov dword [0x140053e94], 1
mov ecx, dword [0x140053e70]
mov r8, rbx
xor r9d, r9d
mov edx, 0x5e5d
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostThreadMessageW]
ror bl, cl
movabs dword [0x499e1b5b192c58fb], eax
cld
xchg dword [rcx + 0x71bfeaf7], edx
cmp al, 0xdf
in al, 0xd4
invalid
invalid
Function at 0x14000e340
Capabilities:
Query or enumerate registry value
Query service status
Start service
Stop service

Disassembly:
push rsi
sub rsp, 0x280
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x270], rax
movups xmm0, xmmword [str.SOFTWAREAtherosVistaAddOn]
mov esi, ecx
xor edx, edx
movups xmm1, xmmword [0x140041e88]
lea rcx, [rsp + 0x98]
mov r8d, 0x1d0
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x140041e98]
movaps xmmword [rsp + 0x70], xmm1
movsd xmm1, qword [0x140041ea8]
movaps xmmword [rsp + 0x80], xmm0
movsd qword [rsp + 0x90], xmm1
call fcn.14001d250
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e568
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.ControlBthServ
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000e427
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000e568
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 1
jne 0x14000e568
mov r8d, esi
mov qword [rsp + 0x2a0], rdi
lea rdx, str.StartBthService___d___n
mov ecx, 1
call fcn.1400197e0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000e480
lea rdx, str.Open_Service_manager_error__n
lea ecx, [rax + 1]
call fcn.1400197e0
jmp 0x14000e560
mov r8d, 0x34
mov qword [rsp + 0x298], rbx
lea rdx, str.BthServ
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000e4c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Open_BthServ_Service_error:__d___n
lea ecx, [rbx + 1]
call fcn.1400197e0
jmp 0x14000e54f
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000e4e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Get_Service_state_error:__d___n
jmp 0x14000e539
test esi, esi
jne 0x14000e513
cmp dword [rsp + 0x44], 4
jne 0x14000e546
lea r8, [rsp + 0x40]
mov rcx, rbx
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000e546
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.stop_service_error:__d___n
jmp 0x14000e539
cmp dword [rsp + 0x44], 1
jne 0x14000e546
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000e546
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.start_service_error:__d___n
mov r8d, eax
mov ecx, 1
call fcn.1400197e0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x280
pop rsi
ret
Function at 0x14000eb30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [str..ATHAMPFL]
lea rcx, [rsp + 0x50]
movzx eax, word [0x140046ac8]
movsd xmm1, qword [0x140046ac0]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x68], ax
movsd qword [rsp + 0x60], xmm1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000ebbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ath_l2cap_disconnect_all__INVALID_HANDLE_VALUE_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000ec17
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], edi
mov r9d, 8
mov edx, 0x2a0508
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x48], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000ec0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ath_l2cap_disconnect_all__error__x_n
call fcn.14000e220
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140019ce0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x14000ec40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [str..ATHAMPFL]
lea rcx, [rsp + 0x48]
movzx eax, word [0x140046ac8]
movsd xmm1, qword [0x140046ac0]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
movups xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x60], ax
movsd qword [rsp + 0x58], xmm1
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000ecce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ath_fake_disconnect_event__INVALID_HANDLE_VALUE_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000ed29
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x2a0518
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000ed14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ath_fake_disconnect_event__error__x_n
call fcn.14000e220
jmp 0x14000ed20
lea rcx, str.ath_fake_disconnect_event_success__n
call fcn.14000e220
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140019ce0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400101a0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx ebx, cl
lea rcx, str.DisableBTENUMDevice_Start_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableBTENUMDevice_Start_n
mov ecx, 2
call fcn.1400197e0
cmp word [0x1400557b0], 0
lea rax, str.enable
mov qword [rsp + 0x30], rax
lea rdx, [0x1400557b0]
lea rax, str.disable
mov qword [rsp + 0x38], rax
lea rcx, str.argv2_5_:__s_n
lea rax, str.remove
mov qword [rsp + 0x40], rax
lea rax, str.BTHMS_BTHBRB
mov qword [rsp + 0x48], rax
lea rax, str.BTHMS_BTHLE
mov qword [rsp + 0x50], rax
lea rax, str.USBClass_E0
cmove rdx, rax
mov qword [rsp + 0x58], rdx
call fcn.14000e220
lea rax, str.BTHENUM
mov qword [rsp + 0x60], rax
lea rax, str.rescan
mov qword [rsp + 0x68], rax
test bl, bl
je 0x1400102a5
lea rcx, str.DisableBTENUMDevice__Enable_device_n
call fcn.14000e220
lea rdx, str.DisableBTENUMDevice__Enable_device_n
mov ecx, 2
call fcn.1400197e0
lea rax, [rsp + 0x58]
movzx ecx, bl
mov qword [rsp + 0x28], rax
