joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000155a
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400052c0
sub rsp, 0x38
xor eax, eax
mov word [0x140064930], ax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400052ee
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x1400052f5
mov rax, qword [0x140064bc8]
mov qword [rsp + 0x28], rax
lea r9, [0x140064930]
lea r8, str._LocalAppData_TOSHIBATSDRMService.txt
lea rdx, str.LogFile
lea rcx, [0x14004b3c8]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [0x140064930]
add rsp, 0x38
ret

Function at 0x14000157d
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004ad0
sub rsp, 0x28
mov eax, dword [0x140064bc4]
test al, 1
jne 0x140004b33
or eax, 1
mov dword [0x140064bc4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004b08
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x140004b0f
mov rax, qword [0x140064bc8]
lea rdx, str.Flush
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064bc0], eax
jmp 0x140004b39
mov ecx, dword [0x140064bc0]
test ecx, ecx
je 0x140004b48
dec ecx
jne 0x140004b48
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400017d0
Capabilities:
Print debug messages

Disassembly:
jmp 0x140004720
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1400648f0]
mov rdi, rdx
mov rbx, rcx
test al, 1
jne 0x140004759
or eax, 1
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
jmp 0x140004760
mov r8d, dword [0x1400648ec]
cmp r8d, 1
jne case.default.0x140004773
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test al, 1
jne 0x14000479e
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 2
jne 0x1400047df
mov rcx, rbx
call fcn.140001401
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400103b0
cmp byte [rbx + 8], 0
je 0x1400048bd
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140010d10
test al, 1
jne 0x140004803
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 3
jne 0x140004888
mov eax, dword [0x14006492c]
test al, 1
jne 0x14000482d
or eax, 1
mov rcx, rbx
mov dword [0x14006492c], eax
call fcn.14000155a
mov qword [0x140064920], rax
jmp 0x140004834
mov rax, qword [0x140064920]
lea r8, [0x14004b8a0]
lea rcx, [rsp + 0x20]
xor r9d, r9d
mov rdx, rax
call fcn.14000101e
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400103b0
cmp byte [rsp + 0x28], 0
je 0x14000486e
mov rcx, qword [rsp + 0x20]
call fcn.140010d10
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
call fcn.140010bd4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test al, 1
jne 0x1400048a6
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
cmp r8d, 4
jne 0x1400048bd
call fcn.140010150
mov rdx, rdi
lea rcx, [rax + 0x60]
call fcn.14001031c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rcx
xlatb
push r15
add eax, 0xf82bc03
invalid
or al, 0xc4
sbb ebp, edx
push rdx
adc al, 0xdb
outsd dx, dword [rsi]
adc ebx, dword [rsi + rdi*8]
sbb ch, byte [rsi + 0x5054a43c]
ret 0xb88d

Function at 0x140001807
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004cc0
sub rsp, 0x28
mov eax, dword [0x140064bac]
test al, 1
jne 0x140004d26
or eax, 1
mov dword [0x140064bac], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004cf8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x140004cff
mov rax, qword [0x140064bc8]
lea rdx, str.Destination
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064ba8], eax
jmp 0x140004d2c
mov ecx, dword [0x140064ba8]
test ecx, ecx
je 0x140004d66
dec ecx
je 0x140004d5c
dec ecx
je 0x140004d52
dec ecx
je 0x140004d48
dec ecx
jne 0x140004d52
lea eax, [rcx + 4]
add rsp, 0x28
ret
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001811
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400050b0
sub rsp, 0x28
mov eax, dword [0x140064bbc]
test al, 1
jne 0x140005114
or eax, 1
mov dword [0x140064bbc], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400050e8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x1400050ef
mov rax, qword [0x140064bc8]
lea rdx, str.TimeDateFormat
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x140064bb8], eax
jmp 0x14000511a
mov eax, dword [0x140064bb8]
test eax, eax
je 0x140005148
dec eax
je 0x14000513e
dec eax
je 0x140005134
dec eax
jne 0x14000513e
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140003b40
Capabilities:
Query environment variable

