joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d260
Capabilities:
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rcx + 0x174]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test al, al
je 0x14005d29c
mov r8d, 0x1f8
lea rdx, str.CRpcClientObject::OnRegKeyChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.140032320
cmp dword [rcx + 0x44], 0
je 0x14005d2c3
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140032320
mov r8d, 0x1f9
jmp 0x14005d282
mov qword [rsp + 0x48], rbp
mov eax, 1
mov qword [rsp + 0x50], r14
lock xadd dword [rcx + 0x40], eax
mov ecx, 0x408
call fcn.14007953c
xor edx, edx
mov r8d, 0x408
mov rcx, rax
mov rbp, rax
call fcn.140081670
lea rcx, [rbp + 8]
mov r8, rsi
mov edx, pe_nt_image_headers64
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbp + 0x208]
mov r8, rdi
mov edx, pe_nt_image_headers64
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbx + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
movzx eax, byte [rbx + 0x174]
test al, al
jne 0x14005d380
lea rdi, [rbx + 0x100]
mov rsi, qword [rdi + 8]
mov rcx, rdi
call fcn.140005600
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x40], rax
mov rcx, qword [rax]
test rax, rax
je 0x14005d358
mov qword [rax + 0x10], rbp
mov qword [rdi + 0x20], rcx
mov qword [rax + 8], rsi
mov qword [rax], 0
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005d379
mov qword [rcx], rax
jmp 0x14005d37c
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rcx, [rbx + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
or eax, 0xffffffff
lock xadd dword [rbx + 0x40], eax
mov eax, dword [rbx + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
test eax, eax
jne case.default.0x14005d3bd
cmp dword [rbx + 0x44], eax
je case.default.0x14005d3bd
mov rcx, qword [rbx + 0x38]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005d700
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
movzx eax, byte [rcx + 0x18c]
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
test al, al
je 0x14005d73c
mov r8d, 0x241
lea rdx, str.CRpcClientObject::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp fcn.140032320
cmp dword [rcx + 0x5c], 0
je 0x14005d763
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140032320
mov r8d, 0x242
jmp 0x14005d722
mov qword [rsp + 0x48], rsi
mov eax, 1
mov qword [rsp + 0x50], r14
lock xadd dword [rcx + 0x58], eax
mov ecx, 0x204
call fcn.14007953c
xor edx, edx
mov r8d, 0x204
mov rcx, rax
mov rsi, rax
call fcn.140081670
mov r8, rbp
mov edx, pe_nt_image_headers64
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbx + 0x20]
mov dword [rsi + 0x200], edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
movzx ecx, byte [rbx + 0x18c]
test cl, cl
jne 0x14005d810
lea rdi, [rbx + 0xb8]
mov rbp, qword [rdi + 8]
mov rcx, rdi
call fcn.140005600
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x40], rax
mov rcx, qword [rax]
test rax, rax
je 0x14005d7e8
mov qword [rax + 0x10], rsi
mov qword [rdi + 0x20], rcx
mov qword [rax + 8], rbp
mov qword [rax], 0
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005d809
mov qword [rcx], rax
jmp 0x14005d80c
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rcx, [rbx + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
or eax, 0xffffffff
lock xadd dword [rbx + 0x58], eax
mov eax, dword [rbx + 0x58]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
test eax, eax
jne case.default.0x14005d84d
cmp dword [rbx + 0x5c], eax
je case.default.0x14005d84d
mov rcx, qword [rbx + 0x50]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14005d9d0
Capabilities:
Print debug messages

Disassembly:
push rbx
push rdi
sub rsp, 0x28
movzx eax, byte [rcx + 0x194]
mov edi, r8d
mov rbx, rcx
test al, al
je 0x14005da07
mov r8d, 0x280
lea rdx, str.CRpcClientObject::OnServiceEvent
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140032320
cmp dword [rcx + 0x64], 0
je 0x14005da2e
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140032320
mov r8d, 0x281
jmp 0x14005d9ee
mov qword [rsp + 0x50], rsi
mov eax, 1
mov qword [rsp + 0x20], r14
lock xadd dword [rcx + 0x60], eax
mov ecx, 0x208
call fcn.14007953c
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rsi, rax
call fcn.140081670
lea r8, [0x1400939d8]
mov edx, pe_nt_image_headers64
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbx + 0x28]
mov dword [rsi + 0x200], edi
mov dword [rsi + 0x204], 0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
movzx eax, byte [rbx + 0x194]
test al, al
jne 0x14005daf3
lea rdi, [rbx + 0xf0]
mov qword [rsp + 0x40], rbp
mov rbp, qword [rdi + 8]
mov rcx, rdi
call fcn.140005600
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
test rax, rax
je 0x14005dac6
mov qword [rax + 0x10], rsi
mov qword [rdi + 0x20], rcx
mov qword [rax + 8], rbp
mov rbp, qword [rsp + 0x40]
mov qword [rax], 0
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005daec
mov qword [rcx], rax
jmp 0x14005daef
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rcx, [rbx + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
or eax, 0xffffffff
lock xadd dword [rbx + 0x60], eax
mov eax, dword [rbx + 0x60]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
test eax, eax
jne case.default.0x14005db2f
cmp dword [rbx + 0x64], eax
je case.default.0x14005db2f
mov rcx, qword [rbx + 0x58]
add rsp, 0x28
pop rdi
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x14005dd70
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x54], 0
mov rbx, rcx
je 0x14005ddb6
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140032320
mov r8d, 0x2b6
lea rdx, str.CRpcClientObject::OnTimer
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140032320
mov eax, 1
lock xadd dword [rcx + 0x50], eax
cmp qword [rcx + 0x178], 0
je 0x14005de3d
cmp edx, 0x3f3
jne 0x14005de3d
mov r9d, dword [rcx + 0x180]
test r9d, r9d
je 0x14005de24
lea rax, [rcx - 0x10]
mov r8d, 0x2bf
lea rcx, str._s__d_block_check_EventPostingType_d_CRpcClientObject_x
mov qword [rsp + 0x20], rax
lea rdx, str.CRpcClientObject::OnTimer
call fcn.140032320
cmp dword [rbx + 0x170], 0
je 0x14005de1a
mov dword [rbx + 0x174], 1
call fcn.1400702c0
jmp 0x14005de24
mov dword [rbx + 0x170], 1
mov rax, qword [rbx - 8]
lea rcx, [rbx - 8]
mov r8d, 0x270f
lea rdx, [0x1400939d8]
call qword [rax]
jmp 0x14005de66
cmp edx, 0x3f8
jne 0x14005de66
call fcn.140009aa0
mov rcx, rax
mov edx, 0x3f8
call fcn.140071290
lea rcx, [rbx - 0x10]
mov r8d, 0x20000005
call fcn.14005d9d0
or eax, 0xffffffff
lock xadd dword [rbx + 0x50], eax
mov eax, dword [rbx + 0x50]
test eax, eax
jne case.default.0x14005de83
cmp dword [rbx + 0x54], eax
je case.default.0x14005de83
mov rcx, qword [rbx + 0x48]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x30
pop rbx
ret

Function at 0x14005de90
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x4c], 0
mov rbx, rcx
je 0x14005ded6
mov r8d, 0x2d
lea rdx, str.CDestructorHelper::AvoidDelete
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140032320
mov r8d, 0x2db
lea rdx, str.CRpcClientObject::OnControlChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140032320
mov eax, 1
lock xadd dword [rcx + 0x48], eax
call fcn.140009aa0
mov rcx, rax
mov edx, 0x3f8
mov r8d, 0x64
call fcn.1400710a0
or eax, 0xffffffff
lock xadd dword [rbx + 0x48], eax
mov eax, dword [rbx + 0x48]
test eax, eax
jne case.default.0x14005df15
cmp dword [rbx + 0x4c], eax
je case.default.0x14005df15
mov rcx, qword [rbx + 0x40]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x20
pop rbx
ret
Function at 0x14005ec10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400d6010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xa0]
mov rbp, r9
mov rsi, qword [rsp + 0xb8]
mov rbx, r8
mov r14, qword [rsp + 0xa8]
mov rdi, rdx
mov r15, qword [rsp + 0xb0]
mov dword [rsi], eax
call fcn.140004250
mov rcx, rax
test rax, rax
je 0x14005ed8d
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9, rbx
lea r8, str.SOFTWARERealtekAudioRtkAudUservice
add rax, 0x18
lea rdx, [0x1400934b8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400054e0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x14005ecb1
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140003c80
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov r9d, 0xffff
mov qword [rsp + 0x28], r15
mov r8, rbp
mov rdx, rbx
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14005ed98
cmp eax, dword [rbx - 0xc]
jg 0x14005ed98
mov dword [rbx - 0x10], eax
xor ecx, ecx
cdqe
mov word [rbx + rax*2], cx
cmp dword [0x1400da6dc], ecx
je 0x14005ed4e
cmp dword [0x1400da710], ecx
jne 0x14005ed1e
mov rax, qword [0x1400d63b8]
test byte [rax + 0x1c], 1
je 0x14005ed4e
mov eax, dword [rsi]
lea rdx, str.GetProfileValue
mov dword [rsp + 0x38], eax
lea rcx, str._s_lRet_d_subkey_s_valName_s_type_d_value_x_valuesize_d
mov eax, dword [r14]
mov r9, rbx
mov qword [rsp + 0x30], r15
mov r8d, edi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call fcn.140032320
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005ed69
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140078ef0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140003fc0
int3
mov ecx, 0x80070057
call fcn.140003fc0
int3
Function at 0x14005edb0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1400d6010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0xa8]
mov rsi, r9
mov rbx, r8
mov rdi, rdx
call fcn.140004250
mov rcx, rax
test rax, rax
je 0x14005ef21
mov rax, qword [rax]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x50], r15
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9, rbx
lea r8, str.SOFTWARERealtekAudioRtkAudUservice
add rax, 0x18
lea rdx, [0x1400934b8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400054e0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x14005ee3e
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140003c80
mov rbx, qword [rsp + 0x40]
mov r14d, dword [rsp + 0xb0]
mov r8, rsi
mov r15d, dword [rsp + 0xa0]
mov rdx, rbx
mov dword [rsp + 0x28], r14d
mov r9d, r15d
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14005ef2c
cmp eax, dword [rbx - 0xc]
jg 0x14005ef2c
mov dword [rbx - 0x10], eax
xor ecx, ecx
cdqe
mov word [rbx + rax*2], cx
cmp dword [0x1400da6dc], ecx
je 0x14005eee0
cmp dword [0x1400da710], ecx
jne 0x14005eeb3
mov rax, qword [0x1400d63b8]
test byte [rax + 0x1c], 1
je 0x14005eee0
mov dword [rsp + 0x38], r14d
lea rdx, str.WriteProfileValue
mov qword [rsp + 0x30], rbp
lea rcx, str._s_lRet_d_subkey_s_valName_s_type_d_val_x_valsize_d
mov dword [rsp + 0x28], r15d
mov r9, rbx
mov r8d, edi
mov qword [rsp + 0x20], rsi
call fcn.140032320
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005eefb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov r14, qword [rsp + 0x80]
mov rax, rdi
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140078ef0
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140003fc0
int3
mov ecx, 0x80070057
call fcn.140003fc0
int3
Function at 0x14005fdb0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1400d6010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0xc0]
xor r12d, r12d
mov r15, rcx
mov dword [rsp + 0x50], r12d
mov rcx, qword [rcx]
mov rsi, r9
mov ebp, r8d
mov rdi, rdx
test rcx, rcx
jne 0x14005fdf8
mov eax, 0xc0000008
jmp 0x14005fe75
test rdi, rdi
je 0x14005fef8
test rsi, rsi
je 0x14005fef8
test r14, r14
je 0x14005fef8
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
js 0x14005fe75
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14005fe90
mov eax, 0xc0000017
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140078ef0
add rsp, 0x68
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r15]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 2
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, ebp
mov eax, dword [rsp + 0x50]
mov rdx, rdi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov edi, eax
test eax, eax
js 0x14005fedd
mov ecx, dword [rsp + 0x50]
mov qword [rsi], rbx
mov dword [r14], ecx
jmp 0x14005fe70
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, edi
jmp 0x14005fe70
mov eax, 0xc000000d
jmp 0x14005fe75
Function at 0x140060cc0
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x1400d6010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x70], rcx
call fcn.140004250
mov rcx, rax
test rax, rax
jne 0x140060d15
mov ecx, 0x80004005
call fcn.140003fc0
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 0x808], rax
test rbx, rbx
je 0x140060ec2
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140060d33
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x808]
call fcn.140003d30
mov rax, qword [rbp + 0x808]
cmp dword [rax - 8], 1
jle 0x140060d6b
mov edx, dword [rax - 0x10]
lea rcx, [rbp + 0x808]
call fcn.140003c80
mov rax, qword [rbp + 0x808]
mov qword [rbp + 0x800], rax
mov qword [rbp + 0x818], rsi
mov rdi, rbp
mov esi, 0x5c00
xor r15d, r15d
nop dword [rax + rax]
mov qword [rdi + 8], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x140060e62
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov ebx, esi
or ebx, 0x220000
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax + 3]
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140060e07
mov qword [rsp + 0x40], r15
jmp 0x140060e59
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], SafeArrayUnaccessData
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
test ebx, ebx
cmove rax, r15
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm0
add esi, 0xc
add rdi, 0x20
cmp esi, 0x5ef4
jl 0x140060d90
mov qword [rbp + 0x7e8], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbp + 0x7e0], rax
test rax, rax
je 0x140060ec2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rbp
lea r8, [0x1400610c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbp + 0x810], rax
mov rax, rbp
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140078ef0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140061240
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
mov r9d, edx
lea rcx, str._s__d_nDriverEventIndex_d
lea rdx, str.CRtkAudioDriverEvent::NotifyEvent
mov r8d, 0xbb
call fcn.140032320
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov rcx, qword [rsi + 0x818]
mov ebx, eax
test rcx, rcx
je 0x14006129b
mov r9, qword [rcx]
mov r8d, edi
mov rdx, qword [rsi + 0x800]
call qword [r9]
cmp ebx, 1
jbe 0x1400612cb
mov r9d, ebx
lea rdx, str.CRtkAudioDriverEvent::NotifyEvent
mov r8d, 0xc4
lea rcx, str._s__d_CoInitializeEx_hr_x
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140032320
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
in eax, dx
mov bl, bh
popfq
in al, 0x2a
adc eax, 0xa6526749
cld
invalid
int 0xd
xor eax, 0x485b5a53
mov eax, 0xa655538e
mov ss, word [rbx + 0x55]
cmpsb byte [rsi], byte [rdi]
mov ss, word [rbx + 0x55]
cmpsb byte [rsi], byte [rdi]
sar dword [rax], cl
adc dword [rsi], edx
je 0x14015d8ed
stosb byte [rdi], al
cmp ebp, dword [rsi + 0x1e]
mov ebp, 0x5b2e9b42
xor dword [rcx + 0x23], 0x2b
cmp bl, byte [rsi + 0x1a]
sub byte [ecx], cl
adc ebp, dword [rdx]
xlatb
push rsp
idiv byte [rdi]
sahf
out dx, eax
or byte [rdi + rcx*2 - 0xca3f741], al
cmp dh, dh
jrcxz 0x14015d8b6
enter 0xffffffffffffb38b, 0xfffffffffffffffa
cmp al, 0xd6
and eax, 0x347beb0c
mov esi, dword [rbx + 0x25d63cfa]
or al, 0xeb
jnp 0x14015d92c
jnp 0x14015d90e
fisubr word [rsi - 0x2e795145]
pop rbp
jo 0x14015d8c6
cwde
invalid
retf 0x3ab8
mov edi, 0x918bff95
mov bl, 0xb2
invalid
Function at 0x1400667c0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1400d6010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
call fcn.14006e570
nop
xor esi, esi
mov dword [rdi + 0x78], esi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
lea rbx, [rdi + 0x90]
lea rax, vtable.CSensorsMgr.0
mov qword [rdi], rax
lea rax, vtable.CSensorsMgr.2.0
mov qword [rdi + 0x70], rax
lea rax, vtable.CSensorsMgr.1.0
mov qword [rbx], rax
mov dword [rdi + 0x98], esi
mov dword [rdi + 0x9c], 1
mov qword [rdi + 0xa0], rsi
mov qword [rdi + 0xa8], rsi
lea r8d, [rsi + 0xa]
lea rdx, [0x1400ab458]
lea rcx, [0x1400937f8]
call fcn.140032320
test rdi, rdi
cmove rbx, rsi
call fcn.14005ba60
lea rcx, [rax + 0xa0]
mov rdx, rbx
call fcn.1400051f0
mov dword [rdi + 0x98], esi
mov dword [rdi + 0x9c], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140066d30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0xa0], rax
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140078ef0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140066a30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x1400937f8]
mov r8d, 0x27
call fcn.140032320
xor ebx, ebx
nop dword [rax + rax]
mov r8d, 0x2d
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x1400937f8]
call fcn.140032320
mov ecx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov r8d, 0x31
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x1400937f8]
call fcn.140032320
lea rcx, [rdi - 0x70]
call fcn.140066af0
test eax, eax
jne 0x140066ab3
inc ebx
cmp ebx, 5
jl 0x140066a60
jmp 0x140066acc
mov r8d, 0x34
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x1400937f8]
call fcn.140032320
mov r8d, 0x38
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x1400937f8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140032320
Function at 0x14006a2b0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rsi, rcx
mov r8d, 4
lea rdx, str.CppWindowsService_in_OnStop
call fcn.14006b9b0
lea rdi, [rsi - 0x168]
lea rbx, [rsi + 0x40]
xor ebp, ebp
test rdi, rdi
cmove rbx, rbp
call fcn.140010800
lea rcx, [rax + 0x20]
mov rdx, rbx
call fcn.140009900
lea rbx, [rsi + 0x38]
test rdi, rdi
cmove rbx, rbp
call fcn.140009aa0
lea rcx, [rax + 0x28]
mov rdx, rbx
call fcn.140009900
mov r8d, 0x105
lea rdx, str.CServiceMain::OnStop
lea rcx, str._s__d_Start
call fcn.140032320
mov rbx, qword [rsi + 0x50]
test rbx, rbx
je 0x14006a35d
mov rcx, rbx
call fcn.14000efb0
lea edx, [rbp + 0x58]
mov rcx, rbx
call fcn.140078f1c
mov qword [rsi + 0x50], rbp
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x14006a375
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x20]
mov qword [rsi + 0x58], rbp
mov rbx, qword [rsi + 0x60]
test rbx, rbx
je 0x14006a3d0
mov eax, dword [0x1400da71c]
cmp eax, 1
jne 0x14006a399
call fcn.140054770
call fcn.140056990
mov eax, dword [0x1400da71c]
dec eax
mov dword [0x1400da71c], eax
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a3bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov edx, 0x10
mov rcx, rbx
call fcn.140078f1c
mov qword [rsi + 0x60], rbp
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x14006a3e2
call fcn.140014860
mov qword [rsi + 0x68], rbp
mov rbx, qword [rsi + 0x70]
test rbx, rbx
je 0x14006a404
mov rcx, rbx
call fcn.140050a90
mov edx, 0x28
mov rcx, rbx
call fcn.140078f1c
mov qword [rsi + 0x70], rbp
mov rbx, qword [rsi + 0xa8]
test rbx, rbx
je 0x14006a440
lea rax, vtable.CSurfaceDolbyDSPControl.0
mov qword [rbx], rax
call fcn.1400099e0
lea rcx, [rax + 0x10]
mov rdx, rbx
call fcn.140009900
nop
mov edx, 0x28
mov rcx, rbx
call fcn.140078f1c
mov qword [rsi + 0xa8], rbp
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
je 0x14006a464
add rcx, 0xd8
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsi + 0xb0], rbp
mov r8d, 0x10f
lea rdx, str.CServiceMain::OnStop
lea rcx, str._s__d_End
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140032320