joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e150
Capabilities:
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rcx + 0x174]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test al, al
je 0x14005e18c
mov r8d, 0x1f8
lea rdx, str.CRpcClientObject::OnRegKeyChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.140033040
cmp dword [rcx + 0x44], 0
je 0x14005e1b3
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140033040
mov r8d, 0x1f9
jmp 0x14005e172
mov qword [rsp + 0x48], rbp
mov eax, 1
mov qword [rsp + 0x50], r14
lock xadd dword [rcx + 0x40], eax
mov ecx, 0x408
call fcn.14007a474
xor edx, edx
mov r8d, 0x408
mov rcx, rax
mov rbp, rax
call fcn.1400825c0
lea rcx, [rbp + 8]
mov r8, rsi
mov edx, 0x100
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbp + 0x208]
mov r8, rdi
mov edx, 0x100
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbx + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
movzx eax, byte [rbx + 0x174]
test al, al
jne 0x14005e270
lea rdi, [rbx + 0x100]
mov rsi, qword [rdi + 8]
mov rcx, rdi
call fcn.140005600
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x40], rax
mov rcx, qword [rax]
test rax, rax
je 0x14005e248
mov qword [rax + 0x10], rbp
mov qword [rdi + 0x20], rcx
mov qword [rax + 8], rsi
mov qword [rax], 0
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005e269
mov qword [rcx], rax
jmp 0x14005e26c
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rcx, [rbx + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
or eax, 0xffffffff
lock xadd dword [rbx + 0x40], eax
mov eax, dword [rbx + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
test eax, eax
jne case.default.0x14005e2ad
cmp dword [rbx + 0x44], eax
je case.default.0x14005e2ad
mov rcx, qword [rbx + 0x38]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005e5f0
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
movzx eax, byte [rcx + 0x18c]
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
test al, al
je 0x14005e62c
mov r8d, 0x241
lea rdx, str.CRpcClientObject::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp fcn.140033040
cmp dword [rcx + 0x5c], 0
je 0x14005e653
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140033040
mov r8d, 0x242
jmp 0x14005e612
mov qword [rsp + 0x48], rsi
mov eax, 1
mov qword [rsp + 0x50], r14
lock xadd dword [rcx + 0x58], eax
mov ecx, 0x204
call fcn.14007a474
xor edx, edx
mov r8d, 0x204
mov rcx, rax
mov rsi, rax
call fcn.1400825c0
mov r8, rbp
mov edx, 0x100
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbx + 0x20]
mov dword [rsi + 0x200], edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
movzx ecx, byte [rbx + 0x18c]
test cl, cl
jne 0x14005e700
lea rdi, [rbx + 0xb8]
mov rbp, qword [rdi + 8]
mov rcx, rdi
call fcn.140005600
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x40], rax
mov rcx, qword [rax]
test rax, rax
je 0x14005e6d8
mov qword [rax + 0x10], rsi
mov qword [rdi + 0x20], rcx
mov qword [rax + 8], rbp
mov qword [rax], 0
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005e6f9
mov qword [rcx], rax
jmp 0x14005e6fc
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rcx, [rbx + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
or eax, 0xffffffff
lock xadd dword [rbx + 0x58], eax
mov eax, dword [rbx + 0x58]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
test eax, eax
jne case.default.0x14005e73d
cmp dword [rbx + 0x5c], eax
je case.default.0x14005e73d
mov rcx, qword [rbx + 0x50]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14005e8c0
Capabilities:
Print debug messages

Disassembly:
push rbx
push rdi
sub rsp, 0x28
movzx eax, byte [rcx + 0x194]
mov edi, r8d
mov rbx, rcx
test al, al
je 0x14005e8f7
mov r8d, 0x280
lea rdx, str.CRpcClientObject::OnServiceEvent
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140033040
