joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009440
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x440
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x430], rax
xor edi, edi
mov r14d, edx
mov rbp, rcx
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rbx, rax
movzx eax, word [0x14005654c]
mov word [rsp + 0x20], ax
movzx eax, byte [0x14005654e]
mov byte [rsp + 0x22], al
test rbx, rbx
je 0x140009601
nop word [rax + rax]
cmp byte [rbx], sil
je 0x140009601
lea rax, [rsp + 0x20]
nop
movzx edx, byte [rax]
test dl, dl
je 0x1400094c9
cmp byte [rbx], dl
je 0x1400094df
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
test rax, rax
jne 0x1400094b0
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
test rax, rax
jne 0x1400094a0
jmp 0x140009601
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
test rax, rax
je 0x140009601
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.Service
mov rcx, rbx
call fcn.140007fe0
test eax, eax
je 0x140009566
cmp byte [rbx], sil
je 0x140009601
lea rax, [rsp + 0x20]
movzx edx, byte [rax]
test dl, dl
je 0x14000953a
cmp byte [rbx], dl
je 0x140009550
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
test rax, rax
jne 0x140009521
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
test rax, rax
jne 0x140009513
jmp 0x140009601
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
test rax, rax
jne 0x140009500
jmp 0x140009601
mov esi, 1
test r14d, r14d
je 0x140009601
mov edx, dword [0x14007a090]
mov rcx, rbp
call fcn.14000a0d0
mov rcx, rbp
call fcn.1400047c0
test eax, eax
jne 0x140009601
lea rcx, [0x14007e250]
xor edx, edx
call fcn.14003c9fc
mov ebx, esi
test rax, rax
je 0x1400095db
test edi, edi
jne 0x1400095ed
lea r8, [rsp + 0x30]
mov r9d, 0x400
mov edx, 0xd80b
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringA]
lea rcx, [0x14007e250]
mov edx, ebx
mov edi, eax
call fcn.14003c9fc
inc ebx
test rax, rax
jne 0x1400095a3
test edi, edi
jne 0x1400095ed
lea rdx, str.Could_not_start_service
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rbp + 0x68]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14003eed0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140009630
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400096c5
lea rdx, [rdi + 0x68]
lea r8d, [rbx + 4]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x1400096bc
lea rax, [rsp + 0x30]
lea r9d, [rbx + 0x24]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400096b3
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14003eed0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140009e00
Capabilities:
Modify service

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x140009eda
mov rcx, rax
mov qword [rsp + 0x158], rdi
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov rdi, rax
test rax, rax
je 0x140009ec9
lea rdx, [0x14007de28]
mov r8d, 2
mov rcx, rbx
mov qword [rsp + 0x150], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x140009eb8
mov rcx, qword [0x14007e258]
mov r9d, pe_nt_image_headers64
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x2c]
call qword [sym.imp.USER32.dll_LoadStringA]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rsi, qword [rsp + 0x150]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x140
pop rbx
ret

Function at 0x140009f00
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x140009f28
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x40]
lea r8, [0x140009700]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140009f69
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x140011260
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x208
lea rbp, [rsp + 0x50]
mov rax, qword [0x14007a8d0]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x220]
mov r13, rcx
add rcx, 0x58
mov qword [rbp + 0x18], r9
mov rsi, r8
mov r12d, edx
mov qword [rbp + 0x10], rax
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, str.Login__ld
lea rdx, str.COM:_CItunesServiceImpl::Login__
lea ecx, [r14 + 1]
mov r9d, r12d
mov r15d, 0x80004005
call fcn.140028400
mov rcx, qword [r13 + 0x48]
mov edx, r12d
call fcn.140026dc0
test eax, eax
je 0x140011480
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x140011348
mov rax, rdi
nop
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1400112f0
inc eax
cmp eax, 0x3fffffff
jle 0x140011307
xor esi, esi
jmp 0x140011348
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140011323
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14003ee70
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140003720
mov rsi, rax
lea r8, str.Login__ld___s
lea rdx, str.CItunesServiceImpl::Login__
mov r9d, r12d
mov ecx, 0x80000000
mov qword [rsp + 0x20], rsi
call fcn.140028400
mov r9d, 0xa
lea rdx, [rbp + 0x30]
lea r8d, [r9 + 0x47]
mov ecx, r12d
call fcn.14003f314
mov r9, qword [str.SoftwareApple_Computer__Inc.iPodRegisteredApps]
lea rax, [rbp + 0x30]
lea r8, str._s_s
lea rcx, [rbp + 0x90]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.14003f4f4
xor ecx, ecx
lea rax, [rbp + 0x20]
mov qword [rbp + 8], rcx
lea rdx, [rbp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140011404
mov r14, qword [rbp + 8]
test r14, r14
je 0x14001143c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
jmp 0x14001143c
test rsi, rsi
je 0x14001143c
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], r14b
jne 0x140011410
mov rdx, qword [str.name]
inc edi
mov r9d, 1
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [r13 + 0x50]
mov rcx, qword [r13 + 0x48]
lea r9, [rbp]
mov r8d, r12d
call fcn.140027150
test eax, eax
je 0x14001145c
mov ecx, dword [rbp]
call fcn.14000b630
mov r9, qword [rbp + 0x10]
mov r8, qword [rbp + 0x18]
mov rcx, qword [r13 + 0x48]
mov edx, r12d
call fcn.140026270
test eax, eax
je 0x140011480
mov ecx, dword [r13 + 0x50]
call fcn.140022780
xor r15d, r15d
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r14, r14
je 0x140011498
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r15d
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.14003eed0
lea rsp, [rbp + 0x1b8]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400125f0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x18], 0
mov rdi, rcx
jne 0x14001264a
test rdx, rdx
je 0x14001264a
lea rax, [rcx + 0x20]
mov qword [rcx + 8], r8
mov qword [rcx], rdx
mov r9, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbx
lea r8, [0x140012710]
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.14003f518
test rax, rax
mov qword [rdi + 0x18], rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140012660
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ecx, 0x28
mov rbp, rdx
call fcn.14003cde0
xor edi, edi
mov rbx, rax
test rax, rax
je 0x1400126a2
mov qword [rax + 0x20], rdi
mov dword [rax + 0x10], edi
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x18], rdi
jmp 0x1400126a5
mov rbx, rdi
cmp qword [rbx + 0x18], 0
mov dword [rbx + 0x24], 1
jne 0x1400126ea
test rsi, rsi
je 0x1400126ea
lea rcx, [rbx + 0x20]
lea r8, [0x140012710]
mov r9, rbx
mov qword [rsp + 0x28], rcx
xor edx, edx
xor ecx, ecx
mov qword [rbx], rsi
mov qword [rbx + 8], rbp
mov dword [rsp + 0x20], edi
call fcn.14003f518
test rax, rax
mov qword [rbx + 0x18], rax
setne dil
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140018dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov ebx, r9d
mov r12, r8
mov r15, rdx
mov r14, rcx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
add rcx, 0x1f8
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp ebx, 1
jne 0x140018f1d
mov r9d, 0x20219
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsiTunes.exe]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140005000
mov rsi, qword [rsp + 0x38]
test eax, eax
jne 0x140018f1d
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x140056122]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140018f0d
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, ebx
ja 0x140018f0d
mov ebx, dword [rsp + 0x30]
test ebx, ebx
je 0x140018ea1
cmp byte [rsp + rbx + 0x5f], 0
je 0x140018ea6
jmp 0x140018f0d
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [r14 + 0x30]
lea r8, str.__d__iTunes_located_at__s
lea rdx, str.CItunesDevice::DoLaunchITunesCheck__
mov ecx, 2
call fcn.140028400
lea ecx, [rbx + 1]
call fcn.14003cc90
mov rdi, rax
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14003f9f0
mov byte [rbx + rdi], 0
mov qword [rsp + 0x28], rdi
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x30]
mov r8d, dword [r14 + 0x60]
mov edx, 9
mov rcx, r15
call fcn.14002ab30
test rsi, rsi
je 0x140018f1d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea rcx, [r14 + 0x1f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
test rsi, rsi
je 0x140018f39
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x180
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001be50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, rdx
mov r14d, r9d
mov r15, r8
mov rsi, rcx
