joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dc60
Capabilities:
Query or enumerate registry value
Query service status
Start service
Stop service

Disassembly:
push rsi
sub rsp, 0x280
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x270], rax
movups xmm0, xmmword [str.SOFTWAREAtherosVistaAddOn]
mov esi, ecx
xor edx, edx
movups xmm1, xmmword [0x14003ac28]
lea rcx, [rsp + 0x98]
mov r8d, 0x1d0
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x14003ac38]
movaps xmmword [rsp + 0x70], xmm1
movsd xmm1, qword [0x14003ac48]
movaps xmmword [rsp + 0x80], xmm0
movsd qword [rsp + 0x90], xmm1
call fcn.14001c790
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000de88
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.ControlBthServ
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000dd47
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000de88
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 1
jne 0x14000de88
mov r8d, esi
mov qword [rsp + 0x2a0], rdi
lea rdx, str.StartBthService___d___n
mov ecx, 1
call fcn.140018d20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000dda0
lea rdx, str.Open_Service_manager_error__n
lea ecx, [rax + 1]
call fcn.140018d20
jmp 0x14000de80
mov r8d, 0x34
mov qword [rsp + 0x298], rbx
lea rdx, str.BthServ
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000dde3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Open_BthServ_Service_error:__d___n
lea ecx, [rbx + 1]
call fcn.140018d20
jmp 0x14000de6f
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000de04
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Get_Service_state_error:__d___n
jmp 0x14000de59
test esi, esi
jne 0x14000de33
cmp dword [rsp + 0x44], 4
jne 0x14000de66
lea r8, [rsp + 0x40]
mov rcx, rbx
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000de66
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.stop_service_error:__d___n
jmp 0x14000de59
cmp dword [rsp + 0x44], 1
jne 0x14000de66
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000de66
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.start_service_error:__d___n
mov r8d, eax
mov ecx, 1
call fcn.140018d20
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140019260
add rsp, 0x280
pop rsi
ret
Function at 0x14000e450
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [str..ATHAMPFL]
lea rcx, [rsp + 0x50]
movzx eax, word [0x14003f698]
movsd xmm1, qword [0x14003f690]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x68], ax
movsd qword [rsp + 0x60], xmm1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e4dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ath_l2cap_disconnect_all__INVALID_HANDLE_VALUE_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000e537
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], edi
mov r9d, 8
mov edx, 0x2a0508
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x48], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000e52e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ath_l2cap_disconnect_all__error__x_n
call fcn.14000db40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140019260
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x14000e560
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [str..ATHAMPFL]
lea rcx, [rsp + 0x48]
movzx eax, word [0x14003f698]
movsd xmm1, qword [0x14003f690]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
movups xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x60], ax
movsd qword [rsp + 0x58], xmm1
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e5ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ath_fake_disconnect_event__INVALID_HANDLE_VALUE_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000e649
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x2a0518
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000e634
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ath_fake_disconnect_event__error__x_n
call fcn.14000db40
jmp 0x14000e640
lea rcx, str.ath_fake_disconnect_event_success__n
call fcn.14000db40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140019260
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14000faa0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx ebx, cl
lea rcx, str.DisableBTENUMDevice_Start_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableBTENUMDevice_Start_n
mov ecx, 2
call fcn.140018d20
cmp word [0x14004d7b0], 0
lea rax, str.enable
mov qword [rsp + 0x30], rax
lea rdx, [0x14004d7b0]
lea rax, str.disable
mov qword [rsp + 0x38], rax
lea rcx, str.argv2_5_:__s_n
lea rax, str.remove
mov qword [rsp + 0x40], rax
lea rax, str.BTHMS_BTHBRB
mov qword [rsp + 0x48], rax
lea rax, str.BTHMS_BTHLE
mov qword [rsp + 0x50], rax
lea rax, str.USBClass_E0
cmove rdx, rax
mov qword [rsp + 0x58], rdx
call fcn.14000db40
lea rax, str.BTHENUM
mov qword [rsp + 0x60], rax
lea rax, str.rescan
mov qword [rsp + 0x68], rax
test bl, bl
je 0x14000fba5
lea rcx, str.DisableBTENUMDevice__Enable_device_n
call fcn.14000db40
lea rdx, str.DisableBTENUMDevice__Enable_device_n
mov ecx, 2
call fcn.140018d20
lea rax, [rsp + 0x58]
movzx ecx, bl
mov qword [rsp + 0x28], rax
call fcn.140007450
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.radio_Rescan_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000fbf2
lea rcx, str.DisableBTENUMDevice__Disable_device_n
call fcn.14000db40
lea rdx, str.DisableBTENUMDevice__Disable_device_n
mov ecx, 2
call fcn.140018d20
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x28], rax
call fcn.140007450
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14004d7a0], 0
jne 0x14000fbf2
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.DisableBTENUMDevice_End_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableBTENUMDevice_End_n
mov ecx, 2
call fcn.140018d20
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140019260
add rsp, 0x80
pop rbx
ret

Function at 0x14000fd10
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000fd9e
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x14000fd98
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x44], rax
xor r9d, r9d
xor eax, eax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 0x80010002
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140019260
add rsp, 0x68
ret
Function at 0x140010300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, 0x1002
mov eax, 2
mul rcx
mov r14, 0xffffffffffffffff
cmovo rax, r14
mov rcx, rax
call fcn.14001928c
mov rdi, rax
test rax, rax
jne 0x140010349
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov dword [rsp + 0x60], 0x2000
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400103ec
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14001040c
cmp dword [rsp + 0x68], 7
jne 0x14001040c
mov ebx, dword [rsp + 0x60]
mov rcx, rdi
call fcn.140019284
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.14001928c
mov rdi, rax
test rax, rax
je 0x140010414
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010380
mov ecx, dword [rsp + 0x60]
xor edx, edx
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], dx
mov rcx, rdi
mov word [rdi + rax*2], dx
call fcn.14000ff10
test rax, rax
jne 0x140010416
mov rcx, rdi
call fcn.140019284
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140012f90
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x60
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
lea rdx, str.Enter_EnumerateHostController___n
mov rbx, rcx
mov dword [rsp + 0x40], ebp
mov esi, ebp
lea ecx, [rbp + 2]
call fcn.140018d20
lea rcx, str.Enter_EnumerateHostController___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x44]
mov dword [rsp + 0x28], 6
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x220408
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14001301b
lea rcx, str.Enter_if___DeviceIoControl_sizeof_rootHubName___nBytes__NULL___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x14001314c
mov eax, dword [rsp + 0x44]
mov ecx, eax
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x40], eax
call fcn.140020fe0
mov r14, rax
test rax, rax
jne 0x14001304e
lea rcx, str.Enter_if__rootHubNameW__NULL__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x140013144
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov eax, dword [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x220408
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140013094
lea rcx, str.Enter_if___DeviceIoControl_nBytes__nBytes__NULL___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14001310f
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x88], rdi
mov rcx, rbx
cmp word [r14 + rcx*2 + 6], si
lea rcx, [rcx + 1]
jne 0x1400130a3
lea rcx, [rcx*2 + 0xa]
call fcn.140020fe0
mov rsi, rax
test rax, rax
je 0x140013107
lea r8, str.._
mov edx, 5
mov rcx, rax
call fcn.140020ee4
nop dword [rax + rax]
cmp word [r14 + rbx*2 + 6], bp
lea rbx, [rbx + 1]
jne 0x1400130e0
lea rdx, [rbx + 1]
lea rcx, [rsi + 8]
lea r8, [r14 + 4]
call fcn.140020ee4
mov rcx, rsi
call fcn.140012a80
mov ebp, eax
mov rdi, qword [rsp + 0x88]
mov rcx, r14
call fcn.140020fcc
test rsi, rsi
je 0x140013124
mov rcx, rsi
call fcn.140020fcc
lea rdx, str.Leave_EnumerateHostController___n
mov ecx, 2
call fcn.140018d20
lea rcx, str.Leave_EnumerateHostController___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebp
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140019260
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
Function at 0x140013670
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov dword [rsp + 0x60], 1
mov rsi, rdx
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x68], 4
lea rdx, str.ForceHCResetOnResume
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___2_
mov ecx, 4
cmp eax, 2
sete dil
call fcn.140018d20
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400137cf
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.ResetKeyAddded
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___3_
mov ecx, 4
call fcn.140018d20
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.ResetKeyAddded
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x1400137a4
mov rcx, qword [rsp + 0x30]
lea rdx, str.ForceResetKey
mov dword [rsp + 0x28], 0x104
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ForceHCResetOnResume
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140014230
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x40], 0xffffffff
mov rbx, rcx
mov dword [rsp + 0x48], 4
test rcx, rcx
jne 0x140014257
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400142ed
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400142da
mov r8d, dword [rsp + 0x40]
lea rdx, str.Read__d_from_reg__s__n
mov r9, rbx
lea ecx, [rax + 2]
call fcn.140018d20
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x40], 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x140014300
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov r8d, ecx
lea r9, str.ControllerIndex
mov ecx, 2
lea rdx, str.Set_value__d_into_reg__s__n
call fcn.140018d20
lea rax, [rsp + 0x48]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAtherosVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001438b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.ControllerIndex
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x140014390
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x210
call fcn.14001c790
lea rcx, str.Enter_USBRootHubAndHCReset____n_n
call fcn.14000db40
lea rcx, [rsp + 0x20]
call fcn.140013ea0
test eax, eax
jne 0x1400143ec
lea rcx, str.USBRootHubAndHCReset__GetBTAdapterStatus_failed____n
call fcn.14000db40
xor eax, eax
jmp 0x140014577
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__dongle_status_is__d____n
call fcn.14000db40
mov edx, 1
mov dword [0x14004d7ac], 1
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000db40
mov r8d, 1
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 1]
call fcn.140018d20
call fcn.1400097d0
cmp eax, 0x32
jl 0x14001445f
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableRadioHandler__dont_send_check_msg_n
mov ecx, 2
call fcn.140018d20
mov dword [0x14004be94], 1
mov ecx, dword [0x14004be70]
xor r9d, r9d
mov edx, 0x5e5d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
xor edx, edx
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000db40
xor r8d, r8d
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 2]
call fcn.140018d20
mov ecx, dword [0x14004be70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140013ea0
test eax, eax
je 0x1400143d9
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_off_on_radio__dongle_status_is__d_n
call fcn.14000db40
cmp dword [rsp + 0x20], 1
je 0x140014572
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBRootHubReset__index_is__d____n
call fcn.14000db40
mov ecx, ebx
call fcn.140013c90
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140013ea0
test eax, eax
je 0x1400143d9
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBRootHubReset__dongle_status_is__d____n
call fcn.14000db40
cmp dword [rsp + 0x20], 1
je 0x140014572
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBControllerReset__index_is__d____n
call fcn.14000db40
mov ecx, ebx
call fcn.140013300
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140013ea0
test eax, eax
je 0x1400143d9
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBControllerReset__dongle_status_is__d___n
call fcn.14000db40
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140019260
add rsp, 0x240
pop rbx
ret
Function at 0x140015070
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x4b0
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
lea rcx, str.Enter_function_CheckAndRecoverDevice___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.Enter_function_CheckAndRecoverDevice___n
mov ecx, 2
call fcn.140018d20
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x210
call fcn.14001c790
movaps xmm0, xmmword [str.SOFTWAREAtherosVistaAddOnSupportedDevice]
lea rcx, [rsp + 0xc8]
movaps xmm1, xmmword [0x14003e530]
xor edx, edx
movaps xmmword [rsp + 0x70], xmm0
mov r8d, 0x1b0
movaps xmm0, xmmword [0x14003e540]
movaps xmmword [rsp + 0x80], xmm1
movaps xmm1, xmmword [0x14003e550]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x14003e560]
movaps xmmword [rsp + 0xa0], xmm1
movsd xmm1, qword [0x14003e570]
movaps xmmword [rsp + 0xb0], xmm0
movsd qword [rsp + 0xc0], xmm1
call fcn.14001c790
lea rax, str.hwids
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x490], rax
mov r9d, 2
lea rax, str.bluetooth
mov dword [rsp + 0x44], 0x11
mov qword [rsp + 0x498], rax
xor edx, edx
lea rax, str._USB
mov r8d, r9d
mov qword [rsp + 0x4a0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [0x140006850]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x498]
mov qword [rsp + 0x20], rax
call fcn.1400105e0
mov ebx, 1
test eax, eax
jne 0x1400151de
mov ecx, ebx
cmp dword [rsp + 0x40], eax
jne 0x1400151c4
call fcn.140021108
mov rcx, rax
xor r8d, r8d
mov edx, 0xebf3
call fcn.14000fc30
jmp 0x1400151de
call fcn.140021108
mov r8d, dword [rsp + 0x40]
mov rcx, rax
xor r9d, r9d
mov edx, 0xebf5
call fcn.14000fc30
lea rcx, str.Finish_getting_hwid._n
call fcn.14000db40
lea rdx, str.Finish_getting_hwid._n
mov ecx, 2
call fcn.140018d20
call fcn.140014ec0
mov dword [rsp + 0x280], eax
test eax, eax
je 0x14001523d
lea rdx, [0x14004d7b0]
lea rcx, str.CheckAndRecoverDevice_Find_Dongle_is__s._n
call fcn.14000db40
lea r8, [0x14004d7b0]
mov ecx, 2
lea rdx, str.CheckAndRecoverDevice_Find_Dongle_is__s._n
call fcn.140018d20
mov eax, dword [rsp + 0x280]
cmp eax, 2
jne 0x140015272
lea rcx, str.Status.configStatus__DeviceNotConfigurate_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.Status.configStatus__DeviceNotConfigurate_n
mov ecx, 2
call fcn.140018d20
inc dword [0x14004be90]
mov dword [0x14004be8c], 0
jmp 0x140015284
inc dword [0x14004be8c]
xor ebx, ebx
mov dword [0x14004be90], 0
lea rcx, [rsp + 0x280]
call fcn.140014590
lea rcx, str.Leave_function_CheckAndRecoverDevice___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.Leave_function_CheckAndRecoverDevice___n
mov ecx, 2
call fcn.140018d20
mov eax, ebx
mov rcx, qword [rsp + 0x4a8]
xor rcx, rsp
call fcn.140019260
add rsp, 0x4b0
pop rbx
ret
Function at 0x1400152d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Software_atherosVistaAddon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140015306
xor al, al
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HidePBAP
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x140015362
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], 1
setne al
add rsp, 0x38
ret