joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009cea0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov rcx, qword [0x1402b9860]
lea rsi, [0x1402b9860]
cmp rcx, rsi
je 0x14009cef5
test byte [rcx + 0x44], 2
je 0x14009cef5
cmp byte [rcx + 0x41], 4
jb 0x14009cef5
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x3d
call fcn.140022ad0
lea rax, [rsp + 0x30]
mov r9d, 0x1000b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x14009cf59
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009cf52
test byte [rcx + 0x44], 2
je 0x14009cf52
cmp byte [rcx + 0x41], 2
jb 0x14009cf52
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x3e
mov r9d, eax
call fcn.140025240
mov eax, ebx
jmp 0x14009d0b1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, str.BootMigrationPhase
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14009cfce
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009cfbc
test byte [rcx + 0x44], 2
je 0x14009cfbc
cmp byte [rcx + 0x41], 2
jb 0x14009cfbc
mov edx, 0x3f
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov r9d, ebx
call fcn.140025240
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x14009d0b1
cmp dword [rsp + 0x3c], 4
jne 0x14009d074
cmp dword [rsp + 0x38], 4
jne 0x14009d074
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.BootMigrationPhase
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14009d035
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009cfbc
test byte [rcx + 0x44], 2
je 0x14009cfbc
cmp byte [rcx + 0x41], 2
jb 0x14009cfbc
mov edx, 0x41
jmp 0x14009cfa9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009d070
test byte [rcx + 0x44], 2
je 0x14009d070
cmp byte [rcx + 0x41], 5
jb 0x14009d070
mov r9d, dword [rdi]
lea r8, [0x14022f178]
mov rcx, qword [rcx + 0x38]
mov edx, 0x42
call fcn.140025240
xor eax, eax
jmp 0x14009d0b1
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009d0a1
test byte [rcx + 0x44], 2
je 0x14009d0a1
cmp byte [rcx + 0x41], 2
jb 0x14009d0a1
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x40
call fcn.140022ad0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 0x70c
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401b1920
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14009e770
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov rcx, qword [0x1402b9860]
lea rdi, [0x1402b9860]
cmp rcx, rdi
je 0x14009e7c1
test byte [rcx + 0x44], 2
je 0x14009e7c1
cmp byte [rcx + 0x41], 4
jb 0x14009e7c1
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x47
call fcn.140022ad0
lea rax, [rsp + 0x30]
mov r9d, 0x1000b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x14009e822
mov rcx, qword [0x1402b9860]
cmp rcx, rdi
je 0x14009e81e
test byte [rcx + 0x44], 2
je 0x14009e81e
cmp byte [rcx + 0x41], 2
jb 0x14009e81e
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x48
mov r9d, eax
call fcn.140025240
mov eax, ebx
jmp 0x14009e8a1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.DumpMemoryLevel
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x14009e894
mov rcx, qword [0x1402b9860]
cmp rcx, rdi
je 0x14009e885
test byte [rcx + 0x44], 2
je 0x14009e885
cmp byte [rcx + 0x41], 2
jb 0x14009e885
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x49
mov r9d, eax
call fcn.140025240
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x14009e8a1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401b1920
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14009f010
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rcx, qword [0x1402b9860]
lea rsi, [0x1402b9860]
cmp rcx, rsi
je 0x14009f095
test byte [rcx + 0x44], 2
je 0x14009f06c
cmp byte [rcx + 0x41], 4
jb 0x14009f06c
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x43
call fcn.140022ad0
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009f095
test byte [rcx + 0x44], 2
je 0x14009f095
cmp byte [rcx + 0x41], 5
jb 0x14009f095
mov r9d, dword [rdi]
lea r8, [0x14022f178]
mov rcx, qword [rcx + 0x38]
mov edx, 0x44
call fcn.140025240
lea rax, [rsp + 0x30]
mov r9d, 0x1000b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x14009f0f6
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009f0f2
test byte [rcx + 0x44], 2
je 0x14009f0f2
cmp byte [rcx + 0x41], 2
jb 0x14009f0f2
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x45
mov r9d, eax
call fcn.140025240
mov eax, ebx
jmp 0x14009f170
mov rcx, qword [rsp + 0x30]
lea rdx, str.BootMigrationPhase
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x14009f163
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x14009f154
test byte [rcx + 0x44], 2
je 0x14009f154
cmp byte [rcx + 0x41], 2
jb 0x14009f154
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022f178]
mov edx, 0x46
mov r9d, eax
call fcn.140025240
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x14009f170
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401b1920
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14009fb50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rcx]
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [rax]
xor ebp, ebp
lea rdx, [rbx + 0x12]
mov r9, rsi
mov dword [rbx + 0x14], eax
mov rcx, rdi
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 6]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x14009fba5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x14009fc15
mov rax, qword [rbx]
lea r8, [rsp + 0x30]
mov rdx, rdi
mov dword [rsp + 0x30], ebp
mov rcx, rbx
call qword [rax + 0x20]
mov ecx, dword [rsp + 0x30]
add dword [rsi], ecx
test eax, eax
jne 0x14009fc15
mov rbx, qword [rbx + 0x20]
mov eax, ebp
mov dword [rsp + 0x30], eax
test rbx, rbx
je 0x14009fc0f
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x34]
mov dword [rsp + 0x34], ebp
mov rdx, rdi
mov rcx, rbx
call fcn.14009fb50
mov ecx, eax
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
test ecx, ecx
jne 0x14009fc11
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x14009fbe0
mov ecx, ebp
add dword [rsi], eax
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401b1920
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a2de0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xc]
xor edi, edi
mov rbx, rcx
cmp eax, 1
jne 0x1400a2e2f
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov eax, edi
lea rcx, [0x1400c3460]
xchg dword [rbx + 0x10], eax
mov r8, rbx
xor edx, edx
call fcn.1401d99b0
mov qword [rbx + 0x18], rax
cmp rax, 0xffffffffffffffff
jne 0x1400a2e2f
lea eax, [rdi + 0x6e]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0xc]
cmp eax, 1
je 0x1400a2e49
mov edi, 0x139f
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dword [rbx + 0xc], 2
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400adc00
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
xor edx, edx
mov qword [rbp - 0x48], rdx
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x10], rax
lea rdi, vtable.SqliteStatement.0
mov qword [rbp - 0x40], rdi
mov dword [rbp - 0x38], edx
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rdx
mov qword [rbp - 0x30], rax
lea rdx, str.SELECT_FILE_STATE_FROM_FILES_WHERE_FILE_ID___id
mov qword [rbp - 0x28], rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 0
mov r8d, 6
lea rcx, [0x14025c780]
call fcn.1401bfb60
movzx ecx, byte [rbp - 0x10]
mov edx, 1
test eax, eax
cmove ecx, edx
mov byte [rbp - 0x10], cl
lea rax, vtable.TransactionSafeStatement.0
mov qword [rbp - 0x40], rax
mov r8, rbx
lea rcx, [rbp - 0x40]
call fcn.1400297f0
test eax, eax
jne 0x1400adcb7
lea rcx, [rbp - 0x40]
call fcn.140029c40
cmp eax, 0x64
jne 0x1400add09
lea r8, [rbp - 0x48]
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140029b30
test eax, eax
je 0x1400add09
lea rdx, [0x1402b9860]
mov rcx, qword [0x1402b9860]
cmp rcx, rdx
je 0x1400add09
test dword [rcx + 0x44], 0x20000
je 0x1400add09
cmp byte [rcx + 0x41], 2
jb 0x1400add09
mov edx, 0x13
mov r9d, eax
lea r8, [0x140230320]
mov rcx, qword [rcx + 0x38]
call fcn.140036f70
movzx ebx, byte [rbp - 0x48]
and bl, 1
mov qword [rbp - 0x40], rdi
lea rcx, [rbp - 0x40]
call fcn.140029cf0
nop
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401b1920
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400b9b20
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1400b9cca
cmp byte [rcx + 0x72], 0
je 0x1400b9cca
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x1400b9b7e
xor al, al
jmp 0x1400b9ccc
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.14000ed40
nop
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop dword [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x1400b9bee
sub eax, 1
jne 0x1400b9c62
jmp 0x1400b9bf2
mov byte [rdi + 0x72], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x1400b9c3f
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.1401e3fa4
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x1400b9c6f
cmp byte [rdi + 0x72], 0
je 0x1400b9c73
test rbx, rbx
jne 0x1400b9bb0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140011780
jmp 0x1400b9ba3
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x1400b9c73
xor bl, bl
jmp 0x1400b9c75
mov bl, 1
cmp r9, 0x10
jb 0x1400b9cc5
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x1400b9cc0
test byte [rbp - 0x30], 0x1f
je 0x1400b9c93
call fcn.1401bf8a8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400b9ca2
call fcn.1401bf8a8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400b9cb1
call fcn.1401bf8a8
int3
cmp rcx, 0x27
jbe 0x1400b9cbd
call fcn.1401bf8a8
int3
mov rcx, rax
call fcn.1401b17c8
movzx eax, bl
jmp 0x1400b9ccc
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401b1920
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400ba240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbx, rdx
jb 0x1400ba259
mov rcx, qword [rdx]
jmp 0x1400ba25c
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
lea rdi, [0x1402b9860]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400ba3c1
test sil, 0x10
je 0x1400ba36e
test sil, 2
je 0x1400ba31b
mov rcx, qword [0x1402b9860]
cmp rcx, rdi
je 0x1400ba2d0
test byte [rcx + 0x44], 0x40
je 0x1400ba2d0
cmp byte [rcx + 0x41], 4
jb 0x1400ba2d0
cmp qword [rbx + 0x18], 8
jb 0x1400ba2b1
mov r9, qword [rbx]
jmp 0x1400ba2b4
mov r9, rbx
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x12
call fcn.1400328a0
mov rcx, qword [0x1402b9860]
test sil, 4
je 0x1400ba322
cmp rcx, rdi
je 0x1400ba309
test byte [rcx + 0x44], 0x40
je 0x1400ba309
cmp byte [rcx + 0x41], 4
jb 0x1400ba309
cmp qword [rbx + 0x18], 8
jb 0x1400ba2f1
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x13
mov r9, rbx
call fcn.1400328a0
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rcx, qword [0x1402b9860]
cmp rcx, rdi
je 0x1400ba359
test byte [rcx + 0x44], 0x40
je 0x1400ba359
cmp byte [rcx + 0x41], 2
jb 0x1400ba359
cmp qword [rbx + 0x18], 8
jb 0x1400ba33d
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x14
mov dword [rsp + 0x20], esi
mov r9, rbx
call fcn.140036fd0
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rcx, qword [0x1402b9860]
cmp rcx, rdi
je 0x1400ba3ac
test byte [rcx + 0x44], 0x40
je 0x1400ba3ac
cmp byte [rcx + 0x41], 2
jb 0x1400ba3ac
cmp qword [rbx + 0x18], 8
jb 0x1400ba390
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x15
mov dword [rsp + 0x20], esi
mov r9, rbx
call fcn.140036fd0
mov eax, 0x50
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rcx, qword [0x1402b9860]
cmp rcx, rdi
je 0x1400ba3fb
test byte [rcx + 0x44], 0x40
je 0x1400ba3fb
cmp byte [rcx + 0x41], 4
jb 0x1400ba3fb
cmp qword [rbx + 0x18], 8
jb 0x1400ba3e3
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x16
mov r9, rbx
call fcn.1400328a0
mov rdi, qword [rsp + 0x40]
mov eax, 2
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
Function at 0x1400ba560
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov r14d, r8d
mov rbx, rdx
mov esi, ebp
test r8d, r8d
je 0x1400ba600
xor r9d, r9d
mov dword [rsp + 0x40], ebp
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], 0x18
lea edx, [rbp + 1]
lea rcx, str.D:_A_OI_FA___SY__A_OI_FA___BA_
call sub.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x1400ba5fb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1402b9860]
lea rdi, [0x1402b9860]
cmp rcx, rdi
je 0x1400ba5f4
test byte [rcx + 0x44], 0x40
je 0x1400ba5f4
cmp byte [rcx + 0x41], 2
jb 0x1400ba5f4
mov rcx, qword [rcx + 0x38]
lea edx, [rbp + 0x19]
mov r9d, eax
lea r8, [0x140231f38]
call fcn.140024fa0
mov eax, ebx
jmp 0x1400ba6bb
lea rsi, [rsp + 0x30]
mov rcx, qword [0x1402b9860]
lea rdi, [0x1402b9860]
cmp rcx, rdi
je 0x1400ba643
test byte [rcx + 0x44], 0x40
je 0x1400ba643
cmp byte [rcx + 0x41], 4
jb 0x1400ba643
cmp qword [rbx + 0x18], 8
jb 0x1400ba62b
mov r9, qword [rbx]
jmp 0x1400ba62e
mov r9, rbx
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x1a
call fcn.1400328a0
cmp qword [rbx + 0x18], 8
jb 0x1400ba64f
mov rcx, qword [rbx]
jmp 0x1400ba652
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1400ba6a5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x1402b9860]
cmp rcx, rdi
je 0x1400ba6a5
test byte [rcx + 0x44], 0x40
je 0x1400ba6a5
cmp byte [rcx + 0x41], 2
jb 0x1400ba6a5
cmp qword [rbx + 0x18], 8
jb 0x1400ba689
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x1b
mov dword [rsp + 0x20], eax
mov r9, rbx
call fcn.140032910
test r14d, r14d
je 0x1400ba6b9
test rsi, rsi
je 0x1400ba6b9
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, ebp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401b1920
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400bab10
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rax, qword [0x1402bf880]
test rax, rax
jne 0x1400babe8
mov ecx, 0x95080
call fcn.1401b17d0
mov rdi, rax
mov qword [rsp + 0x40], rax
xor ebx, ebx
test rax, rax
je 0x1400bab67
xor edx, edx
mov r8d, 0x95080
mov rcx, rax
call fcn.1401b3ce0
mov rcx, rdi
call fcn.1400b7910
jmp 0x1400bab6a
mov rax, rbx
mov qword [0x1402bf880], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x1402b6110], eax
cmp eax, 0xffffffff
jne 0x1400babde
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, [0x1402b9860]
mov rcx, qword [0x1402b9860]
cmp rcx, rdx
je 0x1400babbf
test byte [rcx + 0x44], 0x40
je 0x1400babbf
cmp byte [rcx + 0x41], 4
jb 0x1400babbf
mov edx, 0x34
mov r9d, eax
lea r8, [0x140231f38]
mov rcx, qword [rcx + 0x38]
call fcn.140024fa0
mov rcx, qword [0x1402bf880]
test rcx, rcx
je 0x1400babd5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x1402bf880], rbx
jmp 0x1400babe5
mov rbx, qword [0x1402bf880]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400bb730
Capabilities:
Move file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x18], 7
mov word [rsp + 0x38], si
lea r8d, [rsi + 4]
lea rdx, str.._
lea rcx, [r11 - 0x30]
call fcn.140006bd0
nop
lea r8d, [rsi + 0x12]
lea rdx, str.c:IntelOptaneData
lea rcx, [rsp + 0x38]
call fcn.14001a890
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400ba240
test eax, eax
je 0x1400bb7ba
cmp eax, 0xc
je 0x1400bb7ba
mov esi, 2
jmp 0x1400bb897
lea rbx, [0x1402b9860]
mov rcx, qword [0x1402b9860]
cmp rcx, rbx
je 0x1400bb813
test byte [rcx + 0x44], 0x40
je 0x1400bb813
cmp byte [rcx + 0x41], 4
jb 0x1400bb813
cmp qword [rdi + 0x18], 8
jb 0x1400bb7e5
mov rax, qword [rdi]
jmp 0x1400bb7e8
mov rax, rdi
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
mov edx, 0x17
mov qword [rsp + 0x20], rax
lea r8, [0x140231f38]
mov rcx, qword [rcx + 0x38]
call fcn.14003c340
cmp qword [rdi + 0x18], 8
jb 0x1400bb81f
mov rdx, qword [rdi]
jmp 0x1400bb822
mov rdx, rdi
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
test eax, eax
jne 0x1400bb897
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1402b9860]
cmp rcx, rbx
je 0x1400bb897
test byte [rcx + 0x44], 0x40
je 0x1400bb897
cmp byte [rcx + 0x41], 2
jb 0x1400bb897
cmp qword [rdi + 0x18], 8
jb 0x1400bb867
mov rdi, qword [rdi]
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
mov edx, 0x18
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r8, [0x140231f38]
mov rcx, qword [rcx + 0x38]
call fcn.1400bd030
nop
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400bb8b4
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.140007b00
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b1920
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400bc180
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x50], esi
mov rdi, rcx
mov rcx, qword [0x1402b9860]
lea rbp, [0x1402b9860]
cmp rcx, rbp
je 0x1400bc1d2
test byte [rcx + 0x44], 0x40
je 0x1400bc1d2
cmp byte [rcx + 0x41], 4
jb 0x1400bc1d2
mov rcx, qword [rcx + 0x38]
lea edx, [rsi + 0x35]
lea r8, [0x140231f38]
call fcn.140022ad0
add rdi, 0x94e08
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp byte [0x1402bf990], sil
jne 0x1400bc27d
mov rcx, rdi
mov byte [0x1402bf990], 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rax, qword [0x1402b9860]
cmp rax, rbp
je 0x1400bc25c
test byte [rax + 0x44], 0x40
je 0x1400bc25c
cmp byte [rax + 0x41], 2
jb 0x1400bc25c
cmp qword [rbx + 0x18], 8
jb 0x1400bc221
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400bc990
mov esi, 1
cmp qword [rax + 0x18], 0x10
jb 0x1400bc23d
mov rax, qword [rax]
mov rcx, qword [0x1402b9860]
lea r8, [0x140231f38]
mov edx, 0x37
mov r9, rax
mov rcx, qword [rcx + 0x38]
call fcn.1400293b0
test sil, 1
je 0x1400bc26c
lea rcx, [rsp + 0x20]
call fcn.140005290
call fcn.1400bd290
mov ecx, 0x2c9
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, qword [0x1402b9860]
cmp rcx, rbp
je 0x1400bc2aa
test byte [rcx + 0x44], 0x40
je 0x1400bc2aa
cmp byte [rcx + 0x41], 5
jb 0x1400bc2aa
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x36
call fcn.140022ad0
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]