joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400801c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x50
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
xor ebx, ebx
cmp qword [rcx + 0x908], 0xffffffffffffffff
mov rbp, rcx
mov qword [rsp + 0x38], rax
mov word [rsp + 0x38], 0xe51c
mov byte [rsp + 0x3a], 1
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x40], eax
je 0x14008028a
mov qword [rsp + 0x68], rsi
add rcx, 0xff0
mov qword [rsp + 0x70], rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rcx, qword [rbp + 0x908]
lea r9, [rsp + 0x30]
lea r8d, [rbx + 0xc]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
lea rcx, [rbp + 0xff0]
mov ebx, eax
setne sil
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rdi, qword [rsp + 0x70]
test ebx, ebx
jne 0x140080281
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str._AsusSync_MdnsMgr__WriteWsPipe_failed__d__r_n
mov ebx, eax
call fcn.140095ab0
cmp ebx, 0x6d
jne 0x140080281
xor edx, edx
mov rcx, rbp
call fcn.140080b10
movzx eax, sil
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140081f60
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.CloseWebSocketDeviceHandler_Start_n
call fcn.140095ab0
mov rcx, qword [rbx + 0x960]
xor esi, esi
test rcx, rcx
je 0x140082000
mov rax, qword [rbx + 0x950]
test rax, rax
je 0x140081fa8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 0x960]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140081fc6
mov rcx, qword [rbx + 0x960]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov rcx, qword [rbx + 0x960]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbx + 0x958]
mov qword [rbx + 0x960], rsi
test rcx, rcx
je 0x140081ff3
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x958], rsi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [rbx + 0x980], rax
lea rcx, [rbx + 0xfc8]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rdx, qword [rbx + 0x1070]
test rdx, rdx
je 0x14008208f
mov r8, qword [rdx]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
test rax, rax
je 0x14008208b
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
cmp rax, rdi
jbe 0x1400820bc
lfence
mov rax, qword [rdx]
mov rcx, qword [rax + rdi*8]
test rcx, rcx
je 0x140082069
mov edx, reloc.WS2_32.dll_WSAGetLastError
call fcn.1400c2470
mov rdx, qword [rbx + 0x1070]
inc esi
inc rdi
movsxd rax, esi
mov r8, qword [rdx]
mov rcx, qword [rdx + 8]
sub rcx, r8
sar rcx, 3
cmp rax, rcx
jb 0x140082040
mov qword [rdx + 8], r8
lea rcx, [rbx + 0xfc8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
lea rcx, str.CloseWebSocketDeviceHandler_End_n
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.140095ab0
call fcn.14000a150
int3
Function at 0x140089930
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x140089990
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14008995d
cmp eax, 0xffffffff
jne 0x140089978
mov rcx, qword [rbx + 0x88]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
lea rcx, str._AsusSync_ObexClient__StopReceiver___thread_is_still_existent__TerminateThread_n
call fcn.140095ab0
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x88], 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x14008b310
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x30], 0
mov rdi, rcx
je 0x14008b45a
mov qword [rsp + 0x58], rbx
mov rbx, qword [rcx + 0x40]
mov qword [rsp + 0x60], rsi
xor esi, esi
test rbx, rbx
je 0x14008b38e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008b37d
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14008b36d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008b460
mov rcx, r8
call fcn.1400c2470
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.1400c2470
mov qword [rdi + 0x40], rsi
mov ecx, 0x18
call fcn.1400c2704
xorps xmm0, xmm0
mov qword [rsp + 0x38], rax
mov dl, 3
mov rcx, rax
movups xmmword [rax], xmm0
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rdi + 0x40], rax
mov byte [rdi + 0x50], 3
call fcn.140089420
mov rbx, qword [rdi + 0x40]
mov rsi, qword [rdi + 0x30]
mov byte [rsp + 0x30], 0xcb
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14008b3e0
mov byte [rdx], 0xcb
inc qword [rbx + 8]
jmp 0x14008b3ed
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.140028ac0
mov rdx, qword [rbx + 8]
lea r9, [rsi + 4]
mov r8, rsi
mov rcx, rbx
call fcn.14008ca60
mov rdx, qword [rdi + 0x40]
mov rax, qword [rdx]
mov r8d, dword [rdx + 8]
sub r8d, dword [rdx]
mov ecx, r8d
mov byte [rax + 2], r8b
mov rax, qword [rdx]
sar ecx, 8
mov byte [rax + 1], cl
