joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005c50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.1400208c0
sub rsp, rax
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov eax, dword [rcx + 0x14]
mov rdi, rdx
mov rbx, rcx
test eax, eax
je 0x140005e07
cmp eax, 2
jl 0x140005ca8
cmp qword [rcx], 0xffffffffffffffff
je 0x140005e07
mov qword [rsp + 0x1098], rsi
lea rcx, [rbp + 0x780]
xor edx, edx
mov qword [rsp + 0x50], 0
mov r8d, 0x800
lea rsi, [rbp + 0xfd0]
call fcn.140022630
mov r9, rsi
lea rcx, [rbp + 0x780]
mov r8, rdi
call fcn.140005a40
mov rsi, qword [rsp + 0x1098]
test al, al
je 0x140005e07
lea rcx, [rsp + 0x50]
call fcn.14002a2b8
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140029e9c
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x800
call fcn.140022630
mov ecx, dword [rbx + 0x14]
sub ecx, 1
je 0x140005d36
sub ecx, 1
je 0x140005d96
cmp ecx, 1
jne 0x140005e07
mov r9d, dword [rsp + 0x68]
lea rax, [rbp + 0x780]
mov r8d, dword [rsp + 0x6c]
lea rdx, str._04d__02d__02d__02d:_02d:_02d__s_r_n
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov eax, dword [rsp + 0x58]
inc r9d
mov dword [rsp + 0x38], eax
add r8d, 0x76c
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
call fcn.140007610
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rbx + 0x14], 3
jne 0x140005e07
mov r9d, dword [rsp + 0x68]
lea rax, [rbp + 0x780]
mov r8d, dword [rsp + 0x6c]
lea rdx, str._04d__02d__02d__02d:_02d:_02d___s_r_n
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov eax, dword [rsp + 0x58]
inc r9d
mov dword [rsp + 0x38], eax
add r8d, 0x76c
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
call fcn.140007610
lea rax, [rbp - 0x80]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x140005df1
mov rdx, qword [rbx]
lea r8, [rbp - 0x80]
call fcn.140005e30
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x10a0
pop rdi
pop rbx
pop rbp
ret

Function at 0x140005e30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov ebx, r9d
mov dword [rsp + 0x30], r15d
mov edi, r15d
mov rsi, r8
mov r14, rdx
mov ebp, r9d
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
mov r8d, ebx
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140005ea9
mov eax, dword [rsp + 0x30]
sub ebx, eax
add edi, eax
cmp edi, ebp
ja 0x140005ea0
add rsi, rax
test ebx, ebx
jne 0x140005e70
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001fab0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005ed0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
test r9, r9
jne 0x140005f0c
lea rcx, str.error_argument_is_null
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], r14
call fcn.1400011a0
mov qword [rsp + 0x28], rbx
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov r14, rax
mov rcx, qword [rax]
or rcx, 2
call fcn.140029090
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
inc eax
cmp eax, 0x800
jb 0x140005f5f
lea rcx, str.error_argument_is_too_big
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x140005f83
mov rcx, qword [r14]
mov r9, rdi
mov qword [rsp + 0x28], rbx
mov r8d, 0x800
mov rdx, rsi
mov qword [rsp + 0x20], 0
call fcn.140029098
mov al, 1
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140006070
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, r8
mov qword [rsp + 0x40], 0
mov edi, edx
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
mov rbp, r9
call fcn.140022630
test ebx, ebx
jne 0x1400060c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov r9d, 0x400
mov r8d, edi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140006119
mov r9d, edi
lea r8, str.__SYSTEM_ERROR:_lu_
mov edx, 0x104
mov rcx, rsi
call fcn.1400011b0
jmp 0x1400061b1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea ecx, [rax + 0x14]
cmp ecx, ebp
jl 0x14000614f
lea rcx, str.getErrorCodeMsg_buffer_size_is_to_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r9d, edi
lea r8, str.__SYSTEM_ERROR:_lu_
mov edx, 0x104
mov rcx, rsi
call fcn.1400011b0
jmp 0x1400061a6
mov rdx, qword [rsp + 0x40]
lea r9d, [rax - 2]
movsxd rax, r9d
