joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a930
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebp, ebp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rbp
xor r9d, r9d
mov qword [rsp + 0x50], rbp
xor r8d, r8d
mov qword [rsp + 0x48], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov rsi, rcx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x60], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000aa6e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000aa6a
mov edi, ebp
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14001b960
mov qword [rsp + 0x38], rbp
lea r9, [rsp + 0x64]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x64], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000aa6e
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000aa6e
mov rcx, qword [rsp + 0x68]
call fcn.14000a930
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000aa5e
xor r9d, r9d
lea rdx, [rsp + 0x70]
mov r8d, 0x300
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
inc edi
cmp edi, dword [rsp + 0x60]
jb 0x14000a9c0
xor eax, eax
jmp 0x14000aa73
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140019b40
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000b990
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x10270
call fcn.140031bd0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x102b8], rbx
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x10260], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.14000d0c0
mov rax, qword [rsi]
mov qword [rsi + 8], rax
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x260]
call fcn.14001b960
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.14001b960
lea r14, [rsp + 0x260]
cmp qword [rdi + 0x18], 8
jb 0x14000ba1d
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x14000ba27
mov rbx, qword [rbx]
mov r9, rdi
mov r8d, 0x7fff
lea rdx, [rsp + 0x260]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov ebp, eax
xor r15d, r15d
mov edi, r15d
test eax, eax
je 0x14000bb5d
mov ebx, r15d
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r14]
mov eax, edi
movzx ecx, word [rsp + rax*2 + 0x260]
mov word [rsp + rbx*2 + 0x50], cx
test dx, dx
jne 0x14000bb4c
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r15w
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000baa0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.14000c900
nop
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14000bae8
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x28], r15w
add qword [rsi + 8], 0x20
jmp 0x14000bafa
lea r8, [rsp + 0x28]
mov rcx, rsi
call fcn.14000ca90
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000bb33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bb84
call fcn.140019b64
mov rbx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.14001b960
inc rbx
add r14, 2
inc edi
cmp edi, ebp
jb 0x14000ba60
mov rcx, qword [rsp + 0x10260]
xor rcx, rsp
call fcn.140019b40
mov rbx, qword [rsp + 0x102b8]
add rsp, 0x10270
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400219a8
int3
Function at 0x14000db40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x848
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.14001b960
lea rdi, [rsp + 0x868]
call fcn.140001030
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x7fffffff
mov rcx, qword [rax]
call fcn.140021464
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140019b40
add rsp, 0x848
pop rdi
pop rbx
ret
Function at 0x14000dbe0
Capabilities:
Query or enumerate registry value
Query service status
Start service
Stop service

Disassembly:
push rsi
sub rsp, 0x280
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x270], rax
movups xmm0, xmmword [str.SOFTWAREAtherosVistaAddOn]
mov esi, ecx
xor edx, edx
movups xmm1, xmmword [0x14003c468]
lea rcx, [rsp + 0x98]
mov r8d, 0x1d0
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x14003c478]
movaps xmmword [rsp + 0x70], xmm1
movsd xmm1, qword [0x14003c488]
movaps xmmword [rsp + 0x80], xmm0
movsd qword [rsp + 0x90], xmm1
call fcn.14001b960
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000de08
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.ControlBthServ
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000dcc7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000de08
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 1
jne 0x14000de08
mov r8d, esi
mov qword [rsp + 0x2a0], rdi
lea rdx, str.StartBthService___d___n
mov ecx, 1
call fcn.140019630
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000dd20
lea rdx, str.Open_Service_manager_error__n
lea ecx, [rax + 1]
call fcn.140019630
jmp 0x14000de00
mov r8d, 0x34
mov qword [rsp + 0x298], rbx
lea rdx, str.BthServ
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000dd63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Open_BthServ_Service_error:__d___n
lea ecx, [rbx + 1]
call fcn.140019630
jmp 0x14000ddef
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000dd84
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Get_Service_state_error:__d___n
jmp 0x14000ddd9
test esi, esi
jne 0x14000ddb3
cmp dword [rsp + 0x44], 4
jne 0x14000dde6
lea r8, [rsp + 0x40]
mov rcx, rbx
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000dde6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.stop_service_error:__d___n