mov rcx, qword [rdi]
mov rax, qword [rdi + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x14008b450
mov rdx, qword [rax]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14008b450
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str._AsusSync_ObexClient__ContinueGet___send_socket_failed__WSAGetLastError____d__n
call fcn.140095ab0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400c8b64
int3

Function at 0x14008b7a0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x68]
mov rbx, rcx
mov qword [rcx + 0x70], rax
mov byte [rcx + 0x64], 0
call fcn.14008a9c0
mov rcx, qword [rbx + 0xc0]
cmp rcx, 0xffffffffffffffff
je 0x14008b806
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x14008b7ee
mov rcx, qword [rbx + 0xc0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
lea rcx, str._AsusSync_PhoneBook__StopPullPhoneBook___a_task_is_still_running___terminate_it_n
call fcn.140095ab0
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0xc0], 0xffffffffffffffff
mov rcx, rbx
call fcn.14008b470
mov rcx, qword [rbx + 0xa0]
cmp rcx, 0xffffffffffffffff
je 0x14008b827
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
add rsp, 0x20
pop rbx
ret
Function at 0x14008e060
Capabilities:
Create pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp qword [rdx], 0xffffffffffffffff
mov rbx, rdx
movzx edi, r8b
mov rsi, rcx
jne 0x14008e18a
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x100
call fcn.1400c5120
mov edx, 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea rcx, [rsp + 0x58]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
mov r9, qword [rsi]
lea rax, [rsp + 0x58]
lea r8, str..pipeLTM__012llX
mov qword [rsp + 0x48], rax
mov edx, 0x80
mov dword [rsp + 0x40], 0x18
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x50], 0
call fcn.140017d20
xor r8d, r8d
lea rcx, [rsp + 0x80]
test dil, dil
je 0x14008e143
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9d, [r8 + 1]
mov dword [rsp + 0x30], 0x3e8
lea edx, [r8 + 3]
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreateNamedPipeW]
jmp 0x14008e16a
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x14008e1a7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, edi
lea rcx, str._AsusSync_Phone__CreateConnection__d__fail_:0x_I64X_n
mov r8d, eax
call fcn.1400959a0
xor al, al
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x190
pop rdi
pop rsi
pop rbx
ret
mov al, 1
jmp 0x14008e18c
Function at 0x14008ec40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
movzx eax, byte [rsp + 0x60]
mov rbx, rcx
mov byte [rcx + 0x39], al
lea rax, [0x140099a40]
mov qword [rcx + 0x40], rax
mov qword [rcx], 0xffffffffffffffff
mov qword [rcx + 8], 0xffffffffffffffff
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x28], 0xffffffffffffffff
mov qword [rcx + 0x30], 0xffffffffffffffff
mov byte [rcx + 0x38], 1
test r8, r8
je 0x14008ed16
xor r8d, r8d
mov qword [rsp + 0x40], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx + 0x28], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
xor edi, edi
lea r8, [0x14008f200]
mov r9, rbx
mov qword [rbx + 0x30], rax
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
cmp qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx], rax
je 0x14008ed08
mov qword [rsp + 0x28], rdi
lea r8, [0x14008f240]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 8], rax
mov rdi, qword [rsp + 0x40]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14008f6f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbx, rcx
test rdx, rdx
je 0x14008f810
test r8d, r8d
je 0x14008f810
test r9, r9
je 0x14008f810
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008f7fb
cmp byte [rbx], 0
je 0x14008f7e6
lea rax, [rbx + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x14008f763
cmp esi, dword [rdi]
jne 0x14008f763
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
je 0x14008f7c8
mov edx, eax
lea rcx, str._Aws_Pipe__Send___failed__GLE0x_I64X_n
call fcn.140095ab0
cmp byte [rbx], 0
je 0x14008f78e
mov byte [rbx], 0
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14008f79e
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008f7d4
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, edi
mov qword [rbx + 8], 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, str._Aws_Pipe__Send___failed__ERROR_IO_PENDING_n
call fcn.140095ab0
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 0x4ca
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 0x4cd
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0x57