Disassembly:
jmp 0x140003b40
push rbx
push rsi
push rdi
sub rsp, 0x6b0
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rax, rdx
mov rdi, r8
mov rbx, rcx
mov byte [rcx + 8], r9b
xor esi, esi
lea rdx, [rsp + 0x70]
mov qword [rcx], rsi
mov rcx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.140010a24
cmp eax, 2
jne 0x140003c16
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x280]
lea r8d, [rsi + 0xa]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x104
call fcn.14000fdd0
lea r9, [rsp + 0x280]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x490]
mov edx, 0x104
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call fcn.14000fc78
lea rcx, [rsp + 0x490]
call fcn.140010264
lea rdx, [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.140010a24
mov rax, rbx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140011a80
add rsp, 0x6b0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004720
Capabilities:
Print debug messages

Disassembly:
jmp 0x140004720
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1400648f0]
mov rdi, rdx
mov rbx, rcx
test al, 1
jne 0x140004759
or eax, 1
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
jmp 0x140004760
mov r8d, dword [0x1400648ec]
cmp r8d, 1
jne case.default.0x140004773
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test al, 1
jne 0x14000479e
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 2
jne 0x1400047df
mov rcx, rbx
call fcn.140001401
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400103b0
cmp byte [rbx + 8], 0
je 0x1400048bd
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140010d10
test al, 1
jne 0x140004803
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
mov eax, dword [0x1400648f0]
cmp r8d, 3
jne 0x140004888
mov eax, dword [0x14006492c]
test al, 1
jne 0x14000482d
or eax, 1
mov rcx, rbx
mov dword [0x14006492c], eax
call fcn.14000155a
mov qword [0x140064920], rax
jmp 0x140004834
mov rax, qword [0x140064920]
lea r8, [0x14004b8a0]
lea rcx, [rsp + 0x20]
xor r9d, r9d
mov rdx, rax
call fcn.14000101e
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
mov rdx, rdi
call fcn.1400103b0
cmp byte [rsp + 0x28], 0
je 0x14000486e
mov rcx, qword [rsp + 0x20]
call fcn.140010d10
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400048bd
call fcn.140010bd4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test al, 1
jne 0x1400048a6
or eax, 1
mov rcx, rbx
mov dword [0x1400648f0], eax
call fcn.140001807
mov r8d, eax
mov dword [0x1400648ec], eax
cmp r8d, 4
jne 0x1400048bd
call fcn.140010150
mov rdx, rdi
lea rcx, [rax + 0x60]
call fcn.14001031c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rcx
xlatb
push r15
add eax, 0xf82bc03
invalid
or al, 0xc4
sbb ebp, edx
push rdx
adc al, 0xdb
outsd dx, dword [rsi]
adc ebx, dword [rsi + rdi*8]
sbb ch, byte [rsi + 0x5054a43c]
ret 0xb88d

Function at 0x140004ad0
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004ad0
sub rsp, 0x28
mov eax, dword [0x140064bc4]
test al, 1
jne 0x140004b33
or eax, 1
mov dword [0x140064bc4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004b08
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x140004b0f
mov rax, qword [0x140064bc8]
lea rdx, str.Flush
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064bc0], eax
jmp 0x140004b39
mov ecx, dword [0x140064bc0]
test ecx, ecx
je 0x140004b48
dec ecx
jne 0x140004b48
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x140004cc0
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004cc0
sub rsp, 0x28
mov eax, dword [0x140064bac]
test al, 1
jne 0x140004d26
or eax, 1
mov dword [0x140064bac], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004cf8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x140004cff
mov rax, qword [0x140064bc8]
lea rdx, str.Destination
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064ba8], eax
jmp 0x140004d2c
mov ecx, dword [0x140064ba8]
test ecx, ecx
je 0x140004d66
dec ecx
je 0x140004d5c
dec ecx
je 0x140004d52
dec ecx
je 0x140004d48
dec ecx
jne 0x140004d52
lea eax, [rcx + 4]
add rsp, 0x28
ret
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140004df0
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004df0
sub rsp, 0x28
mov eax, dword [0x140064ba4]
test al, 1
jne 0x140004e53
or eax, 1
mov dword [0x140064ba4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004e28
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x140004e2f
mov rax, qword [0x140064bc8]
lea rdx, str.Level
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064ba0], eax
jmp 0x140004e59
mov ecx, dword [0x140064ba0]
test ecx, ecx
je 0x140004e85
dec ecx
je 0x140004e7b
dec ecx
je 0x140004e71
dec ecx
jne 0x140004e85
lea eax, [rcx + 3]
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140004f90
Capabilities:
Read .ini file

Disassembly:
jmp 0x140004f90
sub rsp, 0x28
mov eax, dword [0x140064bb4]
test al, 1
jne 0x140004ff3
or eax, 1
mov dword [0x140064bb4], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x140004fc8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x140004fcf
mov rax, qword [0x140064bc8]
lea rdx, str.SourceFileFormat
lea rcx, [0x14004b3c8]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
mov dword [0x140064bb0], eax
jmp 0x140004ff9
mov ecx, dword [0x140064bb0]
test ecx, ecx
je 0x14000500b
dec ecx
jne 0x14000500b
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400050b0
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400050b0
sub rsp, 0x28
mov eax, dword [0x140064bbc]
test al, 1
jne 0x140005114
or eax, 1
mov dword [0x140064bbc], eax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400050e8
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x1400050ef
mov rax, qword [0x140064bc8]
lea rdx, str.TimeDateFormat
lea rcx, [0x14004b3c8]
mov r9, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x140064bb8], eax
jmp 0x14000511a
mov eax, dword [0x140064bb8]
test eax, eax
je 0x140005148
dec eax
je 0x14000513e
dec eax
je 0x140005134
dec eax
jne 0x14000513e
mov eax, 3
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400052c0
Capabilities:
Read .ini file

Disassembly:
jmp 0x1400052c0
sub rsp, 0x38
xor eax, eax
mov word [0x140064930], ax
mov eax, dword [0x140064bd4]
test al, 1
jne 0x1400052ee
or eax, 1
mov dword [0x140064bd4], eax
call fcn.14000133e
mov qword [0x140064bc8], rax
jmp 0x1400052f5
mov rax, qword [0x140064bc8]
mov qword [rsp + 0x28], rax
lea r9, [0x140064930]
lea r8, str._LocalAppData_TOSHIBATSDRMService.txt
lea rdx, str.LogFile
lea rcx, [0x14004b3c8]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [0x140064930]
add rsp, 0x38
ret
Function at 0x140009ea0
Capabilities:
Create thread

Disassembly:
jmp 0x140009ea0
push rbx
sub rsp, 0x60
lea rax, str.CRadioManagerControl::InitRMControl
mov rbx, rcx
lea r9, [0x14004b650]
mov qword [rsp + 0x30], rax
lea rax, str.__CRadioManagerControl::InitRMControl_
lea rdx, str.RadioManager.cpp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x38]
mov r8d, 0x131
mov dword [rsp + 0x20], 3
call fcn.1400010c8
mov r8, qword [rsp + 0x30]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x38]
call fcn.1400016e5
lea rax, [rbx + 0x40]
lea r8, [0x140001550]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rsp + 0x30]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x38]
mov qword [rbx + 0x30], rax
call fcn.1400016e5
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x14000a930
Capabilities:
Create thread

Disassembly:
jmp 0x14000a930
push rbx
sub rsp, 0x60
lea rax, str.CRadioManagerControl::RMStart
mov rbx, rcx
lea r9, [0x14004b650]
mov qword [rsp + 0x30], rax
lea rax, str.__CRadioManagerControl::RMStart_
lea rdx, str.RadioManager.cpp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x38]
mov r8d, 0x163
mov dword [rsp + 0x20], 3
call fcn.1400010c8
mov r8, qword [rsp + 0x30]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x38]
call fcn.1400016e5
lea rax, [rbx + 0x44]
lea r8, [0x1400014f6]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rsp + 0x30]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x38]
mov qword [rbx + 0x38], rax
call fcn.1400016e5
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x14000aa00
Capabilities:
Terminate thread

Disassembly:
jmp 0x14000aa00
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rbx, rcx
lea rax, str.CRadioManagerControl::RMStop
mov qword [r11 - 0x38], rax
lea rsi, str.__CRadioManagerControl::RMStop_
mov qword [r11 - 0x70], rsi
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x170
lea rdx, str.RadioManager.cpp
lea rcx, [r11 - 0x30]
call fcn.1400010c8
mov r8, qword [rsp + 0x60]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x68]
call fcn.1400016e5
nop
xor edi, edi
mov dword [rsp + 0xa0], edi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000aab7
lea rdx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0xa0], 0x103
jne 0x14000aaa9
xor edx, edx
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], rdi
lea r9, str.OnRadiOChange
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov dword [rbx + 0x28], 1
test rax, rax
je 0x14000ab27
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x185
lea rdx, str.RadioManager.cpp
lea rcx, [rsp + 0x38]
call fcn.1400010c8
mov rcx, rax
lea rdx, str.Stop_Services_
call fcn.1400016e5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x60]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x68]
call fcn.1400016e5
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000be80
Capabilities:
Query service status

Disassembly:
jmp 0x14000be80
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rax, str.CheckPreviousServiceStatus
mov qword [rsp + 0x38], rax
lea rbp, str.__CheckPreviousServiceStatus_
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x55
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x40]
call fcn.1400010c8
mov r8, qword [rsp + 0x38]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
nop
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000bf81
mov ebx, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
lea r8d, [rax + 0x5e]
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c050
mov r8d, 0xf01ff
lea rdx, str.TOSRMService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14000bfdd
mov ebx, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
lea r8d, [rax + 0x61]
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c046
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne al
test al, al
jne 0x14000c03b
mov ebx, 0x80004005
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0
lea r9, [0x14004b650]
mov r8d, 0x63
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c03d
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8, qword [rsp + 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140011a80
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000d490
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
jmp 0x14000d490
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
lea rax, str.UninstallService
mov qword [rsp + 0x38], rax
lea rbp, str.__UninstallService_
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0xab
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x40]
call fcn.1400010c8
mov r8, qword [rsp + 0x38]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
nop
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000d575
mov edi, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
mov r8d, 0xb2
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000d61e
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000d5cf
mov edi, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
mov r8d, 0xb5
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000d614
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x94], 1
je 0x14000d600
lea r8, [rsp + 0x90]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
xor edi, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8, qword [rsp + 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140011a80
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140010264
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001027c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001027e
xor eax, eax
test eax, eax
je 0x14001028e
mov ecx, eax
call fcn.140014410
or eax, 0xffffffff
jmp 0x140010290
xor eax, eax
add rsp, 0x28
ret
Function at 0x140950058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409501df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140950089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095006f
add dl, dl
jne 0x140950096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409500f6
xor eax, eax
add dl, dl
jne 0x1409500a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409501ad
add dl, dl
jne 0x1409500b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409500c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409500d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409500dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409500ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14095007e
mov eax, 1
add dl, dl
jne 0x140950106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140950113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409500fb
sub eax, ebx
mov ebx, 1
jne 0x14095014c
mov ecx, 1
add dl, dl
jne 0x14095012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140950123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140950168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140950175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095015d
cmp eax, 0x7d00
jae 0x14095019b
cmp eax, 0x500
jb 0x140950196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095007e
cmp eax, 0x7f
ja 0x14095019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409501d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14095007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20