call fcn.1400073a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.radio_Rescan_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1400102f2
lea rcx, str.DisableBTENUMDevice__Disable_device_n
call fcn.14000e220
lea rdx, str.DisableBTENUMDevice__Disable_device_n
mov ecx, 2
call fcn.1400197e0
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x28], rax
call fcn.1400073a0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1400557a0], 0
jne 0x1400102f2
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.DisableBTENUMDevice_End_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableBTENUMDevice_End_n
mov ecx, 2
call fcn.1400197e0
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x80
pop rbx
ret

Function at 0x140010410
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001049e
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140010498
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x44], rax
xor r9d, r9d
xor eax, eax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 0x80010002
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x68
ret
Function at 0x140010a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, 0x1002
mov eax, 2
mul rcx
mov r14, 0xffffffffffffffff
cmovo rax, r14
mov rcx, rax
call fcn.140019d0c
mov rdi, rax
test rax, rax
jne 0x140010a49
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov dword [rsp + 0x60], 0x2000
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140010aec
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140010b0c
cmp dword [rsp + 0x68], 7
jne 0x140010b0c
mov ebx, dword [rsp + 0x60]
mov rcx, rdi
call fcn.140019d04
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.140019d0c
mov rdi, rax
test rax, rax
je 0x140010b14
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010a80
mov ecx, dword [rsp + 0x60]
xor edx, edx
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], dx
mov rcx, rdi
mov word [rdi + rax*2], dx
call fcn.140010610
test rax, rax
jne 0x140010b16
mov rcx, rdi
call fcn.140019d04
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140013690
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x60
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
lea rdx, str.Enter_EnumerateHostController___n
mov rbx, rcx
mov dword [rsp + 0x40], ebp
mov esi, ebp
lea ecx, [rbp + 2]
call fcn.1400197e0
lea rcx, str.Enter_EnumerateHostController___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x44]
mov dword [rsp + 0x28], 6
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x220408
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14001371b
lea rcx, str.Enter_if___DeviceIoControl_sizeof_rootHubName___nBytes__NULL___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x14001384c
mov eax, dword [rsp + 0x44]
mov ecx, eax
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x40], eax
call fcn.140021aa0
mov r14, rax
test rax, rax
jne 0x14001374e
lea rcx, str.Enter_if__rootHubNameW__NULL__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x140013844
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov eax, dword [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x220408
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140013794
lea rcx, str.Enter_if___DeviceIoControl_nBytes__nBytes__NULL___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14001380f
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x88], rdi
mov rcx, rbx
cmp word [r14 + rcx*2 + 6], si
lea rcx, [rcx + 1]
jne 0x1400137a3
lea rcx, [rcx*2 + 0xa]
call fcn.140021aa0
mov rsi, rax
test rax, rax
je 0x140013807
lea r8, str.._
mov edx, 5
mov rcx, rax
call fcn.1400219a4
nop dword [rax + rax]
cmp word [r14 + rbx*2 + 6], bp
lea rbx, [rbx + 1]
jne 0x1400137e0
lea rdx, [rbx + 1]
lea rcx, [rsi + 8]
lea r8, [r14 + 4]
call fcn.1400219a4
mov rcx, rsi
call fcn.140013180
mov ebp, eax
mov rdi, qword [rsp + 0x88]
mov rcx, r14
call fcn.140021a8c
test rsi, rsi
je 0x140013824
mov rcx, rsi
call fcn.140021a8c
lea rdx, str.Leave_EnumerateHostController___n
mov ecx, 2
call fcn.1400197e0
lea rcx, str.Leave_EnumerateHostController___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebp
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
Function at 0x140013d70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov dword [rsp + 0x60], 1
mov rsi, rdx
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x68], 4
lea rdx, str.ForceHCResetOnResume
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___2_
mov ecx, 4
cmp eax, 2
sete dil
call fcn.1400197e0
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013ecf
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.ResetKeyAddded
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___3_
mov ecx, 4
call fcn.1400197e0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.ResetKeyAddded
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x140013ea4
mov rcx, qword [rsp + 0x30]
lea rdx, str.ForceResetKey
mov dword [rsp + 0x28], 0x104
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ForceHCResetOnResume
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140014930
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x40], 0xffffffff
mov rbx, rcx
mov dword [rsp + 0x48], 4
test rcx, rcx
jne 0x140014957
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400149ed
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400149da
mov r8d, dword [rsp + 0x40]
lea rdx, str.Read__d_from_reg__s__n
mov r9, rbx
lea ecx, [rax + 2]
call fcn.1400197e0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x40], 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x140014a00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov r8d, ecx
lea r9, str.ControllerIndex
mov ecx, 2
lea rdx, str.Set_value__d_into_reg__s__n
call fcn.1400197e0
lea rax, [rsp + 0x48]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAtherosVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014a8b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.ControllerIndex
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x140014a90
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x210
call fcn.14001d250
lea rcx, str.Enter_USBRootHubAndHCReset____n_n
call fcn.14000e220
lea rcx, [rsp + 0x20]
call fcn.1400145a0
test eax, eax
jne 0x140014aec
lea rcx, str.USBRootHubAndHCReset__GetBTAdapterStatus_failed____n
call fcn.14000e220
xor eax, eax
jmp 0x140014c77
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__dongle_status_is__d____n
call fcn.14000e220
mov edx, 1
mov dword [0x1400557ac], 1
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000e220
mov r8d, 1
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 1]
call fcn.1400197e0
call fcn.140009810
cmp eax, 0x32
jl 0x140014b5f
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableRadioHandler__dont_send_check_msg_n
mov ecx, 2
call fcn.1400197e0
mov dword [0x140053e94], 1
mov ecx, dword [0x140053e70]
xor r9d, r9d
mov edx, 0x5e5d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
xor edx, edx
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000e220
xor r8d, r8d
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 2]
call fcn.1400197e0
mov ecx, dword [0x140053e70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.1400145a0
test eax, eax
je 0x140014ad9
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_off_on_radio__dongle_status_is__d_n
call fcn.14000e220
cmp dword [rsp + 0x20], 1
je 0x140014c72
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBRootHubReset__index_is__d____n
call fcn.14000e220
mov ecx, ebx
call fcn.140014390
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.1400145a0
test eax, eax
je 0x140014ad9
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBRootHubReset__dongle_status_is__d____n
call fcn.14000e220
cmp dword [rsp + 0x20], 1
je 0x140014c72
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBControllerReset__index_is__d____n
call fcn.14000e220
mov ecx, ebx
call fcn.140013a00
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.1400145a0
test eax, eax
je 0x140014ad9
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBControllerReset__dongle_status_is__d___n
call fcn.14000e220
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x240
pop rbx
ret
Function at 0x140015b30
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x4b0
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
lea rcx, str.Enter_function_CheckAndRecoverDevice___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.Enter_function_CheckAndRecoverDevice___n
mov ecx, 2
call fcn.1400197e0
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x210
call fcn.14001d250
movaps xmm0, xmmword [str.SOFTWAREAtherosVistaAddOnSupportedDevice]
lea rcx, [rsp + 0xc8]
movaps xmm1, xmmword [0x140045820]
xor edx, edx
movaps xmmword [rsp + 0x70], xmm0
mov r8d, 0x1b0
movaps xmm0, xmmword [0x140045830]
movaps xmmword [rsp + 0x80], xmm1
movaps xmm1, xmmword [0x140045840]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x140045850]
movaps xmmword [rsp + 0xa0], xmm1
movsd xmm1, qword [0x140045860]
movaps xmmword [rsp + 0xb0], xmm0
movsd qword [rsp + 0xc0], xmm1
call fcn.14001d250
lea rax, str.hwids
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x490], rax
mov r9d, 2
lea rax, str.bluetooth
mov dword [rsp + 0x44], 0x11
mov qword [rsp + 0x498], rax
xor edx, edx
lea rax, str._USB
mov r8d, r9d
mov qword [rsp + 0x4a0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [0x1400067a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x498]
mov qword [rsp + 0x20], rax
call fcn.140010ce0
mov ebx, 1
test eax, eax
jne 0x140015c9e
mov ecx, ebx
cmp dword [rsp + 0x40], eax
jne 0x140015c84
call fcn.140021bc8
mov rcx, rax
xor r8d, r8d
mov edx, 0xebf3
call fcn.140010330
jmp 0x140015c9e
call fcn.140021bc8
mov r8d, dword [rsp + 0x40]
mov rcx, rax
xor r9d, r9d
mov edx, 0xebf5
call fcn.140010330
lea rcx, str.Finish_getting_hwid._n
call fcn.14000e220
lea rdx, str.Finish_getting_hwid._n
mov ecx, 2
call fcn.1400197e0
call fcn.140015980
mov dword [rsp + 0x280], eax
test eax, eax
je 0x140015cfd
lea rdx, [0x1400557b0]
lea rcx, str.CheckAndRecoverDevice_Find_Dongle_is__s._n
call fcn.14000e220
lea r8, [0x1400557b0]
mov ecx, 2
lea rdx, str.CheckAndRecoverDevice_Find_Dongle_is__s._n
call fcn.1400197e0
mov eax, dword [rsp + 0x280]
cmp eax, 2
jne 0x140015d32
lea rcx, str.Status.configStatus__DeviceNotConfigurate_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.Status.configStatus__DeviceNotConfigurate_n
mov ecx, 2
call fcn.1400197e0
inc dword [0x140053e90]
mov dword [0x140053e8c], 0
jmp 0x140015d44
inc dword [0x140053e8c]
xor ebx, ebx
mov dword [0x140053e90], 0
lea rcx, [rsp + 0x280]
call fcn.140015030
lea rcx, str.Leave_function_CheckAndRecoverDevice___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.Leave_function_CheckAndRecoverDevice___n
mov ecx, 2
call fcn.1400197e0
mov eax, ebx
mov rcx, qword [rsp + 0x4a8]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x4b0
pop rbx
ret