joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6d8e63600
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x7ff6d8e63622
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x7ff6d8e636a3
mov rdi, r14
mov rcx, rbx
call fcn.7ff6d8e65b00
test rax, rax
jle 0x7ff6d8e63674
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.7ff6d8e9db70
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x7ff6d8e63693
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [0x7ff6d8ec9610]
cmp eax, 0xffffffff
je 0x7ff6d8e6369b
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x7ff6d8e63636
sub r14, rdi
jmp 0x7ff6d8e63798
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x7ff6d8e636ba
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x7ff6d8e636bc
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x7ff6d8e636f1
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.7ff6d8e9db70
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x7ff6d8e63795
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x7ff6d8e6372c
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x7ff6d8e63770
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.7ff6d8ea51f4
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x7ff6d8e637ae
cmp rbp, rax
ja 0x7ff6d8e63740
mov r8, rdi
test rdi, rdi
je 0x7ff6d8e63795
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.7ff6d8ea51f4
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x7ff6d8e63798
Function at 0x7ff6d8e63c10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x7ff6d8e63c40
xor eax, eax
jmp 0x7ff6d8e63d90
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x7ff6d8e63c7a
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x7ff6d8e63c7a
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x7ff6d8e63d90
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x7ff6d8e63d83
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x7ff6d8e63cbd
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x7ff6d8e63ccc
movsx ecx, dil
jmp 0x7ff6d8e63d2a
lea r8, [rsp + 0x50]
mov byte [rsp + 0x60], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x61]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [0x7ff6d8ec9610]
test eax, eax
js 0x7ff6d8e63d83
cmp eax, 1
jle 0x7ff6d8e63d44
cmp eax, 3
jne 0x7ff6d8e63d83
movsx ecx, byte [rsp + 0x60]
mov rdx, qword [rbx + 0x80]
call fcn.7ff6d8ea1850
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x7ff6d8e63d88
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rsi, rax
je 0x7ff6d8e63d71
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rsi
mov edx, 1
call fcn.7ff6d8ea4a40
cmp rsi, rax
jne 0x7ff6d8e63d83
lea rax, [rsp + 0x60]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x58], rax
mov eax, edi
jne 0x7ff6d8e63d88
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x7ff6d8e65820
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff6d8e65900
cmp byte [rcx + 0x71], 0
je 0x7ff6d8e65900
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [0x7ff6d8ec9610]
cmp eax, 0xffffffff
je 0x7ff6d8e658fc
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x7ff6d8ec9610]
test eax, eax
je 0x7ff6d8e658c2
sub eax, 1
je 0x7ff6d8e658c6
cmp eax, 2
jne 0x7ff6d8e658fc
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff6d8e98b50
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x7ff6d8e658f3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.7ff6d8ea4a40
cmp rdi, rax
jne 0x7ff6d8e658fc
cmp byte [rbx + 0x71], 0
sete al
jmp 0x7ff6d8e658aa
xor al, al
jmp 0x7ff6d8e658aa
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff6d8e98b50
add rsp, 0x60
pop rbx
ret

Function at 0x7ff6d8e69360
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov rdi, rdx
mov dword [rsp + 0x38], 4
mov rbx, rcx
test rcx, rcx
je 0x7ff6d8e693d2
test rdx, rdx
je 0x7ff6d8e693d2
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
je 0x7ff6d8e693ec
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.7ff6d8e631b0
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
je 0x7ff6d8e69431
mov rdx, rbx
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.7ff6d8e631b0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
jmp 0x7ff6d8e693d2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov al, 1
jmp 0x7ff6d8e693d4
Function at 0x7ff6d8e69440
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r8
mov dword [rsp + 0x38], 0x206
mov rsi, rdx
mov dword [rsp + 0x40], 3
mov rbp, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, str.sechost.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x7ff6d8e694ac
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.LoadLibraryEx_with_sechost.dll_failed._Error:__0x_x_
call fcn.7ff6d8e631b0
xor al, al
jmp 0x7ff6d8e695ca
lea rdx, str.GetServiceRegistryStateKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x7ff6d8e694fc
lea r9, [rsp + 0x30]
xor edx, edx
mov r8d, 0x20019
mov rcx, rbp
call qword [0x7ff6d8ec9610]
test eax, eax
je 0x7ff6d8e69556
mov r8, rbp
lea rcx, str.GetServiceRegistryStateKey_failed__0x_x__handle__p
mov edx, eax
call fcn.7ff6d8e631b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x7ff6d8e695ca
lea rcx, str.GetProcAddress_with_GetServiceRegistryStateKey_failed__This_is_windows_RS3_or_lower.
call fcn.7ff6d8e631b0
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff6d8edbc10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
je 0x7ff6d8e69556
mov r8d, eax
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_serviceParameters
lea rcx, str.Registry_read_failure_for__s__RegOpenKeyEx_failed__0x_x__n
call fcn.7ff6d8e631b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x7ff6d8e695ca
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
je 0x7ff6d8e695a9
mov r8d, eax
lea rcx, str.Registry_read_failure_for__S._Error:__0x_x__n
mov rdx, rsi
call fcn.7ff6d8e631b0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
xor al, al
jmp 0x7ff6d8e695ca
mov eax, dword [rsp + 0x38]
shr rax, 1
cmp word [rdi + rax*2], 0
je 0x7ff6d8e695bd
xor ecx, ecx
mov word [rdi + rax*2], cx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff6d8e6a0a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
movzx r9d, r8b
mov r8, rdx
lea rdx, [rbp + 0x17]
call fcn.7ff6d8e6bcc0
nop
movzx r9d, bl
mov r8, rsi
lea rdx, [rbp - 0x29]
call fcn.7ff6d8e6bfe0
nop
xor bl, 1
movzx r9d, bl
mov r8, rsi
lea rdx, [rbp - 9]
call fcn.7ff6d8e6bfe0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rcx, qword [rbp - 0x29]
call fcn.7ff6d8ea5e64
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
call fcn.7ff6d8ea5e64
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call fcn.7ff6d8ea5e8c
mov ebx, eax
mov rdx, rsi
call fcn.7ff6d8e6c300
test ebx, ebx
je 0x7ff6d8e6a167
lea rcx, str.rename_file_failed_n
call fcn.7ff6d8e631b0
xor bl, bl
jmp 0x7ff6d8e6a19b
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov r8, rsi
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.7ff6d8e6de50
mov rcx, qword [rax]
mov dword [rcx + 0x40], 2
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov bl, 1
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x7ff6d8e6a1db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e6a1d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e6a29d
call fcn.7ff6d8e98b74
xor edi, edi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], 7
mov word [rbp - 9], di
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x7ff6d8e6a229
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e6a224
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e6a2a3
call fcn.7ff6d8e98b74
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], di
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x7ff6d8e6a275
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e6a270
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e6a297
call fcn.7ff6d8e98b74
movzx eax, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
int3
Function at 0x7ff6d8e7c770
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x1b8], 0xffffffffffffffff
mov rbx, rcx
je 0x7ff6d8e7c8ba
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rbx + 0x1b8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff6d8e7c883
lea rdx, [0x7ff6d8eca078]
mov ecx, 0x18
call fcn.7ff6d8e990e4
mov rdi, rax
test rax, rax
jne 0x7ff6d8e7c81a
lea edx, [rax + 0x18]
lea rcx, str.JHI_memory_allocation_of_size__d_failed_.
call fcn.7ff6d8e63170
lea rcx, str.CS_ClientThreadParams_memory_allocation_failed
call fcn.7ff6d8e631b0
mov rcx, qword [rbx + 0x10]
lea edx, [rdi + 1]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_ReleaseSemaphore]
jmp 0x7ff6d8e7c873
mov qword [rax], rsi
lea r8, [0x7ff6d8e7c8c0]
mov rax, qword [rbx + 0x18]
mov r9, rdi
mov qword [rdi + 8], rax
xor edx, edx
mov rax, qword [rbx + 0x10]
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov qword [rdi + 0x10], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.DLL_CreateThread]
test rax, rax
jne 0x7ff6d8e7c86a
lea rcx, str.failed_creating_thread_for_client_request_n
call fcn.7ff6d8e631b0
mov edx, 0x18
mov rcx, rdi
call fcn.7ff6d8e98b74
jmp 0x7ff6d8e7c873
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp qword [rbx + 0x1b8], 0xffffffffffffffff
jne 0x7ff6d8e7c7a0
jmp 0x7ff6d8e7c8ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.accept_failed_with_error:__d_n
call fcn.7ff6d8e631b0
mov rcx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, qword [rcx]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.DLL_ReleaseSemaphore]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x7ff6d8e7e360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
cmp byte [rcx + 0x10], 0
je 0x7ff6d8e7e396
mov eax, 1
jmp 0x7ff6d8e7e53f
call fcn.7ff6d8e6cc30
mov ebx, dword [rax + 0x5c]
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bp
mov byte [rsp + 0x30], bpl
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.7ff6d8e7dbf0
test al, al
jne 0x7ff6d8e7e3d5
mov ebx, 0x1014
jmp 0x7ff6d8e7e4f7
movzx esi, byte [rsp + 0x30]
cmp ebx, 2
jne 0x7ff6d8e7e3f4
movzx r8d, sil
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.7ff6d8e7e8b0
test eax, eax
je 0x7ff6d8e7e46e
lea rcx, str.Installing_the_Spooler...
call fcn.7ff6d8e631b0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
movzx r9d, sil
xor r8d, r8d
lea rcx, str.BA8D164350B649CC861D2C01BED14BE8
call fcn.7ff6d8e81830
mov ebx, eax
test eax, eax
je 0x7ff6d8e7e43f
cmp eax, 0x108
je 0x7ff6d8e7e43f
lea rcx, str.failed_downloading_Spooler_Applet_to_DAL_FW_n
call fcn.7ff6d8e63170
jmp 0x7ff6d8e7e44b
lea rcx, str.Spooler_is_installed.
call fcn.7ff6d8e631b0
test ebx, ebx
jne 0x7ff6d8e7e4f9
movzx r8d, sil
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.7ff6d8e7e8b0
mov ebx, eax
test eax, eax
jne 0x7ff6d8e7e4f7
call fcn.7ff6d8e6cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rsi, qword [rbx + 0x50]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rcx, str.Creating_the_event_listener_thread...
call fcn.7ff6d8e631b0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x7ff6d8e7d750]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
jne 0x7ff6d8e7e4e9
lea rcx, str.Failed_creating_event_handle_thread_n
call fcn.7ff6d8e631b0
mov ebx, 0x601
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
mov rax, qword [rax + 0x40]
call qword [0x7ff6d8ec9610]
jmp 0x7ff6d8e7e4f7
lea rcx, str.Event_listener_thread_created_successfully
call fcn.7ff6d8e631b0
mov ebx, ebp
test ebx, ebx
sete al
mov byte [rdi + 0x10], al
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x7ff6d8e7e53d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7e538
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e562
call fcn.7ff6d8e98b74
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff6d8e98b50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.7ff6d8ea5708
int3
Function at 0x7ff6d8e7ee20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 8], 0
mov rdi, rdx
mov rsi, rcx
je 0x7ff6d8e7ef82
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x30]
and eax, 0xffff02ff
mov qword [rsp + 0x20], 0
or eax, 0x2ff
mov r8d, 4
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x7ff6d8e7ef62
lea rcx, str.Sent_FWU_GET_VERSION_to_HECI._n
call fcn.7ff6d8e631b0
xor bpl, bpl
mov dword [rsp + 0x30], 0
test rdi, rdi
je 0x7ff6d8e7ef82
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x7ff6d8e7ef82
call fcn.7ff6d8e689c0
mov rbx, rax
test rax, rax
je 0x7ff6d8e7ef82
movsxd r8, dword [rsi + 0x18]
xor edx, edx
mov rcx, rax
call fcn.7ff6d8e9d8e0
mov r8d, dword [rsi + 0x18]
lea r9, [rsp + 0x30]
mov rcx, qword [rsi + 0x10]
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x7ff6d8e7ef3d
mov edx, dword [rsp + 0x30]
lea rcx, str.Number_bytes_read_from_HECI:__d_n
call fcn.7ff6d8e631b0
cmp byte [rbx + 3], bpl
je 0x7ff6d8e7ef19
lea rcx, str.Got_error_status_from_HCI_GET_FW_VERSION._n
call fcn.7ff6d8e631b0
jmp 0x7ff6d8e7ef51
movzx eax, word [rbx + 6]
mov bpl, 1
mov word [rdi], ax
movzx eax, word [rbx + 4]
mov word [rdi + 2], ax
movzx eax, word [rbx + 0xa]
mov word [rdi + 4], ax
movzx eax, word [rbx + 8]
mov word [rdi + 6], ax
jmp 0x7ff6d8e7ef51
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.HeciRead_Error._LastError___d_n
call fcn.7ff6d8e631b0
mov rcx, rbx
call fcn.7ff6d8e689f0
test bpl, bpl
je 0x7ff6d8e7ef82
mov al, 1
jmp 0x7ff6d8e7ef84
lea rcx, str.Error:_sending_FWU_GET_VERSION_request_to_HECI_failed._n
call fcn.7ff6d8e631b0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.error:__d
call fcn.7ff6d8e631b0
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff6d8e98b50
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff6d8e823e0
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
lea rcx, [0x7ff6d8eded50]
call fcn.7ff6d8e63170
call fcn.7ff6d8e6cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [rbx + 8], 2
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rdx, [0x7ff6d8eca078]
mov ecx, 0x10
call fcn.7ff6d8e990e4
mov rdi, rax
test rax, rax
je 0x7ff6d8e82457
lea rax, vtable.intel_dal::CommandDispatcher.0
mov qword [rdi], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [rdi + 8], rax
jmp 0x7ff6d8e82468
xor edi, edi
lea edx, [rdi + 0x10]
lea rcx, str.JHI_memory_allocation_of_size__d_failed_.
call fcn.7ff6d8e63170
mov ecx, 0x1c0
call fcn.7ff6d8e98e18
mov rsi, rax
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x1c0
mov rcx, rax
call fcn.7ff6d8e9d8e0
lea rax, vtable.intel_dal::ICommandsServer.0
mov qword [rsi], rax
mov ecx, 8
call fcn.7ff6d8e98e18
mov rbx, rax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rbx], rax
xor r9d, r9d
mov edx, 0xa
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov qword [rbx], rax
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rdi
mov byte [rsi + 8], 0xa
lea rax, vtable.intel_dal::CommandsServerSocketsWin32.0
mov qword [rsi], rax
mov qword [rsi + 0x1b8], 0xffffffffffffffff
mov ecx, 0x202
lea rdx, [rsi + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x7ff6d8e8256f
cmp byte [rsi + 0x20], 2
jne 0x7ff6d8e825a0
cmp byte [rsi + 0x21], 2
jne 0x7ff6d8e825a0
mov qword [0x7ff6d8ef1a30], rsi
lea rcx, str.opening_command_server_n
call fcn.7ff6d8e631b0
mov rcx, qword [0x7ff6d8ef1a30]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x7ff6d8ec9610]
test al, al
jne 0x7ff6d8e82551
lea rcx, str.Error:_command_server_has_failed_to_open_a_connection_n
call fcn.7ff6d8e63170
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rcx, str.____jhi_start
call fcn.7ff6d8e63170
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error:__d_n
call fcn.7ff6d8e63170
lea rdx, str.WSAStartup_failed
lea rcx, [rsp + 0x20]
call fcn.7ff6d8e61ff0
lea rdx, [0x7ff6d8eebf00]
lea rcx, [rsp + 0x20]
call fcn.7ff6d8e9da70
int3
lea rcx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
call fcn.7ff6d8e63170
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll
lea rcx, [rsp + 0x38]
call fcn.7ff6d8e61ff0
lea rdx, [0x7ff6d8eebf00]
lea rcx, [rsp + 0x38]
call fcn.7ff6d8e9da70
int3
Function at 0x7ff6d8e827b0
Capabilities:
Create mailslot

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0x28], 0
mov r14d, r8d
mov rdi, rdx
mov rbp, rcx
je 0x7ff6d8e827e5
mov eax, 7
jmp 0x7ff6d8e828e2
mov qword [rsp + 0xb0], rbx
test rdi, rdi
je 0x7ff6d8e82921
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x7ff6d8e82800
cmp rbx, 0x20
ja 0x7ff6d8e82921
lea r8, str..mailslot_
mov qword [rsp + 0xb8], rsi
mov edx, 0x2e
lea rcx, [rsp + 0x40]
call fcn.7ff6d8ea475c
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x2e
call fcn.7ff6d8eac68c
test r14d, r14d
jne 0x7ff6d8e8288d
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1a8
call qword [sym.imp.KERNEL32.DLL_CreateMailslotA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff6d8e828cd
xor eax, eax
lea r8d, [r14 + 4]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea edx, [rax + 6]
call qword [sym.imp.ADVAPI32.DLL_SetSecurityInfo]
jmp 0x7ff6d8e828c7
cmp r14d, 1
jne 0x7ff6d8e8291a
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rsi, rax
cmp rsi, 0xffffffffffffffff
jne 0x7ff6d8e828fb
mov eax, 1
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ff6d8e98b50
add rsp, 0x80
pop r14
pop rdi
pop rbp
ret
mov r9, rbx
mov r8, rdi
mov edx, 0x22
mov rcx, rbp
call fcn.7ff6d8eac5b8
xor eax, eax
mov dword [rbp + 0x30], r14d
mov qword [rbp + 0x28], rsi
jmp 0x7ff6d8e828d2
mov eax, 0xa
jmp 0x7ff6d8e828d2
mov eax, 8
jmp 0x7ff6d8e828da