joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62960940
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x62960980
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x62960972
test byte [rcx + 0xd], 0x10
jne 0x62960972
cmp qword [rdx + 0x28], 0
jne 0x62960972
cmp qword [rcx + 0x28], rdx
je 0x62960983
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x62960972
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x62960a03
ja 0x62960a20
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x62960972
mov rcx, rbp
call fcn.62960530
test al, 4
jne 0x62960972
mov edx, eax
and edx, 3
cmp edx, 3
je 0x62960aa0
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x62960ad0
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x62960af6
mov rbx, qword [rcx]
test rbx, rbx
je 0x62960972
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x629609a4
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x62960a33
mov rcx, rbx
jmp 0x629609ef
cmp edx, 0xcd
jne 0x629609ae
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x62960972
cmp qword [rbx + 0x18], rdi
jne 0x62960972
cmp rcx, rbx
mov rax, qword [rbx]
je 0x62960b30
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x629609ef
test al, 8
je 0x62960b10
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x62960972
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x629609c8
jmp 0x62960972
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x62960972
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x629609ef
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x629609ef
jmp 0x62960972
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x629609c8
jmp 0x62960972
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x62960a57
Function at 0x6297ee60
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
cmp dword [rcx + 0x244], 0x10
ja 0x6297eee0
mov rbx, rcx
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov edi, r8d
call fcn.6291d540
test eax, eax
mov r14d, eax
jne 0x6297eee6
mov eax, dword [rbx + 0x240]
test eax, eax
jne 0x6297eed1
movsxd rcx, dword [rbx + 0x244]
test ecx, ecx
jne 0x6297ef00
cmp qword [rbx + 0x248], 0
je 0x6297f0f0
lea r13, [rbx + 0x228]
lea r12, [rbx + 0x1f8]
jmp 0x6297ef7a
cmp eax, 1
je 0x6297f100
nop word [rax + rax]
mov r14d, 0x10
lea rsp, [rbp - 0x38]
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbx + 0x23c]
lea r13, [rbx + 0x228]
test eax, eax
jne 0x6297ef40
cmp ecx, 0xc
jne 0x6297ef40
mov rax, qword [rbx + 0x228]
mov qword [rbx + 0x208], rax
mov eax, dword [r13 + 8]
mov dword [rbx + 0x214], 0x1000000
mov dword [rbx + 0x210], eax
jmp 0x6297efe5
lea eax, [rcx - 1]
lea r12, [rbx + 0x1f8]
lea r8, [rbx + rax + 0x1f9]
mov rdx, r12
movzx eax, byte [rdx + 0x30]
xor byte [rdx], al
add rdx, 1
cmp rdx, r8
jne 0x6297ef55
shl rcx, 3
add qword [rbx + 0x248], rcx
mov rdx, r12
mov rcx, rbx
call fcn.62917660
mov edx, 8
mov rcx, r13
call fcn.6291e040
mov rax, qword [rbx + 0x248]
mov rdx, r12
bswap rax
mov qword [rbx + 0x230], rax
lea rax, [rbx + 0x208]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rax, rdx
jne 0x6297efa2
mov rdx, r12
mov rcx, rbx
call fcn.62917660
mov rdx, qword [rbx + 0x200]
mov rax, qword [rbx + 0x1f8]
mov rcx, r12
mov qword [rbx + 0x210], rdx
mov qword [rbx + 0x208], rax
mov edx, 0x10
call fcn.6291e040
mov rdx, qword [rbx + 0x210]
mov rax, qword [rbx + 0x208]
mov rcx, r13
mov qword [rbx + 0x220], rdx
mov qword [rbx + 0x218], rax
mov edx, 0x10
call fcn.6291e040
mov qword [rbx + 0x240], 1
mov qword [rbx + 0x248], 0
mov r13d, edi
and r13d, 0xfffffff0
je 0x6297f120
lea r15, [rbx + 0x1f8]
xor r12d, r12d
nop dword [rax + rax]
mov eax, r12d
mov rdx, r15
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [r12 + 8]
add r12d, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.62917660
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12d, r13d
jb 0x6297f040
mov eax, r12d
add rsi, rax
cmp edi, r12d
jbe 0x6297eee6
sub edi, 1
sub edi, r12d
lea r12, [rsi + rdi + 1]
lea rdi, [rbx + 0x1f8]
jmp 0x6297f0a9
cmp rsi, r12
je 0x6297eee6
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
movzx ecx, byte [rsi - 1]
lea eax, [rdx + 1]
mov dword [rbx + 0x244], eax
xor byte [rbx + rdx + 0x1f8], cl
cmp eax, 0x10
jne 0x6297f0a0
mov rdx, rdi
mov rcx, rbx
call fcn.62917660
mov dword [rbx + 0x244], 0
sub qword [rbx + 0x248], 0xffffffffffffff80
jmp 0x6297f0a0
mov r14d, 1
jmp 0x6297eee6
mov eax, dword [rbx + 0x244]
cmp eax, 0xf
jg 0x6297eee0
xor r12d, r12d
test eax, eax
jne 0x6297f080
jmp 0x6297f024
xor r12d, r12d
jmp 0x6297f080
Function at 0x6297f550
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
mov ebp, 0x10
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x240]
test eax, eax
jne 0x6297f691
cmp dword [rcx + 0x244], 0xf
mov rbx, rcx
ja 0x6297f691
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov r12d, r8d
call fcn.6291d540
test eax, eax
mov ebp, eax
jne 0x6297f691
mov eax, dword [rbx + 0x244]
lea edx, [rax + r12]
cmp edx, 0xc
jbe 0x6297f5b2
or dword [rbx + 0x23c], 1
xor edi, edi
test eax, eax
jne 0x6297f60b
mov r13d, r12d
and r13d, 0xfffffff0
je 0x6297f6a2
lea r14, [rbx + 0x1f8]
nop dword [rax]
mov eax, edi
mov rdx, r14
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [rdi + 8]
add edi, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.62917660
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp edi, r13d
jb 0x6297f5d0
mov eax, edi
add rsi, rax
cmp r12d, edi
jbe 0x6297f691
sub r12d, 1
lea r13, [rbx + 0x1f8]
sub r12d, edi
lea rdi, [rbx + 0x208]
lea r12, [rsi + r12 + 1]
jmp 0x6297f635
cmp r12, rsi
je 0x6297f691
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
lea ecx, [rdx + 1]
mov dword [rbx + 0x244], ecx
movzx eax, byte [rsi - 1]
cmp ecx, 0x10
mov byte [rbx + rdx + 0x228], al
jne 0x6297f630
mov rdx, r13
nop dword [rax]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rdi, rdx
jne 0x6297f660
mov rdx, r13
mov rcx, rbx
call fcn.62917660
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12, rsi
mov dword [rbx + 0x244], 0
jne 0x6297f635
add rsp, 0x20
mov eax, ebp
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, eax
jmp 0x6297f60b
Function at 0x630e6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x630e61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x630e6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x630e606f
add dl, dl
jne 0x630e6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x630e60f6
xor eax, eax
add dl, dl
jne 0x630e60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x630e61ad
add dl, dl
jne 0x630e60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x630e60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x630e60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x630e60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x630e60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x630e607e
mov eax, 1
add dl, dl
jne 0x630e6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x630e6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x630e60fb
sub eax, ebx
mov ebx, 1
jne 0x630e614c
mov ecx, 1
add dl, dl
jne 0x630e612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x630e613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x630e6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x630e607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x630e6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x630e6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x630e615d
cmp eax, 0x7d00
jae 0x630e619b
cmp eax, 0x500
jb 0x630e6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x630e607e
cmp eax, 0x7f
ja 0x630e619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x630e607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x630e61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x630e607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001140
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x1480
call fcn.140023940
sub rsp, rax
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rsp + 0x1470], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x570]
mov r8d, 0x700
call fcn.140023ca0
xor edx, edx
lea rcx, [rsp + 0xc70]
mov r8d, 0x800
call fcn.140023ca0
xor edx, edx
mov qword [rsp + 0x60], 0
mov r8d, 0x100
lea rcx, [rsp + 0x470]
lea rsi, [rsp + 0x14b0]
call fcn.140023ca0
call fcn.140001000
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x470]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x7fffffff
mov rcx, qword [rax]
call fcn.1400112dc
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp edi, 2
jne 0x14000120b
lea r11, str.__ERR_
jmp 0x140001220
cmp edi, 1
lea rax, str.__WAR_
lea r11, [0x14002eb60]
cmove r11, rax
movzx ecx, word [rsp + 0x6c]
lea rbx, [rsp + 0x470]
movzx edx, word [rsp + 0x6a]
movzx r8d, word [rsp + 0x68]
movzx eax, word [rsp + 0x6e]
movzx r10d, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r11
lea r11, str.ELANFPSERVICE
mov qword [rsp + 0x48], r11
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0xc70]
mov dword [rsp + 0x30], edx
mov edx, 0x400
mov dword [rsp + 0x28], r8d
lea r8, str.__02d__02d__02d:_02d:_02d_03d____s__s__s_r_n
mov dword [rsp + 0x20], r10d
call fcn.140001010
lea rcx, [rsp + 0xc70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r8, [rsp + 0xc70]
lea rdx, [0x14002ebe8]
lea rcx, [rsp + 0x70]
call fcn.140001070
cmp edi, 2
jne 0x1400012de
mov rcx, qword [0x140037ab0]
lea rax, [0x140037ab0]
cmp rcx, rax
je 0x140001339
test byte [rcx + 0x1c], 1
je 0x140001339
cmp byte [rcx + 0x19], dil
jb 0x140001339
lea edx, [rdi + 8]
jmp 0x14000132b
cmp edi, 1
jne 0x140001307
mov rcx, qword [0x140037ab0]
lea rax, [0x140037ab0]
cmp rcx, rax
je 0x140001339
test byte [rcx + 0x1c], dil
je 0x140001339
cmp byte [rcx + 0x19], 3
jb 0x140001339
lea edx, [rdi + 0xa]
jmp 0x14000132b
mov rcx, qword [0x140037ab0]
lea rax, [0x140037ab0]
cmp rcx, rax
je 0x140001339
test byte [rcx + 0x1c], 1
je 0x140001339
cmp byte [rcx + 0x19], 4
jb 0x140001339
mov edx, 0xc
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x70]
call fcn.1400010d0
mov rcx, qword [rsp + 0x1470]
xor rcx, rsp
call fcn.1400059a0
add rsp, 0x1480
pop rdi
pop rsi
pop rbx
ret
Function at 0x140001ee0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, vtable.CServiceBase.0
mov qword [rcx], rax
lea rdi, [0x140038e60]
mov rcx, rdi
lea rdx, str._ELAN_Service__Enter_CServiceBase_Destructor...
call qword [sym.imp.USER32.dll_wsprintfW]
lea rsi, str.ELAN_Service
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140001f74
xor ecx, ecx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
mov r9d, 0x36b0
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], rcx
mov rcx, rbx
lea edx, [r8 + 4]
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400031f0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r12
push r14
push r15
sub rsp, 0x70
mov r15, r8
mov r12d, edx
mov rbx, qword [0x140039070]
mov qword [rsp + 0x90], rbx
lea rdx, str._ELAN_Service__Enter_CServiceBase::Start...
lea rdi, [0x140038e60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r14, str.ELAN_Service
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x1400032a5
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rdi
mov r14d, 2
xor r8d, r8d
lea edx, [r14 + 2]
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rdi
mov r9d, 0x36b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1400032ad
xor edi, edi
mov r14d, 2
mov dword [rbx + 0x34], r14d
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x48], edi
mov ecx, dword [0x140037ab8]
lea eax, [rcx + 1]
mov dword [0x140037ab8], eax
mov dword [rbx + 0x44], ecx
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rax, qword [rbx]
mov r8, r15
mov edx, r12d
mov rcx, rbx
call qword [rax + 8]
mov dword [rbx + 0x34], 4
mov dword [rbx + 0x3c], edi
mov qword [rbx + 0x44], 0
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140004bf0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rbx, qword [0x140039070]
mov qword [rsp + 0xa8], rbx
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0xa0], eax
lea rdx, str._ELAN_Service__Enter_CServiceBase::Stop...
lea r15, [0x140038e60]
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfW]
lea r12, str.ELAN_Service
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
mov r14d, 2
xor edi, edi
test rax, rax
je 0x140004c9e
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r15
xor r8d, r8d
lea edx, [rdi + 4]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rdi
mov r9d, 0x36b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rdx, str._ELAN_Service__UnregisterPowerSettingNotification...
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x140004d11
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r15
xor r8d, r8d
lea edx, [r8 + 4]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rdi
mov r9d, 0x36b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [0x140039070]
mov rcx, qword [rcx + 0x50]
call qword [sym.imp.USER32.dll_UnregisterPowerSettingNotification]
lea rdx, str._ELAN_Service__UnregisterPowerSettingNotification_Finish
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x140004d8c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r15
xor r8d, r8d
lea edx, [r8 + 4]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rdi
mov r9d, 0x36b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov dword [rbx + 0x34], 3
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x48], edi
mov ecx, dword [0x140037ab8]
lea eax, [rcx + 1]
mov dword [0x140037ab8], eax
mov dword [rbx + 0x44], ecx
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov dword [rbx + 0x34], 1
mov dword [rbx + 0x3c], edi
mov qword [rbx + 0x44], 0
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
nop
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140005260
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x70
mov rbx, qword [0x140039070]
mov qword [rsp + 0x80], rbx
lea rdx, str._ELAN_Service__Enter_CServiceBase::Pause_...
lea rdi, [0x140038e60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r14, str.ELAN_Service
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x140005306
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rdi
xor r8d, r8d
lea edx, [r8 + 4]
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], rdi
mov r9d, 0x36b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x140005308
xor edi, edi
mov dword [rbx + 0x34], 6
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x48], edi
mov ecx, dword [0x140037ab8]
lea eax, [rcx + 1]
mov dword [0x140037ab8], eax
mov dword [rbx + 0x44], ecx
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov dword [rbx + 0x34], 7
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x48], edi
mov ecx, dword [0x140037ab8]
lea eax, [rcx + 1]
mov dword [0x140037ab8], eax
mov dword [rbx + 0x44], ecx
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400053a0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x70
mov rbx, qword [0x140039070]
mov qword [rsp + 0x80], rbx
lea rdx, str._ELAN_Service__Enter_CServiceBase::Continue_...
lea rdi, [0x140038e60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r14, str.ELAN_Service
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x140005446
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rdi
xor r8d, r8d
lea edx, [r8 + 4]
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], rdi
mov r9d, 0x36b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x140005448
xor edi, edi
mov dword [rbx + 0x34], 5
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x48], edi
mov ecx, dword [0x140037ab8]
lea eax, [rcx + 1]
mov dword [0x140037ab8], eax
mov dword [rbx + 0x44], ecx
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov dword [rbx + 0x34], 4
mov dword [rbx + 0x3c], edi
mov qword [rbx + 0x44], 0
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1400054c0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x70
mov rbx, qword [0x140039070]
lea rdx, str._ELAN_Service__Enter_CServiceBase::Shutdown...
lea rdi, [0x140038e60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r14, str.ELAN_Service
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x140005559
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rdi
xor r8d, r8d
lea edx, [r8 + 4]
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], rdi
mov r9d, 0x36b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x14000555b
xor edi, edi
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov dword [rbx + 0x34], 1
mov dword [rbx + 0x3c], edi
mov qword [rbx + 0x44], 0
lea rdx, [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1400055e0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov edi, edx
lea rbp, str.ELAN_Service
mov rsi, rcx
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000565c
xor ecx, ecx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
mov r9d, 0x36b0
mov word [rsp + 0x28], 2
movzx edx, di
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov qword [rsp + 0x58], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400058d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.S_1_5_19SoftwareElanFPEngineBehavior
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005970
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rdx, str.pRestart
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
mov ebx, 0xffffffff
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005959
cmp dword [rsp + 0x40], 4
cmove ebx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov r8d, eax
lea rdx, str._ReadRestartfromReg__ReadSensorModefromReg_error__Result___d_
mov ecx, 2
call fcn.140001140
mov eax, 0x63
add rsp, 0x38
ret

Function at 0x1400063ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006436
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006436
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006436
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006436
cmp dword [rcx + 0x84], 0xe
jbe 0x140006436
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006438
xor al, al
add rsp, 0x28
ret