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14001bf66
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14001bf30
cmp r14d, eax
lea r9, [rsp + 0x40]
mov rdx, r15
cmovb ebx, r14d
mov rcx, rbp
mov qword [rsp + 0x20], rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001bf21
mov eax, dword [rsp + 0x40]
cmp eax, ebx
je 0x14001bf0c
mov r9d, dword [rsi + 0x30]
lea r8, str.__d__ReadFile_read__d_of__d_bytes
lea rdx, str.CItunesDevice::ReadPrefsFile__
lea ecx, [rdi + 4]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.140028400
mov rcx, rbp
mov edi, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
jmp 0x14001bf8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.__d__ReadFile_error_0x_X
jmp 0x14001bf3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.__d__GetFileEOF_error_0x_X
mov r9d, dword [rsi + 0x30]
lea rdx, str.CItunesDevice::ReadPrefsFile__
mov ecx, 4
mov dword [rsp + 0x20], eax
call fcn.140028400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
jmp 0x14001bf8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [rsi + 0x30]
lea r8, str.__d__CreateFileW_error_0x_X
lea rdx, str.CItunesDevice::ReadPrefsFile__
mov ecx, 4
mov dword [rsp + 0x20], eax
call fcn.140028400
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x14001ca60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, rdx
mov edi, r9d
mov rsi, r8
mov rbp, rcx
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001cb52
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
je 0x14001cb1f
mov ecx, dword [rsp + 0x40]
cmp ecx, edi
je 0x14001cb09
mov r9d, dword [rbp + 0x30]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
lea r8, str.__d__WriteFile_wrote__d_of__d_bytes
lea rdx, str.CItunesDevice::WritePrefsFile__
mov ecx, 4
call fcn.140028400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x14001cb7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [rbp + 0x30]
lea r8, str.__d__WriteFile_error_0x_X
lea rdx, str.CItunesDevice::WritePrefsFile__
mov ecx, 4
mov dword [rsp + 0x20], eax
call fcn.140028400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x14001cb7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [rbp + 0x30]
lea r8, str.__d__CreateFileW_error_0x_X
lea rdx, str.CItunesDevice::WritePrefsFile__
mov ecx, 4
mov dword [rsp + 0x20], eax
call fcn.140028400
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140020510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov qword [r11 - 0x30], 0xf
mov qword [r11 - 0x38], 0
mov byte [rsp + 0x30], 0
mov rax, qword [rcx + 0xa0]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400206cb
mov rdi, qword [rbx + 0x40]
mov rcx, rdi
call fcn.14001aeb0
test eax, eax
je 0x1400205dc
cmp byte [rbx + 0x19], 0
jne 0x1400206be
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400205b1
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400206be
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400205a0
jmp 0x1400206be
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400206bb
nop
cmp rbx, qword [rax + 0x10]
jne 0x1400206bb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400205c0
jmp 0x1400206bb
mov rcx, rdi
call fcn.140018310
test eax, eax
je 0x14002066d
lea rdx, [rsp + 0x24]
mov rcx, rdi
call fcn.14002b8b0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140019ca0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x50], al
mov dword [rsp + 0x51], 0x2e5c3a
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14002066d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x14002066d
lea r9, [rsp + 0x50]
lea r8, str.Drive__s_no_longer_active__unmounting_it...
lea rdx, str.CItunesDeviceManager::ScanForUninformedEjects__
lea ecx, [rax - 0x11]
call fcn.140028400
mov rcx, rdi
call fcn.14001ae50
test eax, eax
jne 0x14002066d
mov rcx, rdi
call fcn.14001aeb0
test eax, eax
jne 0x14002066d
mov rcx, rdi
call fcn.140018570
cmp byte [rbx + 0x19], 0
jne 0x1400206be
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14002069e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400206be
nop dword [rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140020690
jmp 0x1400206be
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400206bb
cmp rbx, qword [rax + 0x10]
jne 0x1400206bb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400206a8
mov rbx, rax
cmp rbx, qword [rsi + 0xa0]
jne 0x140020562
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003eed0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400206f0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r12, rcx
xorps xmm0, xmm0
movdqu xmmword [rax - 0x68], xmm0
xor r13d, r13d
mov qword [rax - 0x58], r13
lea rdx, [0x14001ac00]
lea rcx, [rax - 0x50]
call fcn.1400151b0
nop
lea r8, [0x140056122]
lea rdx, str.CItunesDeviceManager::ScanMountedVolumes__
mov ecx, 0x80000000
call fcn.140028400
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.1400151f0
test eax, eax
je 0x1400208aa
call fcn.14002c130
mov rbx, qword [rsp + 0x30]
cmp rbx, qword [rsp + 0x38]
je 0x1400208aa
nop word [rax + rax]
mov rdx, rbx
lea rcx, [r12 + 0xa0]
call fcn.1400212c0
mov rdi, rax
mov rsi, qword [r12 + 0xa0]
cmp rax, rsi
je 0x14002080e
lea rdx, [rax + 0x20]
mov r14, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400207b2
mov rdx, qword [rdx]
mov rbp, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400207c2
mov rcx, qword [rbx]
jmp 0x1400207c5
mov rcx, rbx
mov r8, r14
cmp rbp, r14
cmovb r8, rbp
test r8, r8
jne 0x1400207d9
mov eax, r13d
jmp 0x1400207de
call fcn.14003ef00
cdqe
test rax, rax
jne 0x1400207f8
cmp rbp, r14
jae 0x1400207ef
or eax, 0xffffffff
jmp 0x1400207f8
mov eax, r13d
cmp rbp, r14
setne al
test eax, eax
js 0x14002080e
mov qword [rsp + 0xb8], rdi
lea rax, [rsp + 0xb8]
jmp 0x140020818
mov qword [rsp + 0x20], rsi
lea rax, [rsp + 0x20]
mov rax, qword [rax]
cmp rax, rsi
je 0x14002089b
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14002089b
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0xb0]
call fcn.14001a140
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0xa8]
cmp dword [rsp + 0xb0], 0
je 0x14002089b
cmp eax, dword [reloc.OLEAUT32.dll_SafeArrayLock]
jb 0x14002089b
cmp qword [rbx + 0x18], 0x10
jb 0x140020869
mov r9, qword [rbx]
jmp 0x14002086c
mov r9, rbx
lea r8, str._SIMULATED_VOLUME_ARRIVAL__generating_volume_mount_for__s
lea rdx, str.CItunesDeviceManager::ScanMountedVolumes__
mov ecx, 4
call fcn.140028400
mov rdi, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
xor r8d, r8d
mov rcx, r12
call qword [rdi + 0x58]
jmp 0x14002089f
add rbx, 0x20
cmp rbx, qword [rsp + 0x38]
jne 0x140020780
lea rcx, [rsp + 0x48]
call fcn.1400151c0
nop
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140020904
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
je 0x1400208fc
nop dword [rax]
cmp qword [rbx + 0x18], 0x10
jb 0x1400208df
mov rcx, qword [rbx]
call fcn.14003cc98
mov qword [rbx + 0x18], SafeArrayLock
mov qword [rbx + 0x10], r13
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x1400208d0
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.14003cc98
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020a00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rsi, rcx
call fcn.14002c130
mov rbx, rax
xor ebp, ebp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rbp
mov r9d, 0x20019
mov r8, qword [0x14007a460]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140005000
mov rdi, qword [rsp + 0x38]
test eax, eax
jne 0x140020ace
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rdx, qword [str.EnableFastInjectEject]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140020ab4
cmp dword [rsp + 0x80], 4
jne 0x140020ab4
mov eax, ebp
cmp dword [rsp + 0x70], 1
sete al
mov dword [rsi + 0x138], eax
test rdi, rdi
je 0x140020aca
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], ebp
mov rcx, rbx
call fcn.14002c3b0
mov ebx, eax
test eax, eax
je 0x140020b45
mov dword [rsi + 0x134], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x128], rax
mov ebx, ebp
test rax, rax
setne bl
test ebx, ebx
je 0x140020b45
lea rcx, [rsi + 0x100]
lea r9, str.First_time_Connect_Handler_Thread
mov r8, rsi
lea rdx, [0x14001e4d0]
call fcn.1400125f0
mov ebx, eax
test eax, eax
je 0x140020b45
mov rcx, rsi
call fcn.140022560
mov ebx, eax
test eax, eax
je 0x140020b45
mov rcx, rsi
call fcn.140020bd0
mov ebx, ebp
test eax, eax
sete bl
lea rcx, [rsi + 0xf8]
call fcn.14002c790
test eax, eax
je 0x140020b8f
call fcn.14002a8c0
mov r8d, dword [rsi + 0xf8]
mov edx, 1
mov rcx, rax
call fcn.14002aab0
mov r9d, dword [rsi + 0xf8]
lea r8, str.Device_manager_starting_with_current_console_session__d
lea rdx, str.CItunesDeviceManager::Start
mov ecx, 0x80000000
call fcn.140028400
jmp 0x140020ba8
lea r8, str.Device_manager_could_not_get_the_current_console_session__may_be_Win2K
lea rdx, str.CItunesDeviceManager::Start
mov ecx, 0x80000000
call fcn.140028400
nop
test rdi, rdi
je 0x140020bb6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret