joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023be0
Capabilities:
Set registry value

Disassembly:
jmp 0x140023be0
push rbx
sub rsp, 0x30
lea rcx, str.Inside_SetSystemScreenRotationStateTabletMode__._n
call fcn.140003224
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotation
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023c65
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov ebx, 1
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.Enable
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [rsp + 0x40]
lea rcx, str.SetSystemScreenRotationStateTabletMode__:_Enable_Auto_Rotation_:__d_n
call fcn.140003224
jmp 0x140023c71
lea rcx, str.Error_:_RegOpenKeyEx_:_SetSystemScreenRotationStateTabletMode__._n
call fcn.140003224
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140023c81
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140023cc0
Capabilities:
Write file on windows

Disassembly:
jmp 0x140023cc0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.Inside_SetSystemTransformation_n
call fcn.140003224
lea rcx, [0x1400a92d8]
call fcn.140002766
xor ebx, ebx
mov rbp, rax
mov byte [rsp + 0x68], bl
mov edi, ebx
mov esi, ebx
test rax, rax
je 0x140023d9e
mov rdx, rax
lea rcx, str.SetSystemTransformation_DevicePath____ws__n
call fcn.140003224
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140023d4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetSystemTransformation:_CreateFile_Error__08d__n
jmp 0x140023dab
movzx eax, byte [r14]
lea rdx, [rsp + 0x68]
xor r9d, r9d
mov byte [rsp + 0x68], al
mov rcx, rdi
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
jne 0x140023d86
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Inside_SetSystemTransformation:_WriteFile_Error__08d__n
jmp 0x140023dab
movzx edx, byte [rsp + 0x68]
lea rcx, str.SetSystemTransformation:_WriteFile_0x_08x__n
call fcn.140003224
mov esi, 1
jmp 0x140023db4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetSystemTransformation:_GetDevicePath_Error__08d__n
mov edx, eax
mov ebx, eax
call fcn.140003224
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140023dca
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_SetSystemTransformation:_Status__08d__n
call fcn.140003224
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140023e40
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140023e40
push rbx
sub rsp, 0x30
lea rcx, str.Inside_SetTNSPMode___n
call fcn.140003224
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCConfigurationsScreenRotation
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023ec5
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov ebx, 1
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.TNSPMode
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [rsp + 0x40]
lea rcx, str.SetTNSPMode__:_Enable_Tanner_BIOS_Flag_:__d_n
call fcn.140003224
jmp 0x140023ed1
lea rcx, str.Error_:_RegOpenKeyEx_:_SetTNSPMode__._n
call fcn.140003224
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140023ee1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140023f20
Capabilities:
Create thread

Disassembly:
jmp 0x140023f20
sub rsp, 0x38
lea rcx, str.StandbySystem__
call fcn.140003224
cmp dword [0x1400d415c], 0
jne 0x140023f96
xor edx, edx
lea r8, [0x1400d44a8]
xor r9d, r9d
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor edx, edx
mov dword [rsp + 0x40], 0
xor r9d, r9d
lea r8, [rsp + 0x40]
lea ecx, [rdx + 0x72]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [rsp + 0x40], 0
je 0x140023f7c
mov dword [0x1400d44a8], 0
jmp 0x140023f96
cmp dword [0x1400d44a8], 0
je 0x140023f96
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, [rsp + 0x40]
call fcn.14000103c
test al, al
je 0x140023feb
mov eax, dword [rsp + 0x40]
lea r9, [0x1400d4474]
or eax, 0xe0000000
lea r8, [0x140003751]
mov dword [0x1400d4474], eax
xor edx, edx
lea rax, [rsp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140023feb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x140024030
Capabilities:
Create thread

Disassembly:
jmp 0x140024030
sub rsp, 0x38
test ecx, ecx
je 0x140024076
cmp qword [0x1400d4988], 0
jne 0x14002409f
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea r8, [0x14000344a]
xor ecx, ecx
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400d4988], rax
add rsp, 0x38
ret
cmp qword [0x1400d4988], 0
je 0x140024096
mov rcx, qword [0x1400d49a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov qword [0x1400d4988], rax
add rsp, 0x38
jmp fcn.140003fcb
add rsp, 0x38
ret
Function at 0x140024470
Capabilities:
Write file on windows

