joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001af20
Capabilities:
Set registry value

Disassembly:
jmp 0x14001af20
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], r8d
push rdi
sub rsp, 0x60
mov rsi, rcx
xor ebx, ebx
lea rcx, str.Enter_IntelligentCoolingSetRegKeyDwordValue___n
mov qword [rax - 0x18], rbx
mov dword [rax + 0x20], ebx
mov rdi, rdx
call fcn.140003224
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001afa1
mov edx, eax
lea rcx, str.Error_IntelligentCoolingSetRegKeyDwordValue_RegCreateKeyEx_error___d__n
call fcn.140003224
jmp 0x14001b000
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001afe1
mov edx, eax
lea rcx, str.Error_IntelligentCoolingSetRegKeyDwordValue_RegSetValueEx_error___d__n
call fcn.140003224
jmp 0x14001b000
mov r9d, dword [rsp + 0x80]
lea rcx, str.IntelligentCoolingSetRegKeyDwordValue___Set_the_value:_s_s___x__n
mov r8, rdi
mov rdx, rsi
call fcn.140003224
mov ebx, 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001b010
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingSetRegKeyDwordValue___n
call fcn.140003224
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14001d160
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001d160
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rcx, str.Inside_GetLastSystemTransformation__._n
call fcn.140003224
lea rax, [rsp + 0x30]
mov dword [rsp + 0x60], 4
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d221
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x68], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastSystemTransformation
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d218
mov edx, dword [rsp + 0x58]
lea rcx, str.GetLastSystemTransformation__:__d_n
mov dword [rdi], edx
call fcn.140003224
mov edx, dword [rdi]
lea rcx, str.GetLastSystemTransformation__:_pdwLastSystemTransformation_:_0x_08x__n
call fcn.140003224
mov ebx, 1
jmp 0x14001d22d
lea rcx, str.Error_:_RegQueryValueEx_:_GetLastSystemTransformation__._n
jmp 0x14001d228
lea rcx, str.Error_:_RegOpenKeyEx_:_GetLastSystemTransformation__._n
call fcn.140003224
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001d23d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14001d290
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
jmp 0x14001d290
sub rsp, 0x38
mov edx, 0x104
lea rcx, [0x1400d4570]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14001d36e
lea rdx, str.LidBeep.ini
lea rcx, [0x1400d4570]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [0x1400d4570]
call fcn.140003224
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWow6432NodeLenovoPWRMGRVPath
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d36e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
lea rbx, [0x1400d4780]
mov dword [rsp + 0x40], 0x104
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x48], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d35e
lea rdx, str.LidBeep.ini
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call fcn.140003224
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x14001d4c0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001d4c0
push rbx
sub rsp, 0x150
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, str.Inside_GetSystemBiosVersion__._n
call fcn.140003224
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], 0xff
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d5a0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.BIOSVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d597
lea rdx, [0x1400b271c]
lea rcx, [rsp + 0x40]
call fcn.140003ae9
test rax, rax
je 0x14001d58f
call fcn.140001744
call fcn.1400047be
mov dword [0x1400d49a8], 1
mov ebx, 1
jmp 0x14001d675
mov dword [0x1400d49a8], ebx
jmp 0x14001d5ac
lea rcx, str.Error_:_RegQueryValueEx_:_GetSystemBiosVersion__._n
jmp 0x14001d5a7
lea rcx, str.Error_:_RegOpenKeyEx_:_GetSystemBiosVersion__._n
call fcn.140003224
lea rax, [rsp + 0x38]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HARDWAREDESCRIPTIONSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d669
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemBiosVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d660
cmp byte [rsp + 0x40], bl
je 0x14001d648
lea rbx, [rsp + 0x43]
cmp byte [rbx - 1], 0x47
jne 0x14001d63f
cmp byte [rbx], 0x44
jne 0x14001d63f
call fcn.140001744
call fcn.1400047be
mov dword [0x1400d49a8], 1
inc rbx
cmp byte [rbx - 3], 0
jne 0x14001d620
lea rdx, [rsp + 0x40]
lea rcx, str.GetSystemBiosVersion__:_SyatemBiosVersion_:__s__n
call fcn.140003224
mov ebx, 1
jmp 0x14001d675
lea rcx, str.Error_:_RegQueryValueEx_:_GetSystemBiosVersion__._n
jmp 0x14001d670
lea rcx, str.Error_:_RegOpenKeyEx_:_GetSystemBiosVersion__._n
call fcn.140003224
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001d685
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x150
pop rbx
ret
Function at 0x14001d720
Capabilities:
Read file on windows