cmp dword [rcx + 0x64], 0
je 0x14005e91e
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140033040
mov r8d, 0x281
jmp 0x14005e8de
mov qword [rsp + 0x50], rsi
mov eax, 1
mov qword [rsp + 0x20], r14
lock xadd dword [rcx + 0x60], eax
mov ecx, 0x208
call fcn.14007a474
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rsi, rax
call fcn.1400825c0
lea r8, [0x1400949f8]
mov edx, 0x100
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbx + 0x28]
mov dword [rsi + 0x200], edi
mov dword [rsi + 0x204], 0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
movzx eax, byte [rbx + 0x194]
test al, al
jne 0x14005e9e3
lea rdi, [rbx + 0xf0]
mov qword [rsp + 0x40], rbp
mov rbp, qword [rdi + 8]
mov rcx, rdi
call fcn.140005600
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
test rax, rax
je 0x14005e9b6
mov qword [rax + 0x10], rsi
mov qword [rdi + 0x20], rcx
mov qword [rax + 8], rbp
mov rbp, qword [rsp + 0x40]
mov qword [rax], 0
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005e9dc
mov qword [rcx], rax
jmp 0x14005e9df
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rcx, [rbx + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
or eax, 0xffffffff
lock xadd dword [rbx + 0x60], eax
mov eax, dword [rbx + 0x60]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
test eax, eax
jne case.default.0x14005ea1f
cmp dword [rbx + 0x64], eax
je case.default.0x14005ea1f
mov rcx, qword [rbx + 0x58]
add rsp, 0x28
pop rdi
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x14005ec60
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x54], 0
mov rbx, rcx
je 0x14005eca6
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140033040
mov r8d, 0x2b6
lea rdx, str.CRpcClientObject::OnTimer
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140033040
mov eax, 1
lock xadd dword [rcx + 0x50], eax
cmp qword [rcx + 0x178], 0
je 0x14005ed2d
cmp edx, 0x3f3
jne 0x14005ed2d
mov r9d, dword [rcx + 0x180]
test r9d, r9d
je 0x14005ed14
lea rax, [rcx - 0x10]
mov r8d, 0x2bf
lea rcx, str._s__d_block_check_EventPostingType_d_CRpcClientObject_x
mov qword [rsp + 0x20], rax
lea rdx, str.CRpcClientObject::OnTimer
call fcn.140033040
cmp dword [rbx + 0x170], 0
je 0x14005ed0a
mov dword [rbx + 0x174], 1
call fcn.140071200
jmp 0x14005ed14
mov dword [rbx + 0x170], 1
mov rax, qword [rbx - 8]
lea rcx, [rbx - 8]
mov r8d, 0x270f
lea rdx, [0x1400949f8]
call qword [rax]
jmp 0x14005ed56
cmp edx, 0x3f8
jne 0x14005ed56
call fcn.140009b20
mov rcx, rax
mov edx, 0x3f8
call fcn.1400721d0
lea rcx, [rbx - 0x10]
mov r8d, 0x20000005
call fcn.14005e8c0
or eax, 0xffffffff
lock xadd dword [rbx + 0x50], eax
mov eax, dword [rbx + 0x50]
test eax, eax
jne case.default.0x14005ed73
cmp dword [rbx + 0x54], eax
je case.default.0x14005ed73
mov rcx, qword [rbx + 0x48]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x30
pop rbx
ret

Function at 0x14005ed80
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x4c], 0
mov rbx, rcx
je 0x14005edc6
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140033040
mov r8d, 0x2db
lea rdx, str.CRpcClientObject::OnControlChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140033040
mov eax, 1
lock xadd dword [rcx + 0x48], eax
call fcn.140009b20
mov rcx, rax
mov edx, 0x3f8
mov r8d, 0x64
call fcn.140071fe0
or eax, 0xffffffff
lock xadd dword [rbx + 0x48], eax
mov eax, dword [rbx + 0x48]
test eax, eax
jne case.default.0x14005ee05
cmp dword [rbx + 0x4c], eax
je case.default.0x14005ee05
mov rcx, qword [rbx + 0x40]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x20
pop rbx
ret
Function at 0x14005fb00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400d8010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xa0]
mov rbp, r9
mov rsi, qword [rsp + 0xb8]
mov rbx, r8
mov r14, qword [rsp + 0xa8]
mov rdi, rdx
mov r15, qword [rsp + 0xb0]
mov dword [rsi], eax
call fcn.140004250
mov rcx, rax
test rax, rax
je 0x14005fc7d
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9, rbx
lea r8, str.SOFTWARERealtekAudioRtkAudUservice
add rax, 0x18
lea rdx, [0x1400944d8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400054e0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x14005fba1
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140003c80
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov r9d, 0xffff
mov qword [rsp + 0x28], r15
mov r8, rbp
mov rdx, rbx
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14005fc88
cmp eax, dword [rbx - 0xc]
jg 0x14005fc88
mov dword [rbx - 0x10], eax
xor ecx, ecx
cdqe
mov word [rbx + rax*2], cx
cmp dword [0x1400dc724], ecx
je 0x14005fc3e
cmp dword [0x1400dc758], ecx
jne 0x14005fc0e
mov rax, qword [0x1400d83b8]
test byte [rax + 0x1c], 1
je 0x14005fc3e
mov eax, dword [rsi]
lea rdx, str.GetProfileValue
mov dword [rsp + 0x38], eax
lea rcx, str._s_lRet_d_subkey_s_valName_s_type_d_value_x_valuesize_d
mov eax, dword [r14]
mov r9, rbx
mov qword [rsp + 0x30], r15
mov r8d, edi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call fcn.140033040
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005fc59
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140079e30
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140003fc0
int3
mov ecx, 0x80070057
call fcn.140003fc0
int3
Function at 0x14005fca0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1400d8010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0xa8]
mov rsi, r9
mov rbx, r8
mov rdi, rdx
call fcn.140004250
mov rcx, rax
test rax, rax
je 0x14005fe11
mov rax, qword [rax]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x50], r15
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9, rbx
lea r8, str.SOFTWARERealtekAudioRtkAudUservice
add rax, 0x18
lea rdx, [0x1400944d8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400054e0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x14005fd2e
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140003c80
mov rbx, qword [rsp + 0x40]
mov r14d, dword [rsp + 0xb0]
mov r8, rsi
mov r15d, dword [rsp + 0xa0]
mov rdx, rbx
mov dword [rsp + 0x28], r14d
mov r9d, r15d
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14005fe1c
cmp eax, dword [rbx - 0xc]
jg 0x14005fe1c
mov dword [rbx - 0x10], eax
xor ecx, ecx
cdqe
mov word [rbx + rax*2], cx
cmp dword [0x1400dc724], ecx
je 0x14005fdd0
cmp dword [0x1400dc758], ecx
jne 0x14005fda3
mov rax, qword [0x1400d83b8]
test byte [rax + 0x1c], 1
je 0x14005fdd0
mov dword [rsp + 0x38], r14d
lea rdx, str.WriteProfileValue
mov qword [rsp + 0x30], rbp
lea rcx, str._s_lRet_d_subkey_s_valName_s_type_d_val_x_valsize_d
mov dword [rsp + 0x28], r15d
mov r9, rbx
mov r8d, edi
mov qword [rsp + 0x20], rsi
call fcn.140033040
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005fdeb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov r14, qword [rsp + 0x80]
mov rax, rdi
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140079e30
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140003fc0
int3
mov ecx, 0x80070057
call fcn.140003fc0
int3
Function at 0x140060ca0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1400d8010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0xc0]
xor r12d, r12d
mov r15, rcx
mov dword [rsp + 0x50], r12d
mov rcx, qword [rcx]
mov rsi, r9
mov ebp, r8d
mov rdi, rdx
test rcx, rcx
jne 0x140060ce8
mov eax, 0xc0000008
jmp 0x140060d65
test rdi, rdi
je 0x140060de8
test rsi, rsi
je 0x140060de8
test r14, r14
je 0x140060de8
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
js 0x140060d65
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140060d80
mov eax, 0xc0000017
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140079e30
add rsp, 0x68
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r15]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 2
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, ebp
mov eax, dword [rsp + 0x50]
mov rdx, rdi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov edi, eax
test eax, eax
js 0x140060dcd
mov ecx, dword [rsp + 0x50]
mov qword [rsi], rbx
mov dword [r14], ecx
jmp 0x140060d60
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, edi
jmp 0x140060d60
mov eax, 0xc000000d
jmp 0x140060d65
Function at 0x140061bb0
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x1400d8010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x70], rcx
call fcn.140004250
mov rcx, rax
test rax, rax
jne 0x140061c05
mov ecx, 0x80004005
call fcn.140003fc0
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 0x808], rax
test rbx, rbx
je 0x140061db2
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140061c23
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x808]
call fcn.140003d30
mov rax, qword [rbp + 0x808]
cmp dword [rax - 8], 1
jle 0x140061c5b
mov edx, dword [rax - 0x10]
lea rcx, [rbp + 0x808]
call fcn.140003c80
mov rax, qword [rbp + 0x808]
mov qword [rbp + 0x800], rax
mov qword [rbp + 0x818], rsi
mov rdi, rbp
mov esi, 0x5c00
xor r15d, r15d
nop dword [rax + rax]
mov qword [rdi + 8], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x140061d52
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov ebx, esi
or ebx, 0x220000
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax + 3]
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140061cf7
mov qword [rsp + 0x40], r15
jmp 0x140061d49
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], SafeArrayUnaccessData
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
test ebx, ebx
cmove rax, r15
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm0
add esi, 0xc
add rdi, 0x20
cmp esi, 0x5ef4
jl 0x140061c80
mov qword [rbp + 0x7e8], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbp + 0x7e0], rax
test rax, rax
je 0x140061db2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rbp
lea r8, [0x140061fb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbp + 0x810], rax
mov rax, rbp
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079e30
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140062130
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
mov r9d, edx
lea rcx, str._s__d_nDriverEventIndex_d
lea rdx, str.CRtkAudioDriverEvent::NotifyEvent
mov r8d, 0xbb
call fcn.140033040
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov rcx, qword [rsi + 0x818]
mov ebx, eax
test rcx, rcx
je 0x14006218b
mov r9, qword [rcx]
mov r8d, edi
mov rdx, qword [rsi + 0x800]
call qword [r9]
cmp ebx, 1
jbe 0x1400621bb
mov r9d, ebx
lea rdx, str.CRtkAudioDriverEvent::NotifyEvent
mov r8d, 0xc4
lea rcx, str._s__d_CoInitializeEx_hr_x
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140033040
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
in al, 0xd
call 0x1341e0ba0
jrcxz 0x14015f89c
jns 0x14015f8db
lahf
iretd
jle 0x14015f8e9
invalid
test byte [rbp - 0x53], ah
rol byte [rsi + rbp*8], cl
pop r13
ficom word [rdi + 0x39]
invalid
js 0x14015f90a
adc al, byte [rbx + riz*4 + 0x2cc87f53]
stosb byte [rdi], al
sti
jae 0x14015f964
invalid
adc eax, 0xe9315b5e
movsb byte [rdi], byte [rsi]
invalid
int1
push qword [rsi + 0x2c56ef76]
jp 0x14015f9ec
mov edx, dword [rsi]
mov dl, byte [rdx + 0x74701f1]
movabs dword [0x39da2578f1a947c1], eax
xor eax, 0x2f3e05
test byte [rbp + 0x2690ad59], bh
test r8, r13
ror dword [rdi - 0x65], cl
lea ebx, [rax - 0x23ef278e]
xchg esi, eax
invalid
adc rbp, qword [rbx + 0x745e8d74]
push rbx
sub esp, esp
invalid
mov cl, 0xfe
invalid
Function at 0x140067700
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1400d8010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
call fcn.14006f4b0
nop
xor esi, esi
mov dword [rdi + 0x78], esi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
lea rbx, [rdi + 0x90]
lea rax, vtable.CSensorsMgr.2.0
mov qword [rdi], rax
lea rax, vtable.CSensorsMgr.1.0
mov qword [rdi + 0x70], rax
lea rax, vtable.CSensorsMgr.0
mov qword [rbx], rax
mov dword [rdi + 0x98], esi
mov dword [rdi + 0x9c], 1
mov qword [rdi + 0xa0], rsi
mov qword [rdi + 0xa8], rsi
lea r8d, [rsi + 0xa]
lea rdx, [0x1400ac958]
lea rcx, [0x140094818]
call fcn.140033040
test rdi, rdi
cmove rbx, rsi
call fcn.14005c950
lea rcx, [rax + 0xa0]
mov rdx, rbx
call fcn.1400051f0
mov dword [rdi + 0x98], esi
mov dword [rdi + 0x9c], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140067c70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0xa0], rax
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140079e30
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140067970
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140094818]
mov r8d, 0x27
call fcn.140033040
xor ebx, ebx
nop dword [rax + rax]
mov r8d, 0x2d
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140094818]
call fcn.140033040
mov ecx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov r8d, 0x31
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140094818]
call fcn.140033040
lea rcx, [rdi - 0x70]
call fcn.140067a30
test eax, eax
jne 0x1400679f3
inc ebx
cmp ebx, 5
jl 0x1400679a0
jmp 0x140067a0c
mov r8d, 0x34
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140094818]
call fcn.140033040
mov r8d, 0x38
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140094818]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140033040
Function at 0x14006b1f0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rsi, rcx
mov r8d, 4
lea rdx, str.CppWindowsService_in_OnStop
call fcn.14006c8f0
lea rdi, [rsi - 0x168]
lea rbx, [rsi + 0x40]
xor ebp, ebp
test rdi, rdi
cmove rbx, rbp
call fcn.140010880
lea rcx, [rax + 0x20]
mov rdx, rbx
call fcn.140009980
lea rbx, [rsi + 0x38]
test rdi, rdi
cmove rbx, rbp
call fcn.140009b20
lea rcx, [rax + 0x28]
mov rdx, rbx
call fcn.140009980
mov r8d, 0x105
lea rdx, str.CServiceMain::OnStop
lea rcx, str._s__d_Start
call fcn.140033040
mov rbx, qword [rsi + 0x50]
test rbx, rbx
je 0x14006b29d
mov rcx, rbx
call fcn.14000f030
lea edx, [rbp + 0x58]
mov rcx, rbx
call fcn.14007a4b8
mov qword [rsi + 0x50], rbp
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x14006b2b5
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x20]
mov qword [rsi + 0x58], rbp
mov rbx, qword [rsi + 0x60]
test rbx, rbx
je 0x14006b310
mov eax, dword [0x1400dc764]
cmp eax, 1
jne 0x14006b2d9
call fcn.140055660
call fcn.140057880
mov eax, dword [0x1400dc764]
dec eax
mov dword [0x1400dc764], eax
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b2ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov edx, 0x10
mov rcx, rbx
call fcn.14007a4b8
mov qword [rsi + 0x60], rbp
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x14006b322
call fcn.1400148c0
mov qword [rsi + 0x68], rbp
mov rbx, qword [rsi + 0x70]
test rbx, rbx
je 0x14006b344
mov rcx, rbx
call fcn.140051950
mov edx, 0x28
mov rcx, rbx
call fcn.14007a4b8
mov qword [rsi + 0x70], rbp
mov rbx, qword [rsi + 0xa8]
test rbx, rbx
je 0x14006b380
lea rax, vtable.CSurfaceDolbyDSPControl.0
mov qword [rbx], rax
call fcn.140009a60
lea rcx, [rax + 0x10]
mov rdx, rbx
call fcn.140009980
nop
mov edx, 0x28
mov rcx, rbx
call fcn.14007a4b8
mov qword [rsi + 0xa8], rbp
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
je 0x14006b3a4
add rcx, 0xd8
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsi + 0xb0], rbp
mov r8d, 0x10f
lea rdx, str.CServiceMain::OnStop
lea rcx, str._s__d_End
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140033040