jmp 0x14000ddd9
cmp dword [rsp + 0x44], 1
jne 0x14000dde6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000dde6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.start_service_error:__d___n
mov r8d, eax
mov ecx, 1
call fcn.140019630
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140019b40
add rsp, 0x280
pop rsi
ret
Function at 0x14000e3a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [str..ATHAMPFL]
lea rcx, [rsp + 0x50]
movzx eax, word [0x1400411a8]
movsd xmm1, qword [0x1400411a0]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x68], ax
movsd qword [rsp + 0x60], xmm1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e42d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ath_l2cap_disconnect_all__INVALID_HANDLE_VALUE_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000e487
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], edi
mov r9d, 8
mov edx, 0x2a0508
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x48], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000e47e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ath_l2cap_disconnect_all__error__x_n
call fcn.14000db40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140019b40
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x14000e4b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [str..ATHAMPFL]
lea rcx, [rsp + 0x48]
movzx eax, word [0x1400411a8]
movsd xmm1, qword [0x1400411a0]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
movups xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x60], ax
movsd qword [rsp + 0x58], xmm1
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e53e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ath_fake_disconnect_event__INVALID_HANDLE_VALUE_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000e599
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x2a0518
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000e584
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ath_fake_disconnect_event__error__x_n
call fcn.14000db40
jmp 0x14000e590
lea rcx, str.ath_fake_disconnect_event_success__n
call fcn.14000db40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140019b40
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14000fb30
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx ebx, cl
lea rcx, str.DisableBTENUMDevice_Start_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableBTENUMDevice_Start_n
mov ecx, 2
call fcn.140019630
cmp word [0x1400504b0], 0
lea rax, str.enable
mov qword [rsp + 0x30], rax
lea rdx, [0x1400504b0]
lea rax, str.disable
mov qword [rsp + 0x38], rax
lea rcx, str.argv2_5_:__s_n
lea rax, str.remove
mov qword [rsp + 0x40], rax
lea rax, str.BTHMS_BTHBRB
mov qword [rsp + 0x48], rax
lea rax, str.BTHMS_BTHLE
mov qword [rsp + 0x50], rax
lea rax, str.USBClass_E0
cmove rdx, rax
mov qword [rsp + 0x58], rdx
call fcn.14000db40
lea rax, str.BTHENUM
mov qword [rsp + 0x60], rax
lea rax, str.rescan
mov qword [rsp + 0x68], rax
test bl, bl
je 0x14000fc35
lea rcx, str.DisableBTENUMDevice__Enable_device_n
call fcn.14000db40
lea rdx, str.DisableBTENUMDevice__Enable_device_n
mov ecx, 2
call fcn.140019630
lea rax, [rsp + 0x58]
movzx ecx, bl
mov qword [rsp + 0x28], rax
call fcn.140007d50
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.radio_Rescan_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000fc82
lea rcx, str.DisableBTENUMDevice__Disable_device_n
call fcn.14000db40
lea rdx, str.DisableBTENUMDevice__Disable_device_n
mov ecx, 2
call fcn.140019630
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x28], rax
call fcn.140007d50
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14005039c], 0
jne 0x14000fc82
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.DisableBTENUMDevice_End_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableBTENUMDevice_End_n
mov ecx, 2
call fcn.140019630
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140019b40
add rsp, 0x80
pop rbx
ret
Function at 0x1400102a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, 0x2004
call fcn.140019b6c
mov rdi, rax
test rax, rax
je 0x140010398
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 0x2000
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140010370
mov r14, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140010390
cmp dword [rsp + 0x68], 7
jne 0x140010390
mov ebx, dword [rsp + 0x60]
mov rcx, rdi
call fcn.140019b64
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.140019b6c
mov rdi, rax
test rax, rax
je 0x140010398
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010304
mov ecx, dword [rsp + 0x60]
xor edx, edx
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], dx
mov rcx, rdi
mov word [rdi + rax*2], dx
call fcn.14000fee0
test rax, rax
jne 0x14001039a
mov rcx, rdi
call fcn.140019b64
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140013110
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov dword [rsp + 0x60], 1
mov rsi, rdx
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x68], 4
lea rdx, str.ForceHCResetOnResume
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___2_
mov ecx, 4
cmp eax, 2
sete dil
call fcn.140019630