Disassembly:
jmp 0x140024470
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rcx, [0x1400a92d8]
call fcn.140002766
xor ebx, ebx
mov rbp, rax
mov byte [rsp + 0x50], bl
mov edi, ebx
mov esi, ebx
test rax, rax
je 0x140024539
mov rdx, rax
lea rcx, str.ToggleConversionIndicator:_DevicePath____ws__n
call fcn.140003224
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400244f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.RotationLockButtonPress:_CreateFile_Error__08d__n
jmp 0x140024546
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x50]
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
jne 0x140024521
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ToggleConversionIndicator:_WriteFile_Error__08d__n
jmp 0x140024546
movzx edx, byte [rsp + 0x50]
lea rcx, str.ToggleConversionIndicator:_WriteFile_0x_08x__n
call fcn.140003224
mov esi, 1
jmp 0x14002454f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ToggleConversionIndicator:_GetDevicePath_Error__08d__n
mov edx, eax
mov ebx, eax
call fcn.140003224
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140024565
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Return_ToggleConversionIndicator:_Status__08d__n
call fcn.140003224
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140024c30
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140024c30
sub rsp, 0x38
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
call fcn.140004651
test eax, eax
je 0x140024c74
mov eax, dword [rsp + 0x40]
sub eax, 2
je 0x140024c6c
cmp eax, 1
je 0x140024c62
mov dword [rsp + 0x40], 0
jmp 0x140024c74
mov dword [rsp + 0x40], 2
jmp 0x140024c74
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024cde
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
lea r9d, [rax + 4]
mov rcx, qword [rsp + 0x48]
lea rdx, [0x1400a9c60]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140025890
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140025890
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
lea rcx, str.Enter_CopyTimeStampToPrev___n
call fcn.140003224
xor eax, eax
lea r9, [rsp + 0x34]
mov qword [rsp + 0x38], rax
lea rdx, str.ModeChangeTimeStamp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x68], ax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140025983
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x38]
mov rcx, rdi
lea rdx, str.ModeChangeTimeStamp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140025983
mov eax, dword [rsp + 0x30]
lea rdx, str.PrevTimeStamp
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x98], rsi
mov esi, 1
mov qword [rsp + 0x20], rax
mov r9d, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove ebx, esi
mov rsi, qword [rsp + 0x98]
lea rcx, str.Exit_CopyTimeStampToPrev___n
call fcn.140003224
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140025b40
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140025b40
push rbx
sub rsp, 0x50
xor ebx, ebx
mov dword [rsp + 0x70], 4
lea rcx, str.Enter_SystemTransformationCreateCurrentStatusToReg___n
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x60], ebx
call fcn.140003224
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140025bbd
lea rcx, str.Error_SystemTransformationCreateCurrentStatusToReg_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x140025c46
mov rdx, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x60]
call fcn.140003977
cmp dword [rsp + 0x68], 2
lea rdx, [0x1400b8128]
mov rcx, qword [rsp + 0x78]
jne 0x140025c07
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, str.SystemTransformationCreateCurrentStatusToReg___already_have_than_read_the_dwMultiMode_read_value:__x_n
jmp 0x140025c2f
mov eax, dword [rsp + 0x70]
mov r9d, 4
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, str.SystemTransformationCreateCurrentStatusToReg___Crelate_and_set_dwMultiMode_read_value:__x_n
mov edx, dword [rsp + 0x60]
call fcn.140003224
mov ecx, dword [rsp + 0x60]
call fcn.1400033f5
mov ebx, 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140025c56
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_SystemTransformationCreateCurrentStatusToReg___n
call fcn.140003224
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x140025f70
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140025f70
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov dword [rsp + 0x30], 0x80
xor ebx, ebx
mov dword [rsp + 0x34], 1
lea rcx, str.Enter_SystemTransformationCreateReg___n
mov qword [rsp + 0x38], rbx
call fcn.140003224
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140025ff6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_SystemTransformationCreateReg_RegCreateKeyEx_error____d_n
call fcn.140003224
jmp 0x140026060
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002603e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_SystemTransformationCreateReg_RegQueryValueEx_error____d_n
call fcn.140003224
jmp 0x140026060
lea rdx, [rsp + 0x40]
lea rcx, str.SystemTransformationCreateReg___already_have_than_read_the_dwCurrentSetting_read_value:__s_n
call fcn.140003224
lea rcx, [rsp + 0x40]
call fcn.140003bde
mov dword [rdi], eax
mov ebx, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140026070
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Exit_SystemTransformationCreateReg___n
call fcn.140003224
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140026170
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140026170
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x50
xor ebx, ebx
lea rcx, str.Enter_SystemTransformationSetCurrentStatusToReg___n
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x68], ebx
call fcn.140003224
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400261e1
lea rcx, str.Error_SystemTransformationSetCurrentStatusToReg_RegCreateKeyEx_error____n
call fcn.140003224
jmp 0x140026237
mov rdx, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x60]
call fcn.140003977
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, [0x1400b8128]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14002622e
lea rcx, str.Error_SystemTransformationSetCurrentStatusToReg_RegSetValueEx_error____n
call fcn.140003224
jmp 0x140026237
mov ecx, dword [rsp + 0x60]
call fcn.1400033f5
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140026247
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.SystemTransformationSetCurrentStatusToReg___n
call fcn.140003224
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x1400262a0
Capabilities:
Set registry value