Disassembly:
jmp 0x14001d720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_GetSystemDockingTransformation_n
call fcn.140003224
xor ebx, ebx
lea rcx, [0x1400a92f0]
mov edi, ebx
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], ebx
mov esi, ebx
call fcn.140002766
mov rbp, rax
test rax, rax
je 0x14001d7fc
mov rdx, rax
lea rcx, str.GetSystemDockingTransformation:_DevicePath____ws__n
call fcn.140003224
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001d7b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_CreateFile_Error__08d__n
jmp 0x14001d809
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x14001d7e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_ReadFile_Error__08d__n
jmp 0x14001d809
movzx edx, byte [rsp + 0x68]
lea rcx, str.GetSystemDockingTransformation:_ReadFile_0x_08x__n
mov dword [r14], edx
mov esi, 1
jmp 0x14001d80d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDockingTransformation:_GetDevicePath_Error__08d__n
mov ebx, eax
mov edx, eax
call fcn.140003224
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14001d828
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_GetSystemDockingTransformation:_Status__08d__n
call fcn.140003224
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14001d8a0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001d8a0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rcx, str.Inside_GetSystemScreenRotationState__._n
call fcn.140003224
lea rax, [rsp + 0x30]
mov dword [rsp + 0x58], 4
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d96d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Enable
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d964
mov eax, dword [rsp + 0x68]
and eax, 1
je 0x14001d93f
cmp eax, 1
jne 0x14001d941
mov dword [rdi], eax
jmp 0x14001d941
mov dword [rdi], ebx
mov edx, dword [rdi]
lea rcx, str.GetSystemScreenRotationState__:__d_n
call fcn.140003224
mov edx, dword [rdi]
lea rcx, str.GetSystemScreenRotationState__:_pdwSystemRotationState_:_0x_08x__n
call fcn.140003224
mov ebx, 1
jmp 0x14001d979
lea rcx, str.Error_:_RegQueryValueEx_:_GetSystemScreenRotationState_n
jmp 0x14001d974
lea rcx, str.Error_:_RegOpenKeyEx_:_GetSystemScreenRotationState_n
call fcn.140003224
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001d989
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001d9e0
Capabilities:
Read file on windows

Disassembly:
jmp 0x14001d9e0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_GetSystemTransformation_n
call fcn.140003224
xor ebx, ebx
lea rcx, [0x1400a92d8]
mov edi, ebx
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], ebx
mov esi, ebx
call fcn.140002766
mov rbp, rax
test rax, rax
je 0x14001dabc
mov rdx, rax
lea rcx, str.GetSystemTransformation:_DevicePath____ws__n
call fcn.140003224
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001da73
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_CreateFile_Error__08d__n
jmp 0x14001dac9
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x14001daa6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_ReadFile_Error__08d__n
jmp 0x14001dac9
movzx edx, byte [rsp + 0x68]
lea rcx, str.GetSystemTransformation:_ReadFile_0x_08x__n
mov dword [r14], edx
mov esi, 1
jmp 0x14001dacd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_GetDevicePath_Error__08d__n
mov ebx, eax
mov edx, eax
call fcn.140003224
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14001dae8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_GetSystemTransformation:_Status__08d__n
call fcn.140003224
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14001e170
Capabilities:
Create thread
Terminate thread

Disassembly:
jmp 0x14001e170
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov esi, r8d
mov r9d, r8d
mov r8d, edx
mov ebx, edx
mov edx, ecx
mov edi, ecx
lea rcx, str.bWakeup_x__bDisconnect_x__ulstate_x
call fcn.140003224
mov rcx, qword [0x1400d4ac8]
xor ebp, ebp
mov dword [rsp + 0x50], ebp
test rcx, rcx
je 0x14001e1c8
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [0x1400d4ac8]
test eax, eax
cmove rcx, rbp
mov qword [0x1400d4ac8], rcx
test edi, edi
je 0x14001e209
lea rax, [rsp + 0x50]
mov dword [0x1400d44a0], esi
mov qword [rsp + 0x28], rax
lea r9, [0x1400d44a0]
lea r8, [0x14000194c]
mov dword [rsp + 0x20], ebp
xor edx, edx
mov dword [0x1400d44a4], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400d4ac8], rax
test ebx, ebx
je 0x14001e283
lea rcx, str.bBusDisconnetEvent_is_true
call fcn.140003224
cmp dword [0x1400d44a4], ebp
je 0x14001e27d
lea rcx, str.bWakeupEvent_is_true
call fcn.140003224
mov rcx, qword [0x1400d4ac8]
mov dword [0x1400d44a4], ebp
test rcx, rcx
je 0x14001e247
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x1400d4160], ebp
mov qword [0x1400d4ac8], rbp
je 0x14001e261
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400d44a0]
sub eax, 3
je 0x14001e278
cmp eax, 1
jne 0x14001e27d
call fcn.14000387d
jmp 0x14001e27d
call fcn.140003409
mov dword [0x1400d44a0], ebp
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001e2e0
Capabilities:
Read .ini file

Disassembly:
jmp 0x14001e2e0
sub rsp, 0x138
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor edx, edx
mov dword [rsp + 0x20], 0xe8
lea r9, [rsp + 0x30]
xor r8d, r8d
lea ecx, [rdx + 8]
call fcn.140001159
test eax, eax
jne 0x14001e3e0
cmp dword [rsp + 0x4c], eax
jne 0x14001e34a
call fcn.140001bf9
lea rcx, str.Lid_Close_action_is_None
call fcn.140003224
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x138
ret
lea rcx, str.Lid_Close_action_is_standby_hibernate_etc
call fcn.140003224
lea r9, [0x1400d4780]
mov r8d, 0xdead
lea rdx, str.Status
lea rcx, str.LidCloseBeep
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
je 0x14001e3ca
cmp eax, 0xdead
jne 0x14001e3a6
lea r9, [0x1400d4570]
mov r8d, eax
lea rdx, str.Status
lea rcx, str.LidCloseBeep
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
je 0x14001e3ca
lea rcx, str.Lid_Close_Beep_is_disabled
call fcn.140003224
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x138
ret
lea rcx, str.Lid_Close_Beep_is_enabled
call fcn.140003224
mov ecx, 1
call fcn.140002eaa
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x138
ret
Function at 0x14001e550
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001e550
sub rsp, 0x48
cmp dword [0x1400d415c], 0
jne 0x14001e578
call fcn.140002e28
test al, al
je 0x14001e56f
add rsp, 0x48
jmp fcn.14000263a
add rsp, 0x48
jmp fcn.140003409
call fcn.140002b76
test eax, eax
je 0x14001e66b
call fcn.140002e28
test al, al
jne 0x14001e653
lea rax, [rsp + 0x30]
mov dword [rsp + 0x58], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 0
lea rdx, str.SoftwareIBMIBMPM
mov dword [rsp + 0x68], 1
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001e61e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HibFileCreation
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x68], 0
je 0x14001e56f
xor r9d, r9d
mov byte [rsp + 0x50], 1
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
lea ecx, [r9 + 0xa]
call fcn.140001159
test eax, eax
jne 0x14001e56f
call fcn.140002b76
test eax, eax
je 0x14001e66b
xor edx, edx
xor ecx, ecx
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
add rsp, 0x48
ret

Function at 0x14001e870
Capabilities:
Create thread

Disassembly:
jmp 0x14001e870
sub rsp, 0x38
xor ecx, ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x14000228e]
xor r9d, r9d
mov dword [rsp + 0x20], ecx
xor edx, edx
mov dword [rsp + 0x40], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400d4778], rax
add rsp, 0x38
ret
Function at 0x140021100
Capabilities:
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
jmp 0x140021100
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xb60]
sub rsp, 0xc60
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rbp + 0xb50], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.140002eeb
movups xmm0, xmmword [str.SOFTWAREMicrosoft_]
xor edx, edx
mov r8d, 0x7d8
movups xmm1, xmmword [0x1400ac1a0]
lea rcx, [rbp + 0x378]
movaps xmmword [rbp + 0x350], xmm0
movsd xmm0, qword [0x1400ac1b0]
movsd qword [rbp + 0x370], xmm0
movaps xmmword [rbp + 0x360], xmm1
call fcn.140002eeb
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x200
call fcn.140002eeb
lea rdx, str.Windows_NTCurrentVersionProfileList_
mov dword [rsp + 0x30], 0x100
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x350]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400212c1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProfileImagePath
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400212c1
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.140002eeb
mov r8d, 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400212c1
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x140021281
lea rdx, str._ntuser.dat
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400212c1
lea edx, [rax + 1]
lea rcx, str.SeRestorePrivilege
call fcn.140001e0b
test eax, eax
je 0x1400212c1
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140002a31
test eax, eax
je 0x1400212c1
mov eax, 1
jmp 0x1400212c3
xor eax, eax
mov rcx, qword [rbp + 0xb50]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0xc78]
add rsp, 0xc60
pop rbp
ret
Function at 0x140021360
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140021360
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov edi, ecx
mov edx, ecx
lea rcx, str.Enter_MakeConnect__d_._n
call fcn.140003224
lea rcx, [rbp + 0x1f]
call fcn.14000288d
nop
xor esi, esi
mov r8d, esi
test edi, edi
setne r8b
xor r9d, r9d
mov edx, 0x222404
lea rcx, [rbp + 0x1f]
call fcn.140004647
test eax, eax
je 0x140021452
mov qword [rbp + 0xf], rsi
mov dword [rbp + 0x77], esi
mov ebx, 1
mov dword [rbp + 0x7f], ebx
mov dword [rbp + 0x67], esi
lea rdx, str.SoftwareIBMIBMPM
mov rcx, 0xffffffff80000002
test edi, edi
je 0x140021521
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140021452
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140021527
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 4]
xor r8d, r8d
lea rdx, str.CapaLidBeep
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xf]
test eax, eax
je 0x14002146b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, esi
lea rcx, [rbp + 0x1f]
call fcn.14000187a
mov eax, ebx
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [rbp + 0x67], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SvcCtrlCodeCapa
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xf]
test eax, eax
jne 0x14002144c
mov dword [rbp + 0xb], 4
mov dword [rbp + 7], 4
mov dword [rbp + 0x6f], ebx
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb]
xor r8d, r8d
lea rdx, str.HibFileCreation
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140021504
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.HibFileCreation
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
lea rcx, str.Exit:_MakeConnect___n
call fcn.140003224
jmp 0x140021454
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, edi
lea rcx, str.Exit:_MakeConnect___n
call fcn.140003224
jmp 0x140021454