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001326f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.ResetKeyAddded
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___3_
mov ecx, 4
call fcn.140019630
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.ResetKeyAddded
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x140013244
mov rcx, qword [rsp + 0x30]
lea rdx, str.ForceResetKey
mov dword [rsp + 0x28], 0x104
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ForceHCResetOnResume
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140013da0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x210
call fcn.14001b960
lea rcx, str.Enter_USBRootHubAndHCReset____n_n
call fcn.14000db40
lea rcx, [rsp + 0x20]
call fcn.1400137c0
test eax, eax
je 0x140013f72
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__dongle_status_is__d____n
call fcn.14000db40
mov edx, 1
mov dword [0x1400504a8], 1
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000db40
mov r8d, 1
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 1]
call fcn.140019630
call fcn.140009fa0
cmp eax, 0x32
jl 0x140013e60
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableRadioHandler__dont_send_check_msg_n
mov ecx, 2
call fcn.140019630
mov dword [0x14004ebc4], 1
mov ecx, dword [0x14004eba0]
xor r9d, r9d
mov edx, 0x5e5d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
xor edx, edx
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000db40
xor r8d, r8d
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 2]
call fcn.140019630
mov ecx, dword [0x14004eba0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.1400137c0
test eax, eax
je 0x140013f72
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_off_on_radio__dongle_status_is__d_n
call fcn.14000db40
cmp dword [rsp + 0x20], 1
je 0x140013f6b
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBRootHubReset__index_is__d____n
call fcn.14000db40
mov ecx, ebx
call fcn.140013520
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.1400137c0
test eax, eax
je 0x140013f72
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBRootHubReset__dongle_status_is__d____n
call fcn.14000db40
cmp dword [rsp + 0x20], 1
je 0x140013f6b
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBControllerReset__index_is__d____n
call fcn.14000db40
mov ecx, ebx
call fcn.140012db0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.1400137c0
test eax, eax
je 0x140013f72
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBControllerReset__dongle_status_is__d___n
call fcn.14000db40
mov eax, 1
jmp 0x140013f80
lea rcx, str.USBRootHubAndHCReset__GetBTAdapterStatus_failed____n
call fcn.14000db40
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140019b40
add rsp, 0x240
pop rbx
ret
Function at 0x140017c90
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor ecx, ecx
mov rax, rdi
cmp qword [rdi + 0x18], 8
mov qword [rdi + 0x10], rcx
jb 0x140017cc5
mov rax, qword [rdi]
mov word [rax], cx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x40]
cmp ax, 9
je 0x140017cec
cmp ax, 6
je 0x140017cec
mov ebx, dword [0x14004dce8]
jmp 0x140017cf7
mov ebx, 0xf013f
mov dword [0x14004dce8], ebx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14001b960
mov rcx, qword [0x14004dcf0]
lea rax, [rsp + 0x38]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
lea rdx, str.SOFTWAREAtherosVistaAddOn
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017db0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140017db0
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140017db0
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140017d91
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14000c900
mov eax, 1
jmp 0x140017db2
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140019b40
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret
Function at 0x1400191b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea rcx, [0x14004eb40]
xor r8d, r8d
xor edx, edx
lea r9d, [rbp + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rsi, rax
test rax, rax
je 0x1400192e2
xorps xmm0, xmm0
mov qword [rsp + 0x68], rdi
movups xmmword [rsp + 0x28], xmm0
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], 0x20
xor edx, edx
mov rcx, rax
mov edi, ebp
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400192d2
mov qword [rsp + 0x60], rbx
nop word [rax + rax]
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov dword [rsp + 0x24], 0xff
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.CFGMGR32.dll_CM_Get_DevNode_Status]
mov edx, eax
lea rcx, str.The_status_of_uResult_is__d__n
mov ebx, eax
call fcn.14000db40
mov edx, dword [rsp + 0x20]
lea rcx, str.The_status_of_uProblem_is__d__n
call fcn.14000db40
test ebx, ebx
je 0x1400192bb
xorps xmm0, xmm0
lea rcx, str.The_MemberIndex_of_SetupDiEnumDeviceInfo_is__d__n
movups xmmword [rsp + 0x28], xmm0
inc edi
mov dword [rsp + 0x28], 0x20
mov edx, edi
movups xmmword [rsp + 0x38], xmm0
call fcn.14000db40
lea r8, [rsp + 0x28]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140019230
jmp 0x1400192cd
lea rcx, str.This_device_is_3002_UART_dongle._n
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rdi, qword [rsp + 0x68]
mov eax, ebp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140019b40
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret