joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000101e
Capabilities:
Query environment variable

Disassembly:
jmp 0x140003b40
push rbx
push rsi
push rdi
sub rsp, 0x6b0
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rax, rdx
mov rdi, r8
mov rbx, rcx
mov byte [rcx + 8], r9b
xor esi, esi
lea rdx, [rsp + 0x70]
mov qword [rcx], rsi
mov rcx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.140010b34
cmp eax, 2
jne 0x140003c16
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x280]
lea r8d, [rsi + 0xa]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x104
call fcn.14000fee0
lea r9, [rsp + 0x280]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x490]
mov edx, 0x104
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call fcn.14000fd88
lea rcx, [rsp + 0x490]
call fcn.140010374
lea rdx, [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.140010b34
mov rax, rbx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140011b90
add rsp, 0x6b0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400010dc
Capabilities:
Query service status

Disassembly:
jmp 0x14000bf90
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rax, str.CheckPreviousServiceStatus
mov qword [rsp + 0x38], rax
lea rbp, str.__CheckPreviousServiceStatus_
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x55
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x40]
call fcn.1400010c8
mov r8, qword [rsp + 0x38]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
nop
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000c091
mov ebx, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
lea r8d, [rax + 0x5e]
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c160
mov r8d, 0xf01ff
lea rdx, str.TOSRMService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14000c0ed
mov ebx, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
lea r8d, [rax + 0x61]
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c156
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne al
test al, al
jne 0x14000c14b
mov ebx, 0x80004005
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0
lea r9, [0x14004b650]
mov r8d, 0x63
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c14d
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8, qword [rsp + 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140011b90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400011f9
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004f90
sub rsp, 0x28
mov eax, dword [0x140064bb4]
test al, 1
jne 0x140004ff3
or eax, 1
mov dword [0x140064bb4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004fc8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004fcf
mov rax, qword [0x140064bc8]
lea rdx, str.SourceFileFormat
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064bb0], eax
jmp 0x140004ff9
mov ecx, dword [0x140064bb0]
test ecx, ecx
je 0x14000500b
dec ecx
jne 0x14000500b
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000141a
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
jmp 0x14000d5a0
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
lea rax, str.UninstallService
mov qword [rsp + 0x38], rax
lea rbp, str.__UninstallService_
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0xab
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x40]
call fcn.1400010c8
mov r8, qword [rsp + 0x38]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
nop
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000d685
mov edi, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
mov r8d, 0xb2
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000d72e
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000d6df
mov edi, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
mov r8d, 0xb5
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000d724
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x94], 1
je 0x14000d710
lea r8, [rsp + 0x90]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
xor edi, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8, qword [rsp + 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140011b90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400014a6
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004df0
sub rsp, 0x28
mov eax, dword [0x140064ba4]
test al, 1
jne 0x140004e53
or eax, 1
mov dword [0x140064ba4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004e28
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004e2f
mov rax, qword [0x140064bc8]
lea rdx, str.Level
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064ba0], eax
jmp 0x140004e59
mov ecx, dword [0x140064ba0]
test ecx, ecx
je 0x140004e85
dec ecx
je 0x140004e7b
dec ecx
je 0x140004e71
dec ecx
jne 0x140004e85
lea eax, [rcx + 3]
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000155a
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400052c0
sub rsp, 0x38
xor eax, eax
mov word [0x140064930], ax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400052ee
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x1400052f5
mov rax, qword [0x140064bc8]
mov qword [rsp + 0x28], rax
lea r9, [0x140064930]
lea r8, str._LocalAppData_TOSHIBATSDRMService.txt
lea rdx, str.LogFile
lea rcx, [0x14004b3c8]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [0x140064930]
add rsp, 0x38
ret

Function at 0x14000157d
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004ad0
sub rsp, 0x28
mov eax, dword [0x140064bc4]
test al, 1
jne 0x140004b33
or eax, 1
mov dword [0x140064bc4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004b08
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004b0f
mov rax, qword [0x140064bc8]
lea rdx, str.Flush
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064bc0], eax
jmp 0x140004b39
mov ecx, dword [0x140064bc0]
test ecx, ecx
je 0x140004b48
dec ecx
jne 0x140004b48
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400017d0
Capabilities:
Print debug messages

Disassembly:
jmp 0x140004720
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1400648f0]
mov rdi, rdx
mov rbx, rcx
test al, 1
jne 0x140004759
or eax, 1
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
jmp 0x140004760
mov r8d, dword [0x1400648ec]
cmp r8d, 1
jne case.default.0x140004773
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test al, 1
jne 0x14000479e
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 2
jne 0x1400047df
mov rcx, rbx
call fcn.140001401
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400104c0
cmp byte [rbx + 8], 0
je 0x1400048bd
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140010e20
test al, 1
jne 0x140004803
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 3
jne 0x140004888
mov eax, dword [0x14006492c]
test al, 1
jne 0x14000482d
or eax, 1
mov rcx, rbx
mov dword [0x14006492c], eax
call fcn.14000155a
mov qword [0x140064920], rax
jmp 0x140004834
mov rax, qword [0x140064920]
lea r8, [0x14004b8a0]
lea rcx, [rsp + 0x20]
xor r9d, r9d
mov rdx, rax
call fcn.14000101e
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400104c0
cmp byte [rsp + 0x28], 0
je 0x14000486e
mov rcx, qword [rsp + 0x20]
call fcn.140010e20
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
call fcn.140010ce4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test al, 1
jne 0x1400048a6
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
cmp r8d, 4
jne 0x1400048bd
call fcn.140010260
mov rdx, rdi
lea rcx, [rax + 0x60]
call fcn.14001042c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
adc bh, cl
ficomp word [rax]
cmc
mov edx, 0x58679b0f
invalid
sub eax, dword [0xc5441a1a]
or al, 0x16
xor al, 0xc3
or byte [rdx + 0x392c37ef], bl
xor byte [rsi + 0x1a], dh
sub bl, byte [0x144e30cdb]
push rdi
mov ebp, 0x334d6c3b
popfq
push rsp
invalid
Function at 0x140001807
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004cc0
sub rsp, 0x28
mov eax, dword [0x140064bac]
test al, 1
jne 0x140004d26
or eax, 1
mov dword [0x140064bac], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004cf8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004cff
mov rax, qword [0x140064bc8]
lea rdx, str.Destination
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064ba8], eax
jmp 0x140004d2c
mov ecx, dword [0x140064ba8]
test ecx, ecx
je 0x140004d66
dec ecx
je 0x140004d5c
dec ecx
je 0x140004d52
dec ecx
je 0x140004d48
dec ecx
jne 0x140004d52
lea eax, [rcx + 4]
add rsp, 0x28
ret
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001811
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400050b0
sub rsp, 0x28
mov eax, dword [0x140064bbc]
test al, 1
jne 0x140005114
or eax, 1
mov dword [0x140064bbc], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400050e8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x1400050ef
mov rax, qword [0x140064bc8]
lea rdx, str.TimeDateFormat
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x140064bb8], eax
jmp 0x14000511a
mov eax, dword [0x140064bb8]
test eax, eax
je 0x140005148
dec eax
je 0x14000513e
dec eax
je 0x140005134
dec eax
jne 0x14000513e
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140003b40
Capabilities:
Query environment variable

Disassembly:
jmp 0x140003b40
push rbx
push rsi
push rdi
sub rsp, 0x6b0
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rax, rdx
mov rdi, r8
mov rbx, rcx
mov byte [rcx + 8], r9b
xor esi, esi
lea rdx, [rsp + 0x70]
mov qword [rcx], rsi
mov rcx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.140010b34
cmp eax, 2
jne 0x140003c16
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x280]
lea r8d, [rsi + 0xa]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x104
call fcn.14000fee0
lea r9, [rsp + 0x280]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x490]
mov edx, 0x104
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call fcn.14000fd88
lea rcx, [rsp + 0x490]
call fcn.140010374
lea rdx, [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.140010b34
mov rax, rbx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140011b90
add rsp, 0x6b0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004720
Capabilities:
Print debug messages

Disassembly:
jmp 0x140004720
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1400648f0]
mov rdi, rdx
mov rbx, rcx
test al, 1
jne 0x140004759
or eax, 1
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
jmp 0x140004760
mov r8d, dword [0x1400648ec]
cmp r8d, 1
jne case.default.0x140004773
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test al, 1
jne 0x14000479e
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 2
jne 0x1400047df
mov rcx, rbx
call fcn.140001401
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400104c0
cmp byte [rbx + 8], 0
je 0x1400048bd
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140010e20
test al, 1
jne 0x140004803
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 3
jne 0x140004888
mov eax, dword [0x14006492c]
test al, 1
jne 0x14000482d
or eax, 1
mov rcx, rbx
mov dword [0x14006492c], eax
call fcn.14000155a
mov qword [0x140064920], rax
jmp 0x140004834
mov rax, qword [0x140064920]
lea r8, [0x14004b8a0]
lea rcx, [rsp + 0x20]
xor r9d, r9d
mov rdx, rax
call fcn.14000101e
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400104c0
cmp byte [rsp + 0x28], 0
je 0x14000486e
mov rcx, qword [rsp + 0x20]
call fcn.140010e20
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
call fcn.140010ce4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test al, 1
jne 0x1400048a6
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
cmp r8d, 4
jne 0x1400048bd
call fcn.140010260
mov rdx, rdi
lea rcx, [rax + 0x60]
call fcn.14001042c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
adc bh, cl
ficomp word [rax]
cmc
mov edx, 0x58679b0f
invalid
sub eax, dword [0xc5441a1a]
or al, 0x16
xor al, 0xc3
or byte [rdx + 0x392c37ef], bl
xor byte [rsi + 0x1a], dh
sub bl, byte [0x144e30cdb]
push rdi
mov ebp, 0x334d6c3b
popfq
push rsp
invalid

Function at 0x140004ad0
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004ad0
sub rsp, 0x28
mov eax, dword [0x140064bc4]
test al, 1
jne 0x140004b33
or eax, 1
mov dword [0x140064bc4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004b08
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004b0f
mov rax, qword [0x140064bc8]
lea rdx, str.Flush
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064bc0], eax
jmp 0x140004b39
mov ecx, dword [0x140064bc0]
test ecx, ecx
je 0x140004b48
dec ecx
jne 0x140004b48
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x140004cc0
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004cc0
sub rsp, 0x28
mov eax, dword [0x140064bac]
test al, 1
jne 0x140004d26
or eax, 1
mov dword [0x140064bac], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004cf8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004cff
mov rax, qword [0x140064bc8]
lea rdx, str.Destination
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064ba8], eax
jmp 0x140004d2c
mov ecx, dword [0x140064ba8]
test ecx, ecx
je 0x140004d66
dec ecx
je 0x140004d5c
dec ecx
je 0x140004d52
dec ecx
je 0x140004d48
dec ecx
jne 0x140004d52
lea eax, [rcx + 4]
add rsp, 0x28
ret
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140004df0
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004df0
sub rsp, 0x28
mov eax, dword [0x140064ba4]
test al, 1
jne 0x140004e53
or eax, 1
mov dword [0x140064ba4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004e28
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004e2f
mov rax, qword [0x140064bc8]
lea rdx, str.Level
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064ba0], eax
jmp 0x140004e59
mov ecx, dword [0x140064ba0]
test ecx, ecx
je 0x140004e85
dec ecx
je 0x140004e7b
dec ecx
je 0x140004e71
dec ecx
jne 0x140004e85
lea eax, [rcx + 3]
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140004f90
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004f90
sub rsp, 0x28
mov eax, dword [0x140064bb4]
test al, 1
jne 0x140004ff3
or eax, 1
mov dword [0x140064bb4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004fc8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x140004fcf
mov rax, qword [0x140064bc8]
lea rdx, str.SourceFileFormat
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064bb0], eax
jmp 0x140004ff9
mov ecx, dword [0x140064bb0]
test ecx, ecx
je 0x14000500b
dec ecx
jne 0x14000500b
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400050b0
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400050b0
sub rsp, 0x28
mov eax, dword [0x140064bbc]
test al, 1
jne 0x140005114
or eax, 1
mov dword [0x140064bbc], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400050e8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x1400050ef
mov rax, qword [0x140064bc8]
lea rdx, str.TimeDateFormat
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x140064bb8], eax
jmp 0x14000511a
mov eax, dword [0x140064bb8]
test eax, eax
je 0x140005148
dec eax
je 0x14000513e
dec eax
je 0x140005134
dec eax
jne 0x14000513e
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400052c0
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400052c0
sub rsp, 0x38
xor eax, eax
mov word [0x140064930], ax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400052ee
or eax, 1
mov dword [0x140064bd4], eax
call fcn.140001339
mov qword [0x140064bc8], rax
jmp 0x1400052f5
mov rax, qword [0x140064bc8]
mov qword [rsp + 0x28], rax
lea r9, [0x140064930]
lea r8, str._LocalAppData_TOSHIBATSDRMService.txt
lea rdx, str.LogFile
lea rcx, [0x14004b3c8]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [0x140064930]
add rsp, 0x38
ret
Function at 0x140009fa0
Capabilities:
Create thread

Disassembly:
jmp 0x140009fa0
push rbx
sub rsp, 0x60
lea rax, str.CRadioManagerControl::InitRMControl
mov rbx, rcx
lea r9, [0x14004b650]
mov qword [rsp + 0x30], rax
lea rax, str.__CRadioManagerControl::InitRMControl_
lea rdx, str.RadioManager.cpp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x38]
mov r8d, 0x132
mov dword [rsp + 0x20], 3
call fcn.1400010c8
mov r8, qword [rsp + 0x30]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x38]
call fcn.1400016e5
lea rax, [rbx + 0x40]
lea r8, [0x140001550]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rsp + 0x30]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x38]
mov qword [rbx + 0x30], rax
call fcn.1400016e5
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x14000aa40
Capabilities:
Create thread

Disassembly:
jmp 0x14000aa40
push rbx
sub rsp, 0x60
lea rax, str.CRadioManagerControl::RMStart
mov rbx, rcx
lea r9, [0x14004b650]
mov qword [rsp + 0x30], rax
lea rax, str.__CRadioManagerControl::RMStart_
lea rdx, str.RadioManager.cpp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x38]
mov r8d, 0x17f
mov dword [rsp + 0x20], 3
call fcn.1400010c8
mov r8, qword [rsp + 0x30]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x38]
call fcn.1400016e5
lea rax, [rbx + 0x44]
lea r8, [0x1400014f6]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rsp + 0x30]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x38]
mov qword [rbx + 0x38], rax
call fcn.1400016e5
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x14000ab10
Capabilities:
Terminate thread

Disassembly:
jmp 0x14000ab10
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rbx, rcx
lea rax, str.CRadioManagerControl::RMStop
mov qword [r11 - 0x38], rax
lea rsi, str.__CRadioManagerControl::RMStop_
mov qword [r11 - 0x70], rsi
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x18c
lea rdx, str.RadioManager.cpp
lea rcx, [r11 - 0x30]
call fcn.1400010c8
mov r8, qword [rsp + 0x60]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x68]
call fcn.1400016e5
nop
xor edi, edi
mov dword [rsp + 0xa0], edi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000abc7
lea rdx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0xa0], 0x103
jne 0x14000abb9
xor edx, edx
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], rdi
lea r9, str.OnRadiOChange
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov dword [rbx + 0x28], 1
test rax, rax
je 0x14000ac37
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x1a1
lea rdx, str.RadioManager.cpp
lea rcx, [rsp + 0x38]
call fcn.1400010c8
mov rcx, rax
lea rdx, str.Stop_Services_
call fcn.1400016e5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x60]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x68]
call fcn.1400016e5
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret