joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400031f2
Capabilities:
Set registry value

Disassembly:
jmp 0x140023be0
push rbx
sub rsp, 0x30
lea rcx, str.Inside_SetSystemScreenRotationStateTabletMode__._n
call fcn.140003224
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotation
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023c65
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov ebx, 1
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.Enable
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [rsp + 0x40]
lea rcx, str.SetSystemScreenRotationStateTabletMode__:_Enable_Auto_Rotation_:__d_n
call fcn.140003224
jmp 0x140023c71
lea rcx, str.Error_:_RegOpenKeyEx_:_SetSystemScreenRotationStateTabletMode__._n
call fcn.140003224
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140023c81
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140003247
Capabilities:
Set registry value

Disassembly:
jmp 0x140022ea0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, rcx
xor esi, esi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x58], rsi
xor edx, edx
mov dword [rsp + 0x50], esi
mov r8d, 0x208
call fcn.140002eeb
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call fcn.140002eeb
cmp dword [0x1400d415c], esi
lea ebx, [rsi + 1]
lea rcx, [rsp + 0x60]
je 0x140022f1f
lea rdx, str..DEFAULTControl_PanelPowerCfgGlobalPowerPolicy
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, 0xffffffff80000003
jmp 0x140022f33
lea rdx, str.Control_PanelPowerCfgGlobalPowerPolicy
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, 0xffffffff80000001
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140022f71
xor al, al
jmp 0x140022fc2
lea rdx, str.Policies
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x270]
mov r9d, 3
mov dword [rsp + 0x28], 0xb0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140001ec4
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400033f5
Capabilities:
Set registry value

Disassembly:
jmp 0x140026320
mov dword [rsp + 8], ecx
sub rsp, 0x38
lea rcx, str.ENTER_UpdateDolbyMultimodeRegistry___n
call fcn.140003224
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREDolbyDAX
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400263b5
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.MultimodeFormFactor
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x1400263bc
test rcx, rcx
je 0x1400263a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.EXIT_Error_UpdateDolbyMultimodeRegistry___n
call fcn.140003224
xor eax, eax
add rsp, 0x38
ret
test rcx, rcx
je 0x1400263c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.EXIT_UpdateDolbyMultimodeRegistry___n
call fcn.140003224
mov eax, 1
add rsp, 0x38
ret

Function at 0x140003440
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x1400237c0
sub rsp, 0x38
lea rcx, str.Inside_SetLastSystemTransformationTabletMode__._n
call fcn.140003224
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002383e
mov rcx, qword [rsp + 0x48]
lea rdx, str.LastSystemTransformation
mov dword [rsp + 0x40], eax
mov r9d, 4
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [rsp + 0x40]
lea rcx, str.SetLastSystemTransformationTabletMode___:_Set_last_system_status_0x00000000__in_Tablet_Mode_:__d_n
call fcn.140003224
jmp 0x14002384a
lea rcx, str.Error_:_RegOpenKeyEx_:_SetLastSystemTransformationTabletMode__._n
call fcn.140003224
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002385a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400034ef
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x1400236e0
push rbx
sub rsp, 0x30
lea rcx, str.Inside_SetLastSystemTransformationNotebookMode__._n
call fcn.140003224
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCStatus
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023765
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov ebx, 1
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.LastSystemTransformation
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [rsp + 0x40]
lea rcx, str.SetLastSystemTransformationNotebookMode___:_Set_last_system_status_0x00000001__in_Notebook_Mode:__d_n
call fcn.140003224
jmp 0x140023771
lea rcx, str.Error_:_RegOpenKeyEx_:_SetLastSystemTransformationNotebookMode__._n
call fcn.140003224
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140023781
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1400035bc
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14000ed60
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
mov dword [rax + 0x18], 4
xor ebx, ebx
mov dword [rax + 0x10], 0x14
lea rcx, str.Enter_IntelligentCoolingCreateInitTimeFromReg___n
mov qword [rax - 0x18], rbx
mov dword [rax + 0x20], ebx
call fcn.140003224
cmp dword [0x1400d4158], ebx
jne 0x14000edab
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___does_not_support_system_n
call fcn.140003224
jmp 0x14000eea4
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000ee02
lea rcx, str.Error_IntelligentCoolingCreateInitTimeFromReg_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x14000eea4
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.INIT
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ee47
mov edx, dword [rsp + 0x78]
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___already_have_than_read_the_value_read_value:__x_n
call fcn.140003224
jmp 0x14000ee99
mov eax, dword [rsp + 0x80]
lea rdx, str.INIT
mov rcx, qword [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000ee8d
mov edx, dword [rsp + 0x78]
lea rcx, str.IntelligentCoolingCreateInitTimeFromReg___Set_Key_value_read_value:__x_n
call fcn.140003224
jmp 0x14000ee99
lea rcx, str.Error_IntelligentCoolingCreateInitTimeFromReg___Connot_set_value:_n
call fcn.140003224
mov eax, dword [rsp + 0x78]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000eeb4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_IntelligentCoolingCreateInitTimeFromReg___n
call fcn.140003224
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14000374c
Capabilities:
Read file on windows

Disassembly:
jmp 0x14001d9e0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_GetSystemTransformation_n
call fcn.140003224
xor ebx, ebx
lea rcx, [0x1400a92d8]
mov edi, ebx
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], ebx
mov esi, ebx
call fcn.140002766
mov rbp, rax
test rax, rax
je 0x14001dabc
mov rdx, rax
lea rcx, str.GetSystemTransformation:_DevicePath____ws__n
call fcn.140003224
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001da73
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_CreateFile_Error__08d__n
jmp 0x14001dac9
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x14001daa6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_ReadFile_Error__08d__n
jmp 0x14001dac9
movzx edx, byte [rsp + 0x68]
lea rcx, str.GetSystemTransformation:_ReadFile_0x_08x__n
mov dword [r14], edx
mov esi, 1
jmp 0x14001dacd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemTransformation:_GetDevicePath_Error__08d__n
mov ebx, eax
mov edx, eax
call fcn.140003224
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14001dae8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_GetSystemTransformation:_Status__08d__n
call fcn.140003224
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400037e2
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
jmp 0x140021100
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xb60]
sub rsp, 0xc60
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rbp + 0xb50], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.140002eeb
movups xmm0, xmmword [str.SOFTWAREMicrosoft_]
xor edx, edx
mov r8d, 0x7d8
movups xmm1, xmmword [0x1400ac1a0]
lea rcx, [rbp + 0x378]
movaps xmmword [rbp + 0x350], xmm0
movsd xmm0, qword [0x1400ac1b0]
movsd qword [rbp + 0x370], xmm0
movaps xmmword [rbp + 0x360], xmm1
call fcn.140002eeb
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x200
call fcn.140002eeb
lea rdx, str.Windows_NTCurrentVersionProfileList_
mov dword [rsp + 0x30], 0x100
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x350]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400212c1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProfileImagePath
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400212c1
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.140002eeb
mov r8d, 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400212c1
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x140021281
lea rdx, str._ntuser.dat
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400212c1
lea edx, [rax + 1]
lea rcx, str.SeRestorePrivilege
call fcn.140001e0b
test eax, eax
je 0x1400212c1
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140002a31
test eax, eax
je 0x1400212c1
mov eax, 1
jmp 0x1400212c3
xor eax, eax
mov rcx, qword [rbp + 0xb50]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0xc78]
add rsp, 0xc60
pop rbp
ret
Function at 0x14000387d
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001e550
sub rsp, 0x48
cmp dword [0x1400d415c], 0
jne 0x14001e578
call fcn.140002e28
test al, al
je 0x14001e56f
add rsp, 0x48
jmp fcn.14000263a
add rsp, 0x48
jmp fcn.140003409
call fcn.140002b76
test eax, eax
je 0x14001e66b
call fcn.140002e28
test al, al
jne 0x14001e653
lea rax, [rsp + 0x30]
mov dword [rsp + 0x58], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 0
lea rdx, str.SoftwareIBMIBMPM
mov dword [rsp + 0x68], 1
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001e61e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HibFileCreation
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x68], 0
je 0x14001e56f
xor r9d, r9d
mov byte [rsp + 0x50], 1
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
lea ecx, [r9 + 0xa]
call fcn.140001159
test eax, eax
jne 0x14001e56f
call fcn.140002b76
test eax, eax
je 0x14001e66b
xor edx, edx
xor ecx, ecx
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
add rsp, 0x48
ret

Function at 0x1400038dc
Capabilities:
Parse pe header

Disassembly:
jmp 0x14005ee18
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14005eb6c

Function at 0x140003963
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140032390
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400bb320]
mov edi, ecx
lea rdx, [0x1400bb328]
mov ecx, 3
lea r8, [0x1400bb318]
call fcn.140031ce8
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400323d0
call qword [case.0x140027caa.0]
jmp 0x1400323d6
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400039ae
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1400186d0
sub rsp, 0x38
lea rcx, str.ENTER_GetPMDRVInstallStatus__
call fcn.140003224
lea rax, [rsp + 0x50]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVC
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018747
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, str.Owners
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001874e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret
mov rax, qword gs:[0x58]
mov ecx, dword [0x1400d4bc0]
mov edx, 0x104
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1400d446c], eax
jg 0x1400187dd
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
mov rax, qword [0x1400d4460]
lea rdx, str.Owners
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x140018741
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1400d4460]
call fcn.140003b98
lea rcx, str.EXIT_GetPMDRVInstallStatus__
movzx ebx, al
call fcn.140003224
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rcx, [0x1400d446c]
call fcn.14000380f
cmp dword [0x1400d446c], 0xffffffff
jne 0x140018771
movzx ecx, byte [rsp + 0x40]
call fcn.140003710
lea rcx, [0x1400d446c]
mov qword [0x1400d4460], rax
call fcn.140002ec3
jmp 0x140018771
Function at 0x140003b98
Capabilities:
Check if file exists
Get common file path

Disassembly:
jmp 0x140018a20
push rbx
sub rsp, 0x460
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
lea rcx, str.ENTER_IsINFFileExits__
call fcn.140003224
cmp word [rbx], 0
je 0x140018b0c
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140002eeb
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8024
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140018b33
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.140002eeb
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
lea r8, str._lsINF_ls
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.14000441c
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140018b33
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140018af0
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x140018a60
lea rcx, str.EXIT_IsINFFileExists__
call fcn.140003224
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x460
pop rbx
ret
mov al, 1
jmp 0x140018b1a

Function at 0x140003c65
Capabilities:
Set registry value

Disassembly:
jmp 0x140023b00
push rbx
sub rsp, 0x30
lea rcx, str.Inside_SetSystemScreenRotationStateNotebookMode__._n
call fcn.140003224
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotation
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023b85
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Enable
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [rsp + 0x40]
lea rcx, str.SetSystemScreenRotationStateNotebookMode__:_Disable_Auto_Rotation_:__d_n
call fcn.140003224
mov ebx, 1
jmp 0x140023b91
lea rcx, str.Error_:_RegOpenKeyEx_:_SetSystemScreenRotationStateNotebookMode__._n
call fcn.140003224
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140023ba1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140003cba
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140022b20
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x7a0]
sub rsp, 0x8a0
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rbp + 0x790], rax
xor eax, eax
mov rbx, rdx
mov edi, ecx
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], eax
lea rcx, [rbp + 0x160]
mov dword [rsp + 0x40], eax
mov r8d, 0x208
call fcn.140002eeb
xor edx, edx
lea rcx, [rbp + 0x580]
mov r8d, 0x208
call fcn.140002eeb
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140002eeb
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x208
call fcn.140002eeb
cmp dword [0x1400d415c], 0
je 0x140022c31
lea rcx, [rbp + 0x370]
call fcn.140003a3f
mov r9d, edi
lea r8, [rbp + 0x370]
lea rdx, str._lsControl_PanelPowerCfgPowerPolicies_d
lea rcx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x160]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140022c73
xor al, al
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.140001ec4
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov r8d, edi
lea rdx, str.Control_PanelPowerCfgPowerPolicies_d
lea rcx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x160]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022c0b
lea rdx, str.Policies
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x580]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022c0b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movaps xmm0, xmmword [rsp + 0x50]
mov al, 1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rbx + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x80]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x70]
movups xmmword [rbx + 0x30], xmm1
movaps xmm1, xmmword [rbp - 0x60]
movups xmmword [rbx + 0x40], xmm0
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rbx + 0x50], xmm1
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x70], xmm1
movups xmmword [rbx + 0x80], xmm0
jmp 0x140022c0d
Function at 0x140003e9f
Capabilities:
Get common file path

Disassembly:
jmp 0x1400183a0
push rbx
sub rsp, 0x250
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140002eeb
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8025
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400183f5
xor al, al
jmp 0x14001842b
lea rax, str.IBMPMDRV.INF
mov edx, 0x104
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str._ls_ls
mov rcx, rbx
call fcn.14000441c
mov rdx, rbx
lea rcx, str.GetINFPath:__ls
call fcn.140003224
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x250
pop rbx
ret

Function at 0x140003f26
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x1400143e0
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x50
xor ebx, ebx
lea rcx, str.Enter_SetIntelligentCoolingCurrentStatus___n
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x68], ebx
call fcn.140003224
cmp dword [0x1400d4158], ebx
jne 0x140014419
lea rcx, str.GetIntelligentCoolingCurrentStatus___does_not_support_n
call fcn.140003224
jmp 0x1400144dc
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCICTParameters
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001446a
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x1400144dc
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400144a9
lea rcx, str.Error_SetIntelligentCoolingCurrentStatus_RegSetValueEx_error____n
call fcn.140003224
jmp 0x1400144dc
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400144c9
cmp eax, 1
jne 0x1400144dc
lea rcx, str.SetIntelligentCoolingSetCurrentStatusToReg___Mode_Enable_n
call fcn.140003224
call fcn.140001f82
jmp 0x1400144da
lea rcx, str.SetIntelligentCoolingSetCurrentStatusToReg___Set_System_settings_Nominal_n
call fcn.140003224
call fcn.1400020bd
mov ebx, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400144ec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.SetIntelligentCoolingCurrentStatus___n
call fcn.140003224
mov eax, ebx
add rsp, 0x50
pop rbx
ret