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14008f830
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov rbx, rcx
test rdx, rdx
je 0x14008f9aa
test r8d, r8d
je 0x14008f9aa
test r9, r9
je 0x14008f9aa
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008f9a3
cmp byte [rbx], 0
je 0x14008f99c
lea rbp, [rbx + 0x48]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x14008f894
cmp dword [rsi], 0
jne 0x14008f90d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
cmp eax, 0x6d
jne 0x14008f8e6
lea rcx, str._Aws_Pipe__recv___client_disconnected._n
call fcn.140095ab0
cmp byte [rbx], 0
je 0x14008f8b5
mov byte [rbx], 0
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14008f8c5
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008f9af
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
jmp 0x14008f9af
cmp eax, 0x3e5
jne 0x14008f95c
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008f914
mov r9d, 1
mov r8, rsi
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_GetOverlappedResult]
test eax, eax
je 0x14008f914
xor edi, edi
jmp 0x14008f9af
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str._Aws_Pipe__recv___read_fail_in_ERROR_IO_PENDING___error2:_d._n
mov edi, eax
call fcn.140095ab0
cmp byte [rbx], 0
je 0x14008f932
mov byte [rbx], 0
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14008f942
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008f9af
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
jmp 0x14008f9af
mov edx, eax
lea rcx, str._Aws_Pipe__recv___failed__GLE0x_I64X_n
call fcn.140095ab0
cmp byte [rbx], 0
je 0x14008f972
mov byte [rbx], 0
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14008f982
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008f9af
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
jmp 0x14008f9af
mov edi, 0x4ca
jmp 0x14008f9af
mov edi, 0x4cd
jmp 0x14008f9af
mov edi, 0x57
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14008fab0
Capabilities:
Create pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp qword [rdx], 0xffffffffffffffff
mov rbx, rdx
movzx edi, r8b
mov rsi, rcx
jne 0x14008fbb9
mov edx, 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea rcx, [rsp + 0x58]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
xor edx, edx
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rcx, [rsi + 0x28]
test dil, dil
je 0x14008fb69
cmp qword [rcx + 0x18], 8
jb 0x14008fb31
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
mov r9d, 1
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x3e8
mov edx, 0x40000003
mov dword [rsp + 0x28], 0x40000
mov dword [rsp + 0x20], 0x40000
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreateNamedPipeW]
jmp 0x14008fb99
cmp qword [rcx + 0x18], 8
jb 0x14008fb73
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov dword [rsp + 0x28], 0x40000000
mov edx, 0xc0000000
xor r8d, r8d
mov dword [rsp + 0x20], 3
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x14008fbd6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, edi
lea rcx, str._Aws_PipeServer__CreateConnection__d__fail_:0x_I64X_n
mov r8d, eax
call fcn.1400959a0
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
mov al, 1
jmp 0x14008fbbb
Function at 0x140090570
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x61], 0
lea rax, str.True
lea rdx, str.False
mov rbx, rcx
mov r8, rdx
cmovne r8, rax
cmp byte [rcx + 0x60], 0
lea rcx, str._AsusSync_ProArtItf__SetBTStatus___IsPaired_:__s__IsConnected_:__s_n
cmovne rdx, rax
call fcn.140095ab0
mov ecx, 0x18e
call fcn.1400c2704
xor edx, edx
mov r8d, 0x186
mov rdi, rax
lea rcx, [rax + 8]
call fcn.1400c5120
mov dword [rdi + 4], 0x10000
lea r8, [0x140090490]
mov dword [rdi], 1
mov r9, rdi
movzx eax, byte [rbx + 0x60]
xor edx, edx
mov byte [rdi + 0xc], al
xor ecx, ecx
movzx eax, byte [rbx + 0x61]
mov byte [rdi + 0xd], al
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov dword [rdi + 8], 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
jne 0x14009062f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str._AsusSync_ProArtItf__SetBTStatus___Failed_to_create_thread__error:__d_n
call fcn.140095ab0
mov edx, 0x18e
mov rcx, rdi
call fcn.1400c2470
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140090640
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
cmp qword [rdx + 0x18], 8
jb 0x140090670
mov rdx, qword [rdx]
lea rcx, str._AsusSync_ProArtItf__SetCUSID____s_n
call fcn.140095ab0
mov ecx, 0x18e
call fcn.1400c2704
mov rdi, rax
lea rcx, [rax + 0xc]
xor edx, edx
mov r8d, 0x182
call fcn.1400c5120
mov dword [rdi + 4], 0x10000
mov dword [rdi], 3
mov dword [rdi + 8], 1
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400906bb
mov r8, qword [rbx]
lea rcx, [rdi + 0xe]
mov edx, 0x80
lea r9d, [rdx - 1]
call fcn.1400d6f40
xor esi, esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140090490]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
jne 0x140090713
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str._AsusSync_ProArtItf__SetCUSID___Failed_to_create_thread__error:__d_n
call fcn.140095ab0
mov edx, 0x18e
mov rcx, rdi
call fcn.1400c2470
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14009074e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140090749
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009077a
mov rcx, r8
call fcn.1400c2470
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400c8b64
int3
Function at 0x140091280
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rbx
mov byte [rcx + 0x10], 0
add rcx, 0x18
call fcn.140013730
nop
lea rcx, [rsi + 0x38]
mov rdx, rbx
call fcn.140013730
xor ebp, ebp
mov qword [rsi + 0x58], rbp
lea rax, [0x140096d20]
mov qword [rsi + 0x60], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x1401696c8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x1401696b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x1401696c0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x1401696b0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov qword [0x1401696a8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rsi], rax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov r9, rsi
lea r8, [0x140091a00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rsi + 8], rax
mov qword [0x140169698], rsi
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400913bc
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400913b7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140091435
mov rcx, r8
call fcn.1400c2470
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140091406
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140091401
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009143b
mov rcx, r8
call fcn.1400c2470
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.1400c8b64
nop
call fcn.1400c8b64
int3
Function at 0x140093080
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
movzx edx, byte [rcx + 0x200072]
mov rbx, rcx
lea rcx, str._AsusSync_SharedCamNativeEx__Stop___Begin_State:_d_n
call fcn.140095ab0
movzx eax, byte [rbx + 0x200072]
sub al, 7
cmp al, 1
ja 0x140093208
mov rax, qword [rbx + 0x2000f0]
mov byte [rbx + 0x200072], 2
test rax, rax
je 0x1400930c4
mov byte [rax + 0x1d], 1
cmp qword [rbx + 0x200128], 0
je 0x1400930f2
lea rcx, str._AsusSync_SharedCamNativeEx__Send_Stop_request_to_Remote_device._n
call fcn.140095ab0
mov rcx, qword [rbx]
xor r9d, r9d
mov rax, qword [rbx + 0x200128]
xor r8d, r8d
mov dl, 2
call qword [0x1400fac68]
mov rcx, qword [rbx + 0x2000c8]
cmp rcx, 0xffffffffffffffff
je 0x140093144
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14009312c
lea rcx, str._AsusSync_SharedCamNativeEx__Stop___thread_seems_be_blocked__terminate_it._n
call fcn.140095ab0
mov rcx, qword [rbx + 0x2000c8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov rcx, qword [rbx + 0x2000c8]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x2000c8], 0xffffffffffffffff
mov rcx, qword [rbx + 0x2000f0]
test rcx, rcx
je 0x140093175
lea rcx, str._AsusSync_SharedCamNativeEx__Clean_H264_Frame_n
call fcn.140095ab0
mov rcx, qword [rbx + 0x2000f0]
test rcx, rcx
je 0x140093175
xor edx, edx
mov r8d, 0x20001e
call fcn.1400c5120
mov r8d, dword [rbx + 0x4c]
xor edx, edx
mov rcx, qword [rbx + 0x38]
call fcn.1400c5120
mov r8d, dword [rbx + 0x4c]
xor edx, edx
mov rcx, qword [rbx + 0x40]
call fcn.1400c5120
mov rcx, rbx
mov dword [rbx + 0x48], 0
mov dword [rbx + 0x20006e], 0x90010
call fcn.140093220
mov edx, dword [0x1401696d4]
lea rcx, str._AsusSync_SharedCamNativeEx__DataCleanUp___ToTal_ReceiveData_Count_:__d_n
call fcn.140095ab0
mov rcx, qword [rbx + 0x200080]
mov byte [rbx + 0x200072], 4
cmp rcx, 0xffffffffffffffff
je 0x1400931e3
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x200080], 0xffffffffffffffff
mov rcx, qword [rbx + 0x200088]
cmp rcx, 0xffffffffffffffff
je 0x140093201
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x200088], 0xffffffffffffffff
mov byte [rbx + 0x200094], 0
movzx edx, byte [rbx + 0x200072]
lea rcx, str._AsusSync_SharedCamNativeEx__Stop___End_State:_d_n
add rsp, 0x30
pop rbx
jmp fcn.140095ab0