cmp word [rdx + rax*2], 0xd
jne 0x14000618a
lea eax, [r8 - 1]
movsxd rcx, eax
cmp word [rdx + rcx*2], 0xa
jne 0x14000618a
mov r8d, r9d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x14000618f
mov qword [rsp + 0x20], rdx
mov r9d, edi
lea r8, str.__SYSTEM_ERROR:_lu__s_
mov edx, 0x104
mov rcx, rsi
call fcn.1400011b0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001fab0
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400061e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
sub rsp, 0xc88
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov eax, dword [rcx + 0x14]
mov rbx, rdx
mov rsi, rcx
test eax, eax
je 0x1400063eb
cmp eax, 2
jl 0x140006225
cmp qword [rcx], 0xffffffffffffffff
je 0x1400063eb
mov qword [rsp + 0xc80], rbp
lea rcx, [rsp + 0x250]
xor edx, edx
mov qword [rsp + 0xc78], rdi
mov r8d, 0x208
call fcn.140022630
mov r9d, 0x104
lea r8, [rsp + 0x250]
xor edx, edx
xor ecx, ecx
call fcn.140006070
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
lea rbp, [rsp + 0xcb8]
mov edi, eax
call fcn.140022630
mov r8, qword [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
mov r9, rbp
call fcn.140005ed0
test al, al
je 0x1400063db
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, edi
cmp eax, 0x104
jl 0x1400062ce
lea rcx, str.buffer_is_too_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1400063db
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140029170
test rbx, rbx
je 0x1400062f8
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [rsi + 0x14]
sub ecx, 1
je 0x14000630e
sub ecx, 1
je 0x140006354
cmp ecx, 1
jne 0x1400063db
xor edx, edx
lea rcx, [rsp + 0x460]
mov r8d, 0x800
call fcn.140022630
lea r8, [rsp + 0x40]
lea rdx, str._s__r
lea rcx, [rsp + 0x460]
call fcn.140002370
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsi + 0x14], 3
jne 0x1400063db
lea r8, [0x140059a44]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140029170
xor ebp, ebp
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], ebp
lea r9d, [rbp - 1]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov ebx, eax
call fcn.14001fdb4
mov qword [rsp + 0x38], rbp
lea r9d, [rbp - 1]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsi]
lea r9d, [rbx - 1]
mov r8, rdi
call fcn.140005e30
mov rcx, rdi
call fcn.14001fad4
mov rbp, qword [rsp + 0xc80]
mov rdi, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0xc88
pop rsi
pop rbx
ret
Function at 0x140006410
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x830
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, qword [rsp + 0x880]
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x800
mov rbp, r9
call fcn.140022630
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.140005a40
test al, al
je 0x140006489
lea rcx, [rsp + 0x20]
call fcn.140014e40
mov rdi, rax
test rax, rax
jne 0x14000648d
lea rcx, str.dump_output_msg_AnsiToUnicode_fail
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x1400064e4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
cmp ebx, ebp
jl 0x1400064c0
lea rcx, str.dump_output_msg_buffer_is_too_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.14001fad4
xor al, al
jmp 0x1400064e4
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.14001fad4
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call fcn.140029170
mov al, 1
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x830
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006510
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rsi
sub rsp, 0x688
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400066ed
test r8, r8
je 0x1400066ed
mov qword [r11 - 0x18], rbp
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [r11 - 0x28], r14
mov r8d, 0x208
call fcn.140022630
mov r9d, 0x104
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call fcn.140006070
mov ebp, eax
mov eax, dword [rsi + 0x14]
test eax, eax
je 0x1400066c1
cmp eax, 2
jl 0x140006598
cmp qword [rsi], 0xffffffffffffffff
je 0x1400066c1
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x400
call fcn.140022630
mov rcx, qword [rsp + 0x6b0]