Disassembly:
jmp 0x1400262a0
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, str.Enter_UpdateCurrentModeRegValue___n
call fcn.140003224
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CurrentMode
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
lea rcx, str.Exit_UpdateCurrentModeRegValue___n
test eax, eax
sete bl
call fcn.140003224
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140026320
Capabilities:
Set registry value

Disassembly:
jmp 0x140026320
mov dword [rsp + 8], ecx
sub rsp, 0x38
lea rcx, str.ENTER_UpdateDolbyMultimodeRegistry___n
call fcn.140003224
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREDolbyDAX
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400263b5
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.MultimodeFormFactor
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x1400263bc
test rcx, rcx
je 0x1400263a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.EXIT_Error_UpdateDolbyMultimodeRegistry___n
call fcn.140003224
xor eax, eax
add rsp, 0x38
ret
test rcx, rcx
je 0x1400263c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.EXIT_UpdateDolbyMultimodeRegistry___n
call fcn.140003224
mov eax, 1
add rsp, 0x38
ret
Function at 0x140026410
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140026410
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, str.Enter_UpdatePrevMultimode__._n
call fcn.140003224
xor eax, eax
lea r9, [rsp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rdx, [0x1400b8128]
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026504
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov rcx, rbx
lea rdx, [0x1400b8128]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026504
mov ecx, dword [rsp + 0x30]
lea r8d, [rax + 0xa]
lea rdx, [rsp + 0x40]
call fcn.140001b40
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0xa
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.PrevMode
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140026504
lea rcx, str.Exit_UpdatePrevMultimode__._n
call fcn.140003224
mov eax, 1
jmp 0x140026506
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001ec4
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140026660
Capabilities:
Set registry value

Disassembly:
jmp 0x140026660
push rbx
sub rsp, 0x70
mov rax, qword [0x1400d3008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rcx, str.Enter_UpdateTimeStampRegValue___n
call fcn.140003224
xor eax, eax
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
call fcn.140001bea
mov edx, 0x19
lea rcx, [rsp + 0x30]
call fcn.1400025e0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x19
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ModeChangeTimeStamp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, str.Exit_UpdateTimeStampRegValue___n
mov ebx, eax
call fcn.140003224
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001ec4
add rsp, 0x70
pop rbx
ret
Function at 0x140026990
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140026990
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 0x100
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140026a1b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemFamily
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140026a1b
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140026a10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400010a0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0xe0
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0xd8], rax
xor edi, edi
lea rcx, str.._rootme_kernel_01
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140004670], rax
cmp rax, 0xffffffffffffffff
jne 0x140001108
lea rcx, str.____Failed_to_open_a_handle_to_target_driver.
call fcn.140001040
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Writing_the_shellcode_to_the_memory_n
mov qword [rsp + 0xf0], rbx
call fcn.140001040
mov rcx, qword [0x140004670]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x58]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x10
mov r9d, 4
mov edx, 0x800
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x58], 0x3d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbx, qword [rsp + 0x68]
lea rcx, str.___shellcode_address:_0x_llx_n
mov rdx, rbx
call fcn.140001040
mov rcx, qword [0x140004670]
lea rax, [0x140004038]
xorps xmm0, xmm0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 0x30
mov r9d, 0x18
mov qword [rsp + 0x20], rax
mov edx, 0x802
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x50], 0x3d
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x58], edi
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x140004670]
lea rax, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x68]
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x28], 0x30
mov r9d, 8
mov qword [rsp + 0x20], rax
mov edx, 0x803
mov qword [rsp + 0x68], rbx
movups xmmword [rsp + 0xa8], xmm0
mov dword [rsp + 0x60], edi
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x140004670]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xf0]
xor eax, eax
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400012a0
add rsp, 0xe0
pop rdi
ret