joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c850
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx]
mov r11, rdx
test r10, r10
jne 0x14002c882
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
xor ecx, ecx
mov dword [rsp + 0x50], ecx
test r9, r9
jne 0x14002c8f3
mov dword [rsp + 0x48], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [r10 + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rcx
mov rcx, qword [r10 + 8]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jns 0x14002c8dd
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__AES_BCryptEncrypt_get_size_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002c96e
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
mov edx, dword [rsp + 0x90]
test edx, edx
jle 0x14002c962
lfence
mov rax, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
mov dword [rsp + 0x48], 1
movups xmm0, xmmword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov rdx, r11
mov qword [rsp + 0x30], r9
xor r9d, r9d
movups xmmword [rcx], xmm0
mov rax, qword [r10 + 0x18]
mov rcx, qword [r10 + 8]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jns 0x14002c8dd
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__AES_BCryptEncrypt_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002c96e
lea rcx, str._AsusSync_CNG__CNG_AES_CBC_256::Encrypt__Wrong_parameter_n
call fcn.140095ab0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
Function at 0x14002c990
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx]
mov r11, rdx
test r10, r10
jne 0x14002c9c2
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
xor ecx, ecx
mov dword [rsp + 0x50], ecx
test r9, r9
jne 0x14002ca33
mov dword [rsp + 0x48], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [r10 + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rcx
mov rcx, qword [r10 + 8]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jns 0x14002ca1d
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__BCryptDecrypt_get_size_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002caae
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
mov edx, dword [rsp + 0x90]
test edx, edx
jle 0x14002caa2
lfence
mov rax, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
mov dword [rsp + 0x48], 1
movups xmm0, xmmword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov rdx, r11
mov qword [rsp + 0x30], r9
xor r9d, r9d
movups xmmword [rcx], xmm0
mov rax, qword [r10 + 0x18]
mov rcx, qword [r10 + 8]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jns 0x14002ca1d
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__BCryptDecrypt_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002caae
lea rcx, str._AsusSync_CNG__CNG_AES_CBC_256::Decrypt__Wrong_parameter_n
call fcn.140095ab0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret

Function at 0x14002cad0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x14002cadc
xor eax, eax
ret
jmp fcn.14002d810
Function at 0x14002d710
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r11d, r11d
mov dword [rsp + 0x50], r11d
test r9, r9
jne 0x14002d777
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 2
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r11d
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r11
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jns 0x14002d7ce
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__RSA_BCryptEncrypt_get_size_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002d7f0
mov eax, dword [rsp + 0x90]
test eax, eax
jle 0x14002d7e4
lfence
mov rcx, qword [rcx + 8]
lea r10, [rsp + 0x50]
mov dword [rsp + 0x48], 2
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], r9
xor r9d, r9d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r11
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jns 0x14002d7ce
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__RSA_BCryptEncrypt_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002d7f0
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
lea rcx, str.Wrong_parameter_n
call fcn.14002d910
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret

Function at 0x14002d810
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r11d, r11d
mov dword [rsp + 0x50], r11d
test r9, r9
jne 0x14002d877
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 2
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r11d
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r11
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jns 0x14002d8ce
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__RSA_BCryptDecrypt_get_size_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002d8f0
mov eax, dword [rsp + 0x90]
test eax, eax
jle 0x14002d8e4
lfence
mov rcx, qword [rcx + 8]
lea r10, [rsp + 0x50]
mov dword [rsp + 0x48], 2
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], r9
xor r9d, r9d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r11
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jns 0x14002d8ce
lfence
mov edx, eax
lea rcx, str._AsusSync_CNG__RSA_BCryptDecrypt_Failed__Error_0x_x_n
call fcn.140095ab0
jmp 0x14002d8f0
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
lea rcx, str.Wrong_parameter_n
call fcn.14002d910
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x68
ret
Function at 0x14002f680
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rcx, str._AsusSync_CommDev__EnterAdvancedMode_n
call fcn.140095ab0
xor ebp, ebp
cmp qword [rbx + 0x118], rbp
je 0x14002f6ed
lea rcx, str._AsusSync_CommDev__EnterAdvancedMode___remote_device_is_connected_to_BT_rfcomm_server_actively__BT_rfcomm_client_can_now_be_removed._n
call fcn.140095ab0
mov rcx, qword [rbx + 0x118]
test rcx, rcx
je 0x14002f6e6
call fcn.14002f890
mov qword [rbx + 0x118], rbp
mov qword [rbx + 0x1e0], rdi
cmp qword [rbx + 0x120], rbp
je 0x14002f721
lea rcx, str._AsusSync_CommDev__EnterAdvancedMode___Remove_last_BT_connection_before_creating_a_new_one._n
call fcn.140095ab0
mov rcx, qword [rbx + 0x120]
test rcx, rcx
je 0x14002f71a
call fcn.14002f950
mov qword [rbx + 0x120], rbp
cmp byte [rbx + 0x1a6], bpl
je 0x14002f731
mov byte [rbx + 0x1a6], bpl
mov byte [rbx + 0x199], bpl
mov ecx, 0x48
call fcn.1400c2704
mov rdi, rax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], rax
mov r9, qword [rbx + 0x98]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov qword [rdi + 0x20], r9
mov qword [rdi + 0x28], rsi
mov qword [rdi + 0x30], rbx
lea rax, [0x14002fa10]
mov qword [rdi + 0x40], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movzx r11d, r9b
mov rax, r9
shr rax, 8
movzx r10d, al
mov rax, r9
shr rax, 0x10
movzx r8d, al
mov rax, r9
shr rax, 0x18
movzx edx, al
mov rax, r9
shr rax, 0x20
movzx ecx, al
shr r9, 0x28
movzx r9d, r9b
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea r8, str._02x:_02x:_02x:_02x:_02x:_02x
mov edx, 0x20
lea rcx, [rsp + 0x60]
call fcn.140017d20
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002f820
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140017c00
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, [0x14002dae0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0x38], rax
mov qword [rbx + 0x120], rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c2450
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002f890
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str._AsusSync_BTRFCOMMClient__BTRFCOMMClient_begin_n
call fcn.140095ab0
mov byte [rbx + 0x18], 1
mov rcx, qword [rbx + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x14002f8c5
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x30], 0xffffffffffffffff
mov rcx, qword [rbx]
xor edi, edi
test rcx, rcx
je 0x14002f904
mov edx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14002f8f8
lea rcx, str._AsusSync_BTRFCOMMClient__BTRFCOMMClient___thread_seems_be_blocked__terminate_it._n
call fcn.1400959a0
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx], rdi
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14002f923
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
lea rcx, str._AsusSync_BTRFCOMMClient__BTRFCOMMClient_end_n
call fcn.140095ab0
nop
mov edx, 0x68
mov rcx, rbx
call fcn.1400c2470
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140037b50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceLinktoMyASUS
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140037bf7
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
lea rdx, str.a4b75315_c24b_42eb_9f0a_97e4d1a9f37f
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ecx, 1
movzx ebx, bl
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x140037c03
lea rcx, str._AsusSync_CommMgr__IsRemoveAll___fail_to_open_key_n
call fcn.140095ab0
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x50
pop rbx
ret

Function at 0x1400383a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov edi, edx
mov ecx, 0x18
mov rsi, r8
call fcn.1400c2704
xor ecx, ecx
lea r8, [0x14003a0d0]
mov qword [rsp + 0x28], rcx
mov r9, rax
xor edx, edx
mov dword [rsp + 0x20], ecx
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14003a650
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rcx + 0x70], 1
mov rcx, qword [rcx + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x14003a679
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov rcx, qword [rbx + 8]
xor edi, edi
test rcx, rcx
je 0x14003a6bc
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14003a6ae
lea rcx, str._AsusSync_BTRFCOMMServer__BTRFCOMMServer___thread_seems_be_blocked__terminate_it._n
call fcn.140095ab0
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 8], rdi
mov rdx, qword [rbx + 0x58]
cmp rdx, 8
jb 0x14003a6f8
mov rcx, qword [rbx + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003a6f3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a76f
mov rcx, r8
call fcn.1400c2470
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], 7
mov word [rbx + 0x40], di
mov rdx, qword [rbx + 0x38]
cmp rdx, 8
jb 0x14003a744
mov rcx, qword [rbx + 0x20]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003a73f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a76f
mov rcx, r8
call fcn.1400c2470
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], 7
mov word [rbx + 0x20], di
mov edx, 0x80
mov rcx, rbx
call fcn.1400c2470
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.1400c8b64
int3
Function at 0x1400406d0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx ebx, dl
mov rdi, rcx
mov edx, ebx
lea rcx, str._AsusSync_CommMgr__RPCRequestControl_____d__Start_n
mov esi, ebx
call fcn.140095ab0
mov rax, qword [rdi + 0x768]
test bl, bl
je 0x14004078b
cmp rax, 0xffffffffffffffff
je 0x140040725
xor edx, edx
mov rcx, rdi
call fcn.1400406d0
mov rax, qword [rdi + 0x768]
cmp rax, 0xffffffffffffffff
jne 0x140040830
mov rcx, qword [0x1401696c0]
mov rbx, qword [rdi + 0x758]
mov byte [rdi + 0x6b], 1
test rcx, rcx
je 0x14004074e
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x1401696c0]
mov qword [0x140164ce0], rbx
test rcx, rcx
je 0x140040760
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
xor eax, eax
lea r8, [0x14003f4d0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0x768], rax
jmp 0x140040830
cmp rax, 0xffffffffffffffff
je 0x140040830
mov rcx, qword [0x1401696c0]
mov byte [rdi + 0x6b], 0
test rcx, rcx
je 0x1400407b7
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x1401696c0]
mov qword [0x140164ce0], 0xffffffffffffffff
test rcx, rcx
je 0x1400407cd
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov rcx, qword [rdi + 0x758]
test rcx, rcx
je 0x1400407df
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rdi + 0x768]
test rcx, rcx
je 0x140040830
mov edx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140040818
lea rcx, str._AsusSync_CommMgr__RPCRequestControl___RPCRequestHandler_seems_be_blocked__terminate_it._n
call fcn.140095ab0
mov rcx, qword [rdi + 0x768]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov rcx, qword [rdi + 0x768]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rdi + 0x768], 0xffffffffffffffff
mov edx, esi
lea rcx, str._AsusSync_CommMgr__RPCRequestControl_____d__End_n
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140095ab0
Function at 0x140045e30
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x260
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rdx
mov dword [rsp + 0x3c], 0
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 0x208
lea rcx, [rsp + 0x40]
xor bl, bl
call fcn.1400c5120
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x14004601f
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x280], rdi
lea rcx, str._AsusSync_CommMgr__GetServiceVersion___GetFileVersionInfo_:_s_n
call fcn.140095ab0
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x140046006
mov qword [rsp + 0x270], rsi
lfence
mov ecx, edi
mov eax, 2
shr rcx, 1
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400c26fc
mov rsi, rax
lfence
mov r9, rax
lea rcx, [rsp + 0x40]
mov r8d, edi
xor edx, edx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
test eax, eax
jne 0x140045f20
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rcx, str._AsusSync_CommMgr__GetServiceVersion___GetFileVersionInfo_false:_d_n
jmp 0x140045fbd
lfence
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [0x140119f68]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x140045fb0
cmp dword [rsp + 0x38], 0
je 0x140045fc4
mov rdx, qword [rsp + 0x30]
cmp dword [rdx], 0xfeef04bd
jne 0x140045fc4
movzx eax, word [rdx + 8]
movzx ecx, word [rdx + 0xa]
shl rcx, 0x10
or rcx, rax
movzx eax, word [rdx + 0xe]
shl rcx, 0x10
or rcx, rax
movzx eax, word [rdx + 0xc]
shl rcx, 0x10
or rcx, rax
mov qword [r14], rcx
movzx eax, word [rdx + 0xc]
movzx r9d, word [rdx + 0xe]
movzx r8d, word [rdx + 8]
movzx edx, word [rdx + 0xa]
mov qword [rsp + 0x28], rcx
lea rcx, str._AsusSync_CommMgr__GetServiceVersion_version:_d._d._d._d__0x_I64X__n
mov dword [rsp + 0x20], eax
call fcn.140095ab0
mov bl, 1
jmp 0x140045fc4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rcx, str._AsusSync_CommMgr__GetServiceVersion_VerQueryValue_fail:_d_n
mov edx, eax
call fcn.140095ab0
mov edx, 2
mov rcx, rsi
call fcn.1400c2470
mov rsi, qword [rsp + 0x270]
movzx eax, bl
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop r14
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str._AsusSync_CommMgr__GetFileVersionInfoSize___false:_d_n
call fcn.140095ab0
movzx eax, bl
jmp 0x140045fdc
movzx eax, bl
jmp 0x140045fe4
Function at 0x14004ca90
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edx, 8
call fcn.140044ff0
xor ebx, ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceLinktoMyASUSSharedCam
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x58], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x14004cc44
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1400c5120
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x60]
call fcn.1400c46bc
test rax, rax
je 0x14004cb42
mov word [rax + 2], bx
lea r8, str.B2A1AFEC_DB2A_4892_B696_08C06A058F96
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400d6ec0
lea rax, [rsp + 0x60]
mov r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], bx
jne 0x14004cb64
add r9d, r9d
je 0x14004cba1
test bl, 1
je 0x14004cb9a
mov eax, ebx
lea rdx, [rsp + 0x60]
add rdx, rax
lea eax, [rbx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x60]
movzx r8d, byte [rdx]
add r8b, bl
mov byte [rdx], al
mov byte [rsp + rcx + 0x60], r8b
inc ebx
cmp ebx, r9d
jb 0x14004cb73
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], r9d
lea rdx, str.30AC6FF0_6662_472C_B05D_E2B1E147BC63
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14004cbdd
mov edx, eax
lea rcx, str._AsusSync_CommMgr__SetSharedCamBitmapInfo_RegSetValueExW_REG_BITMAP_INFO__Error___d_
call fcn.1400959a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x28], 4
lea rdx, str.idleduration
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x5c], 3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14004cc24
mov edx, eax
lea rcx, str._AsusSync_CommMgr__SetSharedCamBitmapInfo_RegSetValueExW_REG_IDLE_DURATION__Error___d_
call fcn.1400959a0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rdx, str.B2A1AFEC_DB2A_4892_B696_08C06A058F96
lea rcx, str._AsusSync_CommMgr__SetSharedCamBitmapInfo_:_s
call fcn.1400959a0
jmp 0x14004cc52
mov edx, eax
lea rcx, str._AsusSync_CommMgr__SetSharedCamBitmapInfo_RegCreateKeyExW_Error___d_
call fcn.1400959a0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x280
pop rbx
ret