lea rax, [rsp + 0x6b8]
mov r9d, 0x104
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x50]
xor r14d, r14d
call fcn.140006410
test al, al
je 0x1400066c1
mov rdx, rbx
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [0x140059a44]
mov edx, 0x200
lea rcx, [rsp + 0x260]
call fcn.140029170
mov ecx, dword [rsi + 0x14]
sub ecx, 1
je 0x140006620
sub ecx, 1
je 0x140006638
cmp ecx, 1
jne 0x1400066c1
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsi + 0x14], 3
jne 0x1400066c1
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x260]
mov qword [rsp + 0x30], r14
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x678], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov ebx, eax
call fcn.14001fdb4
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x260]
mov qword [rsp + 0x30], r14
mov r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsi]
mov r9d, ebx
mov r8, rdi
call fcn.140005e30
mov rcx, rdi
call fcn.14001fad4
mov rdi, qword [rsp + 0x678]
mov r14, qword [rsp + 0x670]
mov eax, ebp
mov rbp, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x688
pop rsi
pop rbx
ret
mov eax, 0xffffffff
jmp 0x1400066d3
Function at 0x140006700
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
mov eax, 0x1078
call fcn.1400208c0
sub rsp, rax
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov eax, dword [rcx + 0x14]
mov ebx, edx
mov rsi, rcx
test eax, eax
je 0x1400068bc
cmp eax, 2
jl 0x14000674a
cmp qword [rcx], 0xffffffffffffffff
je 0x1400068bc
xor edx, edx
mov qword [rsp + 0x1070], rbp
mov r8d, 0x800
lea rcx, [rsp + 0x850]
call fcn.140022630
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x800
call fcn.140022630
mov r9d, 0x400
lea r8, [rsp + 0x850]
mov edx, ebx
mov ecx, 1
call fcn.140006070
mov rcx, qword [rsp + 0x10a0]
lea rax, [rsp + 0x10a8]
mov r9d, 0x400
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
xor ebp, ebp
lea rdx, [rsp + 0x850]
call fcn.140006410
test al, al
je 0x1400068b4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
cmp eax, 0x400
jl 0x1400067f1
lea rcx, str.dump_errorcode_buffer_is_too_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1400068b4
lea r8, [0x140059a44]
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.140029170
mov ecx, dword [rsi + 0x14]
sub ecx, 1
je 0x14000681d
sub ecx, 1
je 0x140006832
cmp ecx, 1
jne 0x1400068b4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsi + 0x14], 3
jne 0x1400068b4
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov r9d, 0xffffffff
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x1068], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov ebx, eax
call fcn.14001fdb4
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsi]
mov r9d, ebx
mov r8, rdi
call fcn.140005e30
mov rcx, rdi
call fcn.14001fad4
mov rdi, qword [rsp + 0x1068]
mov rbp, qword [rsp + 0x1070]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x1078
pop rsi
pop rbx
ret
Function at 0x1400068e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rsi
sub rsp, 0xc70
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0xc40], rax
mov eax, dword [rcx + 0x14]
mov rsi, rcx
test eax, eax
je 0x140006aa1
cmp eax, 2
jl 0x140006926
cmp qword [rcx], 0xffffffffffffffff
je 0x140006aa1
xor edx, edx
lea rcx, [rsp + 0x840]
mov r8d, 0x400
call fcn.140022630
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x800
call fcn.140022630
mov r9d, 0x200
lea r8, [rsp + 0x840]
xor edx, edx
xor ecx, ecx
call fcn.140006070
mov rcx, qword [rsp + 0xc88]
lea rax, [rsp + 0xc90]
mov r9d, 0x400
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x840]
call fcn.140006410
test al, al
je 0x140006aa1
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
cmp eax, 0x400
jl 0x1400069c0
lea rcx, str.dump_errorcode_buffer_is_too_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140006aa1
lea r8, [0x140059a44]
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.140029170
mov ecx, dword [rsi + 0x14]
sub ecx, 1
je 0x1400069ec
sub ecx, 1
je 0x140006a01
cmp ecx, 1
jne 0x140006aa1
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsi + 0x14], 3
jne 0x140006aa1
mov qword [rsp + 0xc68], rbx
lea r8, [rsp + 0x40]
mov qword [rsp + 0xc60], rbp
xor edx, edx
xor ebp, ebp
mov qword [rsp + 0xc58], rdi
mov qword [rsp + 0x38], rbp
xor ecx, ecx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
lea r9d, [rbp - 1]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov ebx, eax
call fcn.14001fdb4
mov qword [rsp + 0x38], rbp
lea r9d, [rbp - 1]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsi]
mov r9d, ebx
mov r8, rdi
call fcn.140005e30
mov rcx, rdi
call fcn.14001fad4
mov rdi, qword [rsp + 0xc58]
mov rbp, qword [rsp + 0xc60]
mov rbx, qword [rsp + 0xc68]
mov rcx, qword [rsp + 0xc40]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0xc70
pop rsi
ret
Function at 0x14000e970
Capabilities:
Receive http response

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rcx + 0x10]
test edx, edx
je 0x14000e9e9
mov r9d, 4
mov dword [rsp + 0x40], 0x3100
lea r8, [rsp + 0x40]
mov rcx, rbx
lea edx, [r9 + 0x1b]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x14000e9e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call fcn.140003ed0
mov rcx, rax
lea rdx, str.WinHttpSetOption_Fails___err:_0x_x
mov r8d, ebx
call fcn.140005c50
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x50
pop rbx
ret
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x14000ea45
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call fcn.140003ed0
mov rcx, rax
lea rdx, str.WinHttpSendRequest_Fails___err:_0x_x
mov r8d, ebx
call fcn.140005c50
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x50
pop rbx
ret
Function at 0x1400127b0
Capabilities:
Create service
Persist via windows service
Print debug messages

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.create_control_start
call fcn.140005b00
mov rcx, qword [rbx]
lea r9, [rbx + 0x424]
lea rax, [rbx + 0x21c]
mov qword [rsp + 0x60], rax
lea r8, [rbx + 0x14]
mov qword [rsp + 0x58], r8
lea r10, [rbx + 0x62c]
mov qword [rsp + 0x50], r9
lea rdx, [rbx + 0x834]
xor eax, eax
lea r8, str.AsusROGLSLService_Download_ROGLSLoader
mov qword [rsp + 0x48], rax
mov r9d, 0x10037
mov qword [rsp + 0x40], rax
mov eax, dword [rbx + 0x10]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
xor edx, edx
xor ecx, ecx
mov qword [rbx + 8], rax
call fcn.140003ed0
mov rcx, rax
lea rdx, str.create_control_end
add rsp, 0x70
pop rbx
jmp fcn.140005b00
Function at 0x140012fa0
Capabilities:
Query service status
Stop service

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140012fd7
lea eax, [rcx - 1]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x50
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x68], rbx
xor ebx, ebx
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400130ad
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140013053
cmp dword [rsp + 0x24], 3
jne 0x140013053
cmp ebx, 5
je 0x140013087
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
inc ebx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140013027
cmp dword [rsp + 0x24], 1
je 0x1400130ad
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea r9, [rdi + 0x834]
lea r8, str.close_remote_control_fail___S
lea rdx, [rdi + 0xa3c]
call fcn.140006510
mov eax, 0xffffffff
jmp 0x1400130af
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea r8, [rdi + 0x834]
lea rdx, str.dont_close_control__S
call fcn.140005b00
mov eax, 0xffffffff
jmp 0x1400130af
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x50
pop rdi
ret

Function at 0x140013970
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x210]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400139fc
mov rcx, qword [rdi + 0x210]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001fab0
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013a20
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400131c0
mov rdx, qword [rdi + 0x210]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140013acf
mov rcx, qword [rdi + 0x210]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14001fab0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret