joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002eb30
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1058
call fcn.140281720
sub rsp, rax
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, rcx
mov dword [rsp + 0x20], 0x100
lea rcx, [rsp + 0x30]
mov r9d, 0x20
xor r8d, r8d
call fcn.1402cb9a0
test eax, eax
je 0x14002eb8d
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1402812e0
add rsp, 0x1058
ret
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x1068], rbx
lea ecx, [rdx - 0xf]
call fcn.14028d49c
mov rbx, rax
test rax, rax
je 0x14002ebd2
mov ecx, 0x20
mov dword [rax + 0xc], 0x20
mov dword [rax + 8], 0
call fcn.14029c170
mov qword [rbx], rax
test rax, rax
jne 0x14002ebdb
mov rcx, rbx
call fcn.140288820
or rax, 0xffffffffffffffff
jmp 0x14002ecb1
mov ecx, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov qword [rsp + 0x1050], rdi
call fcn.1402aebe0
mov edi, eax
test eax, eax
jle 0x14002ec88
mov qword [rsp + 0x1070], rsi
nop dword [rax]
mov esi, dword [rbx + 0xc]
mov ecx, esi
mov eax, dword [rbx + 8]
sub ecx, eax
cmp ecx, edi
jg 0x14002ec44
lea ecx, [rax + 8]
add esi, esi
add ecx, edi
cmp esi, ecx
jg 0x14002ec2e
lea esi, [rax + 8]
add esi, edi
mov rcx, qword [rbx]
movsxd rdx, esi
call fcn.14029c7f0
test rax, rax
je 0x14002ec66
mov dword [rbx + 0xc], esi
mov qword [rbx], rax
movsxd rcx, dword [rbx + 8]
lea rdx, [rsp + 0x40]
add rcx, qword [rbx]
movsxd r8, edi
call fcn.140287310
add dword [rbx + 8], edi
movsxd rcx, dword [rbx + 8]
mov rax, qword [rbx]
mov byte [rcx + rax], 0
mov ecx, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
call fcn.1402aebe0
mov edi, eax
test eax, eax
jg 0x14002ec10
mov rsi, qword [rsp + 0x1070]
mov ecx, dword [rsp + 0x30]
call fcn.1402ad85c
mov rcx, qword [rbx]
test edi, edi
jns 0x14002ecd1
call fcn.140288820
mov rcx, rbx
call fcn.140288820
or rax, 0xffffffffffffffff
mov rdi, qword [rsp + 0x1050]
mov rbx, qword [rsp + 0x1068]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1402812e0
add rsp, 0x1058
ret
call fcn.14002f8a0
mov rcx, qword [rbx]
mov rdi, rax
call fcn.140288820
mov rcx, rbx
call fcn.140288820
mov rax, rdi
jmp 0x14002eca9
Function at 0x140033f2c
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
mov dword [rax - 0x28], ebx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
mov word [rcx], bx
xor r8d, r8d
lea rdx, [0x14041bfe0]
call fcn.140009ed0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x5a]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rbp, eax
test eax, eax
je 0x140033fea
lea eax, [rbx + 2]
mul rbp
lea rcx, [rbx - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.1400d7300
mov rdi, rax
mov r9d, ebp
mov r8, rax
lea edx, [rbx + 0x5a]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140033fe2
cmp word [rdi], bx
je 0x140033fd4
mov rcx, rdi
call fcn.140288ad0
mov rbx, rax
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140009ed0
mov rcx, rdi
call fcn.1400d72f0
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140034e3c
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x158]
sub rsp, 0x240
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov rbx, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov dword [rsp + 0x50], esi
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rsi
mov word [rcx], si
mov dword [rsp + 0x50], 1
test rdx, rdx
je 0x140034fb9
cmp word [rdx], si
je 0x140034fb9
mov rcx, qword [str.Hq_]
mov rax, qword [rcx]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x104
lea r8, [rbp + 0x20]
mov qword [rsp + 0x28], r8
or dword [rsp + 0x20], 0xffffffff
mov r9, rdx
xor r8d, r8d
xor edx, edx
call qword [rax + 0x280]
mov edi, eax
cmp eax, 1
jle 0x140034fb9
lea r14, vtable.SHA1.0
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x74], rsi
xor edx, edx
lea r8d, [rsi + 0x44]
lea rcx, [rbp - 0x6c]
call fcn.140287160
mov dword [rsp + 0x78], 0x67452301
mov dword [rsp + 0x7c], 0xefcdab89
mov dword [rbp - 0x80], 0x98badcfe
mov dword [rbp - 0x7c], 0x10325476
mov dword [rbp - 0x78], 0xc3d2e1f0
mov word [rbp - 0x28], si
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x10], eax
lea r8d, [rdi - 1]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140036334
cmp byte [rbp - 0x27], sil
jne 0x140034fb4
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.140036268
test al, al
je 0x140034fb4
mov edi, esi
mov r9d, dword [rbp + rdi*4 - 0x20]
lea r8, str._08X
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
lea rcx, [rbp - 8]
call fcn.14000a38c
cmp word [rbp - 8], si
jne 0x140034f93
mov rax, rsi
jmp 0x140034f9c
lea rcx, [rbp - 8]
call fcn.140288ad0
mov r8, rax
lea rdx, [rbp - 8]
mov rcx, rbx
call fcn.14000af30
inc rdi
cmp rdi, 5
jl 0x140034f6e
mov qword [rsp + 0x70], r14
mov rax, rbx
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140035380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov ecx, 0xfa00
call fcn.1400d7300
mov rdi, rax
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
lea rcx, str.__
call fcn.140288ad0
mov r8, rax
lea rdx, str.__
lea rcx, [rsp + 0x28]
call fcn.140009ed0
nop
lea r9d, [r14 + 2]
cmp qword [rbx + 0x10], r9
jbe 0x140035456
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140013f90
nop
lea rdx, [0x1405ef0ac]
mov rcx, rax
call fcn.140012390
test eax, eax
sete sil
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140009e10
test sil, sil
je 0x140035456
xor r8d, r8d
lea rdx, [0x14041bfe0]
lea rcx, [rsp + 0x28]
call fcn.140009ed0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000b150
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
xor r9d, r9d
mov r8, rdi
mov edx, 0x7d00
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
dec eax
cmp eax, 0x7cfe
ja 0x14003549a
mov rcx, rdi
jmp 0x1400354ab
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, rdi
call fcn.1400d72f0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.140009e10
cmp ebx, 0xffffffff
jne 0x1400354d4
xor al, al
jmp 0x1400354e3
test bl, 0x10
je 0x1400354dd
xor al, al
jmp 0x1400354e3
mov al, 1
jmp 0x1400354e3
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140035884
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x180
lea r9, str.NGUtils::CFileUtils::CreateDirectoryW
lea r8, [0x140745918]
mov rdx, qword [0x140744c58]
lea rcx, [rsp + 0x70]
call fcn.14000a880
nop
mov sil, bl
mov r14d, ebx
lea rdi, [0x140745de8]
test sil, sil
jne 0x140035a55
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
lea rcx, str.__
call fcn.140288ad0
mov r8, rax
lea rdx, str.__
lea rcx, [rsp + 0x48]
call fcn.140009ed0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.14000b150
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
sete sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
test sil, sil
jne 0x1400359df
cmp eax, 0xb7
je 0x140035a3a
mov edx, 0x80
cmp eax, 5
jne 0x1400359fc
mov rcx, rdi
cmp qword [0x140745e00], 8
cmovae rcx, qword [0x140745de8]
mov dword [rsp + 0x30], eax
mov rax, qword [0x140745df8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, str.::CreateDirectory__s__len_d___error_d._Sleeping_...
mov r8d, SafeArrayCopyData
lea rcx, [rsp + 0x70]
call fcn.14000acc0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140009e10
inc r14d
cmp r14d, 2
jae 0x140035a55
jmp 0x1400358f9
cmp qword [0x140745e00], 8
cmovae rdi, qword [0x140745de8]
mov dword [rsp + 0x30], eax
mov rax, qword [0x140745df8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.::CreateDirectory__s__len_d___error_d
mov r8d, 0x19e
lea rcx, [rsp + 0x70]
call fcn.14000acc0
jmp 0x140035a44
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov bl, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140009e10
jmp 0x140035a58
mov bl, sil
lea rcx, [rsp + 0x70]
call fcn.14000a9d0
mov al, bl
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140035a90
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1ac
lea r9, str.NGUtils::CFileUtils::DeleteFileW
lea r8, [0x140745918]
mov rdx, qword [0x140744c58]
lea rcx, [rsp + 0x50]
call fcn.14000a880
nop
cmp qword [rbx + 0x18], 8
jb 0x140035aff
mov rcx, qword [rbx]
jmp 0x140035b02
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x140035bc2
mov sil, 1
test sil, dil
je 0x140035b74
and edi, 0xfffffffe
cmp qword [rbx + 0x18], 8
jb 0x140035b2a
mov rcx, qword [rbx]
jmp 0x140035b2d
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140035b74
cmp qword [rbx + 0x18], 8
jb 0x140035b43
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
lea r9, str.::SetFileAttributes__s__0x_X___error_d
mov edx, 0x80
mov r8d, 0x1bb
lea rcx, [rsp + 0x50]
call fcn.14000acc0
jmp 0x140035bc2
cmp qword [rbx + 0x18], 8
jb 0x140035b80
mov rcx, qword [rbx]
jmp 0x140035b83
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140035bc5
cmp qword [rbx + 0x18], 8
jb 0x140035b97
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, str.::DeleteFile__s___error_d
mov edx, 0x80
mov r8d, 0x1c2
lea rcx, [rsp + 0x50]
call fcn.14000acc0
xor sil, sil
lea rcx, [rsp + 0x50]
call fcn.14000a9d0
mov al, sil
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400363b0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor r9d, r9d
lea rax, [rsp]
mov r10, rcx
mov r8, rcx
sub r10, rax
lea r11d, [r9 + 0x10]
movzx eax, byte [r9 + r8 + 0x25]
lea rdx, [rsp]
add rdx, r9
movzx ecx, byte [r10 + rdx + 0x24]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + r8 + 0x26]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + r8 + 0x27]
shl ecx, 8
add r9, 4
or ecx, eax
mov dword [rdx], ecx
sub r11, 1
jne 0x1400363f5
lea rcx, [rsp + 8]
lea edx, [r11 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x140036438
mov r15d, dword [r8 + 8]
lea edi, [rdx + 0x14]
mov r12d, dword [r8 + 0xc]
mov ebp, r15d
mov r13d, dword [r8 + 0x10]
mov r11d, r12d
mov ebx, dword [r8 + 0x14]
mov r10d, r13d
mov r14d, dword [r8 + 0x18]
xor esi, esi
mov eax, r10d
lea r9d, [r14 + 0x5a827999]
and eax, r11d
mov ecx, r11d
not ecx
mov edx, ebp
and ecx, ebx
rol edx, 5
or ecx, eax
mov r14d, ebx
add edx, ecx
mov ebx, r10d
add edx, dword [rsp + rsi*4]
mov r10d, r11d
add r9d, edx
ror r10d, 2
inc rsi
mov r11d, ebp
mov ebp, r9d
cmp rsi, rdi
jl 0x140036474
mov esi, reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx
rol r9d, 5
add r14d, 0x6ed9eba1
add r9d, dword [rsp + rdi*4]
mov ecx, ebx
xor ecx, r10d
add r9d, r14d
xor ecx, r11d
mov r14d, ebx
mov ebx, r10d
add r9d, ecx
mov r10d, r11d
inc rdi
ror r10d, 2
mov r11d, ebp
mov ebp, r9d
cmp rdi, rsi
jl 0x1400364b7
mov edx, 0x3c
mov ecx, r10d
rol r9d, 5
or ecx, r11d
mov eax, r10d
and ecx, ebx
add r14d, 0x8f1bbcdc
and eax, r11d
add r9d, r14d
or ecx, eax
mov r14d, ebx
add ecx, dword [rsp + rsi*4]
mov ebx, r10d
mov r10d, r11d
add r9d, ecx
ror r10d, 2
inc rsi
mov r11d, ebp
mov ebp, r9d
cmp rsi, rdx
jl 0x1400364f4
mov eax, dword [rsp + rdx*4]
add r14d, 0xca62c1d6
rol r9d, 5
mov ecx, ebx
xor ecx, r10d
add r9d, r14d
xor ecx, r11d
mov r14d, ebx
mov ebx, r10d
add eax, ecx
mov r10d, r11d
add r9d, eax
ror r10d, 2
inc rdx
mov r11d, ebp
mov ebp, r9d
cmp rdx, 0x50
jl 0x140036533
add dword [r8 + 0x14], ebx
lea eax, [r15 + r9]
add dword [r8 + 0x18], r14d
and dword [r8 + 0x64], 0
mov dword [r8 + 8], eax
lea eax, [r12 + r11]
mov dword [r8 + 0xc], eax
lea eax, [r10 + r13]
mov dword [r8 + 0x10], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003cc0c
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x38
call fcn.1400d7290
mov rbx, rax
mov qword [rsp + 0x40], rax
xor ebp, ebp
test rax, rax
je 0x14003ccd1
lea rax, vtable.NGDeviceManager::IDeviceDiscoveryCallback.0
mov qword [rbx], rax
lea rax, vtable.NGDeviceManager::CSearchDevice.0
mov qword [rbx], rax
mov qword [rbx + 8], rdi
or qword [rbx + 0x10], 0xffffffffffffffff
lea rax, vtable.NGDeviceManager::CSearchDeviceByMAC.0
mov qword [rbx], rax
lea rdi, [rbx + 0x18]
mov rcx, rdi
call fcn.140009df4
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
cmp qword [rdi + 0x18], 8
jb 0x14003cca8
mov rax, qword [rdi]
jmp 0x14003ccab
mov rax, rdi
mov word [rax], bp
cmp word [rsi], bp
jne 0x14003ccb8
mov rax, rbp
jmp 0x14003ccc0
mov rcx, rsi
call fcn.140288ad0
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.140009ed0
nop
jmp 0x14003ccd4
mov rbx, rbp
mov byte [rsp + 0x30], bpl
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0x286
lea r9, str.NGDeviceManager::CSearchDevice::FindDevice
lea r8, [0x140745d20]
mov rdx, qword [0x140745980]
lea rcx, [rsp + 0x50]
call fcn.14000a880
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x14003cd35
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.CreateEvent_failed__err_d
mov r8d, 0x28b
jmp 0x14003cd6e
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rbx
lea r8, [0x14003c8d0]
xor edx, edx
xor ecx, ecx
call fcn.14029caa0
test rax, rax
jne 0x14003cd83
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._beginthreadex_Failed__err_d
mov r8d, 0x292
mov edx, 0x80
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.14000acc0
jmp 0x14003cdb3
or edi, 0xffffffff
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
jne 0x14003cdb3
lea r9, str.WaitForSingleObject_failed_
mov edx, 0x80
mov r8d, 0x299
lea rcx, [rsp + 0x50]
call fcn.14000acc0
nop
lea rcx, [rsp + 0x50]
call fcn.14000a9d0
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400612d0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x130
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov dil, dl
mov rbx, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x7c
lea r9, str.NGBusinessLogic::CMediator::Run
lea r8, [0x140746710]
mov rdx, qword [0x140744ff8]
lea rcx, [r11 - 0xb8]
call fcn.14000a880
nop
lea rcx, [0x14002db30]
call fcn.1402878e8
mov qword [rsp + 0x48], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov dword [rsp + 0x88], eax
test eax, eax
je 0x14006139d
lea rax, str.IEXESide::Initialize__
mov qword [rsp + 0x20], rax
lea r9, str._s_failed
mov edx, 0x80
lea r8d, [rdx + 3]
lea rcx, [rsp + 0x80]
call fcn.14000acc0
mov ebx, dword [rsp + 0x88]
lea rcx, [rsp + 0x80]
call fcn.14000a9d0
mov eax, ebx
jmp 0x1400614d4
test dil, dil
je 0x140061453
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1400611f0]
xor edx, edx
xor ecx, ecx
call fcn.14029caa0
mov qword [rbx + 0xb0], rax
mov rax, qword [rbx + 0xb0]
test rax, rax
je 0x140061423
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
mov dword [rsp + 0x88], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
or edx, 0xffffffff
mov rcx, qword [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xb0], 0
jmp 0x14006149d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x20], eax
lea r9, str._beginthreadex_..CMediator::CommandThreadStub...__returned__d
mov edx, 0x80
lea r8d, [rdx + 0x1d]
lea rcx, [rsp + 0x80]
call fcn.14000acc0
jmp 0x14006149d
mov rcx, qword [0x14072a540]
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 2]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov dword [rsp + 0x88], eax
test eax, eax
setns cl
movzx eax, ax
mov dword [rsp + 0x88], eax
test cl, cl
je 0x14006149d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
mov dword [rsp + 0x88], eax
mov rcx, qword [0x14072a540]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx]
mov rcx, qword [rbx + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x50]
nop
mov rcx, qword [rsp + 0x48]
call fcn.1402878e8
mov ebx, dword [rsp + 0x88]
lea rcx, [rsp + 0x80]
call fcn.14000a9d0
mov eax, ebx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1402812e0
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x140062560
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x100
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
and dword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xf8
lea r9, str.NGBusinessLogic::CThreadedCommandReceiver::Initialize
lea r8, [0x140746738]
mov rdx, qword [0x140744ff8]
lea rcx, [rsp + 0x50]
call fcn.14000a880
nop
mov rcx, rbx
call fcn.140061dc0
mov dword [rsp + 0x58], eax
test eax, eax
je 0x1400625f6
lea rax, str.CCommandReceiver::Initialize__
mov qword [rsp + 0x20], rax
lea r9, str._s_failed
mov edx, 0x80
lea r8d, [rdx + 0x7b]
lea rcx, [rsp + 0x50]
call fcn.14000acc0
jmp 0x14006264a
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140062460]
xor edx, edx
xor ecx, ecx
call fcn.14029caa0
mov qword [rbx + 0x90], rax
test rax, rax
jne 0x14006264a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
lea r9, str._beginthreadex_...TargetReceiverThreadStub...__
mov edx, 0x80
mov r8d, 0x103
lea rcx, [rsp + 0x50]
call fcn.14000acc0
mov ebx, dword [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000a9d0
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1402812e0
add rsp, 0x100
pop rbx
ret
Function at 0x140069368
Capabilities:
Modify service

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x120
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xec
lea r9, str.NGUtils::CServiceControl::DoEnableSvc
lea r8, [0x140746828]
mov rdx, qword [0x140744c58]
lea rcx, [rsp + 0x70]
call fcn.14000a880
nop
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x140069408
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.OpenSCManager_failed___d__n
mov edx, 0x80
lea r8d, [rdx + 0x76]
lea rcx, [rsp + 0x70]
call fcn.14000acc0
jmp 0x1400694e7
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14006944d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.OpenService_failed___d__n
mov edx, 0x80
mov r8d, 0x102
lea rcx, [rsp + 0x70]
call fcn.14000acc0
jmp 0x1400694dd
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r9d, edx
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1400694b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.ChangeServiceConfig_failed___d__n
mov edx, 0x80
mov r8d, 0x116
lea rcx, [rsp + 0x70]
call fcn.14000acc0
jmp 0x1400694d4
lea r9, str.Service_enabled_successfully._n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x118
lea rcx, [rsp + 0x70]
call fcn.14000acc0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x70]
call fcn.14000a9d0
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1402812e0
mov rbx, qword [rsp + 0x138]
add rsp, 0x120
pop rdi
ret