joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020bd0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x170
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x188], rbx
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
lea rdx, [0x14001ac00]
lea rcx, [rsp + 0x28]
call fcn.1400151b0
nop
xor ebx, ebx
mov dword [rsp + 0x20], 0x104
mov byte [rsp + 0x50], bl
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140015590
test eax, eax
je 0x140020ca1
cmp byte [rsp + 0x50], 0
je 0x140020c58
mov rax, qword [rdi]
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [0x140063700]
mov rcx, rdi
call qword [rax + 0x50]
inc ebx
mov dword [rsp + 0x20], 0x104
mov byte [rsp + 0x50], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1400157b0
test eax, eax
jne 0x140020c37
test ebx, ebx
je 0x140020ca1
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
xor r8d, r8d
mov rcx, rdi
call qword [rbx + 0x58]
nop
lea rcx, [rsp + 0x28]
call fcn.1400151c0
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14003eed0
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret

Function at 0x140023cd0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 0x262]
test al, al
jne 0x140023d02
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x48
ret
lea rdx, str._c:_
lea rcx, [rsp + 0x28]
movzx r8d, al
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x28]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ebx, eax
test eax, eax
jne 0x140023d54
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetDiskFreeSpaceEx___had_error___ld
lea rcx, str.CPnpdiskUtil::IsMounted__
mov r8d, eax
call fcn.140027ba0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x48
ret

Function at 0x140023d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 0x262]
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], al
mov dword [rsp + 0x21], 0x2e5c3a
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140023de3
movzx r9d, byte [rbx + 0x262]
lea r8, str.Device_with_drive_letter__c_is_in_INTERMEDIATE_state
lea rdx, str.CPnpDiskUtil::IsIntermediateState__
mov ecx, 8
call fcn.140028400
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x40
pop rbx
ret
Function at 0x1400246e0
Capabilities:
Get disk information

Disassembly:
push rsi
push r14
sub rsp, 0x1c8
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov r14, rdx
mov esi, ecx
test ecx, ecx
jne 0x140024729
lea rdx, str.DeviceManagementPnpDiskUtil.cpp
lea rcx, str.0___ulDevNumber
xor r9d, r9d
mov r8d, 0x716
call fcn.140027a80
xor eax, eax
jmp 0x1400247b1
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1f0], rbp
xor ebp, ebp
lea ecx, [rbp + 0x69]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, eax
cmp eax, 0x69
jbe 0x14002476c
lea rdx, str.DeviceManagementPnpDiskUtil.cpp
lea rcx, str.dwSize___dwBufSize
xor r9d, r9d
mov r8d, 0x724
call fcn.140027a80
mov qword [rsp + 0x1c0], rdi
test ebx, ebx
jne 0x1400247cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.ERROR__0x_X
lea rdx, str.CPnpDiskUtil::QueryDriveLetter__
lea ecx, [rbx + 8]
mov r9d, eax
call fcn.140028400
mov rdi, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1e0]
mov eax, ebp
mov rbp, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x1c8
pop r14
pop rsi
ret
lea rdi, [rsp + 0x30]
cmp byte [rsp + 0x30], bpl
je 0x140024797
nop dword [rax + rax]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], bpl
jne 0x1400247e4
lea rdx, [0x1400609ac]
mov rcx, rdi
call fcn.140040f08
test eax, eax
js 0x14002485f
mov eax, dword [0x1400609b0]
lea r8, [rbx - 1]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x1400609b4]
mov rdx, rdi
mov byte [rsp + 0xa4], al
call fcn.140040ff0
lea rax, [rbx + 4]
cmp rax, 0x105
jae 0x140024883
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
mov byte [rsp + rax + 0xa0], bpl
call fcn.140024990
test eax, eax
je 0x14002485f
cmp dword [rsp + 0x24], esi
je 0x140024873
inc rdi
add rdi, rbx
cmp byte [rdi], bpl
jne 0x1400247e0
jmp 0x140024797
movzx eax, byte [rdi]
mov ebp, 1
mov byte [r14], al
jmp 0x140024797
call fcn.14003d0d4
int3
Function at 0x140024890
Capabilities:
Get disk information via ioctl

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx], 0xffffffffffffffff
mov rbx, rcx
jne 0x1400248c3
lea rdx, str.DeviceManagementPnpDiskUtil.cpp
lea rcx, str.m_hDevice___INVALID_HANDLE_VALUE
xor r9d, r9d
mov r8d, 0x75a
call fcn.140027a80
xor eax, eax
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
lea rdi, [rcx + 0x264]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x2d1080
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], SafeArrayGetLBound
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
test eax, eax
je 0x140024953
mov ecx, dword [rbx + 0x26c]
mov r9d, dword [rdi]
lea r8, str.type_0x_x_drive_0x_x_partition_0x_x
mov dword [rsp + 0x28], ecx
mov ecx, dword [rbx + 0x268]
lea rdx, str.CPnpDiskUtil::QueryStorageDeviceNumber__
mov dword [rsp + 0x20], ecx
mov ecx, 8
call fcn.140028400
mov rdi, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.DeviceIoControl_failed.__Last_error__0x_X
lea rdx, str.CPnpDiskUtil::QueryStorageDeviceNumber__
mov r9d, eax
mov ecx, 8
call fcn.140028400
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov rdi, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
Function at 0x140024990
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
jne 0x1400249ce
lea rdx, str.DeviceManagementPnpDiskUtil.cpp
lea rcx, str.NULL___pStrDriveName
xor r9d, r9d
mov r8d, 0x77e
call fcn.140027a80
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov r9, rcx
lea r8, str.looking_up_device__for__s
lea rdx, str.CPnpDiskUtil::QueryStorageDeviceNumber__
mov ecx, 8
mov qword [rsp + 0x58], rdi
call fcn.140028400
xor eax, eax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rbx], rax
lea r8d, [rdi + 7]
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x28], 0x20000000
mov dword [rbx + 8], eax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140024aee
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rsi
mov dword [rsp + 0x28], SafeArrayGetLBound
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test eax, eax
je 0x140024aaa
mov r8d, dword [rbx + 8]
mov r9d, dword [rbx]
lea rdx, str.CPnpDiskUtil::QueryStorageDeviceNumber__
mov dword [rsp + 0x28], r8d
mov r8d, dword [rbx + 4]
mov ecx, 8
mov dword [rsp + 0x20], r8d
lea r8, str.type_0x_x_drive_0x_x_partition_0x_x
call fcn.140028400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.DeviceIoControl_failed.__Last_error__0x_X
lea rdx, str.CPnpDiskUtil::QueryStorageDeviceNumber__
mov r9d, eax
mov ecx, 8
call fcn.140028400
xor eax, eax
mov rcx, rsi
mov qword [rbx], rax
mov dword [rbx + 8], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.CreateFile_failed.__Last_error__0x_X
lea rdx, str.CPnpDiskUtil::QueryStorageDeviceNumber__
mov r9d, eax
mov ecx, 8
call fcn.140028400
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret

Function at 0x140027870
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rdi, [rcx + 0x10e]
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov r8, rdi
call fcn.140041398
lea rcx, [rsp + 0x20]
mov edx, 0x2e
call fcn.140041404
mov edx, 0x104
lea rcx, [rsp + 0x230]
mov rbx, rax
test rax, rax
je 0x1400278db
mov r8, rax
call fcn.140041398
xor eax, eax
mov word [rbx], ax
jmp 0x1400278e7
lea r8, str..txt
call fcn.140041398
lea r8, str.Backup
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140041284
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140041284
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14003eed0
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
Function at 0x140027950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword [0x14007e1b0]
test rax, rax
jne 0x140027997
mov ecx, 0x3c0
call fcn.14003cde0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14002798b
mov rcx, rax
call fcn.140027800
nop
mov qword [0x14007e1b0], rax
test rax, rax
je 0x1400279b4
test byte [rax + 4], 8
je 0x1400279b4
lea rcx, [rax + 0x320]
xor r8d, r8d
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp 0x140029150
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r15d, r15d
mov rcx, rdi
mov dword [rsp + 0x60], r15d
mov esi, r15d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rdi + 0x68]
mov rcx, rdi
sub rbx, qword [rdi + 0x60]
sar rbx, 4
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140029278
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9d, [r15 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rdi + 0x60]
cmp rbx, qword [rdi + 0x68]
je 0x140029244
nop
movups xmm2, xmmword [rbx]
mov rdx, qword [rdi + 0x28]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r15
movq rcx, xmm2
add rdx, rcx
movdqa xmm1, xmm2
psrldq xmm1, 8
movq r8, xmm1
sub r8d, ecx
mov rcx, rbp
inc r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140029231
mov eax, dword [rsp + 0x60]
add rsi, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add rbx, 0x10
cmp rbx, qword [rdi + 0x68]
jne 0x1400291f0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x140029278
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 0x60]
mov rcx, rdi
mov qword [rdi + 0x68], rax
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140027ba0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0xfa8]
mov eax, 0x10a8
call fcn.14003ee70
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rbp + 0xf90], rax
mov rbx, rdx
xor esi, esi
cmp qword [0x14007e1b0], rsi
jne 0x140027c28
mov ecx, 0x3c0
call fcn.14003cde0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140027c0e
mov rcx, rax
call fcn.140027800
jmp 0x140027c11
mov rax, rsi
mov qword [0x14007e1b0], rax
test rax, rax
je 0x140027dbd
mov rbx, qword [rbp + 0xfd8]
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x790]
call fcn.14003efe0
lea rax, [rbp + 0xfe0]
mov qword [rsp + 0x20], rax
mov r9, rbx
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rbp + 0x790]
call fcn.14003e1bc
cmp byte [rbp + 0x790], 0
je 0x140027dbd
mov rdi, qword [0x14007e1b0]
test rdi, rdi
jne 0x140027ca4
mov ecx, 0x3c0
call fcn.14003cde0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140027c9a
mov rcx, rax
call fcn.140027800
mov rdi, rax
jmp 0x140027c9d
mov rdi, rsi
mov qword [0x14007e1b0], rdi
lea rax, [rbp + 0x790]
test rax, rax
je 0x140027dbd
cmp dword [rdi], 0
je 0x140027dbd
mov byte [rbp - 0x70], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov edx, 0x1e
lea rcx, [rsp + 0x70]
call fcn.140041648
lea r8, str.ERROR
mov edx, 0x1e
lea rcx, [rsp + 0x50]
call fcn.14003d4e8
cmp byte [rbp + 0x790], 0
setne sil
lea rcx, [rdi + 0xc]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea r9, str.__s:_0x_X__s__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rbp - 0x70]
call fcn.14003f430
test esi, esi
je 0x140027d56
lea r8, [rbp + 0x790]
mov edx, 0x800
lea rcx, [rbp - 0x70]
call fcn.14003d54c
lea r8, [0x1400614a8]
mov edx, 0x800
lea rcx, [rbp - 0x70]
call fcn.14003d54c
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [rdi + 4], 2
je 0x140027d8a
lea rdx, [rbp - 0x70]
mov rcx, rdi
call fcn.140028dc0
test byte [rdi + 4], 4
je 0x140027d9a
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rdi + 4], 8
je 0x140027db0
lea rcx, [rdi + 0x320]
lea rdx, [rbp - 0x70]
call fcn.140029410
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x10a8
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400281b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x10a0
call fcn.14003ee70
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x1090], rax
mov rbx, rcx
xor esi, esi
cmp qword [0x14007e1b0], rsi
jne 0x140028236
mov ecx, 0x3c0
call fcn.14003cde0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002821b
mov rcx, rax
call fcn.140027800
jmp 0x14002821e
mov rax, rsi
mov qword [0x14007e1b0], rax
test rax, rax
je 0x1400283e0
mov rbx, qword [rsp + 0x10c0]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x890]
call fcn.14003efe0
lea rax, [rsp + 0x10c8]
mov qword [rsp + 0x20], rax
mov r9, rbx
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x890]
call fcn.14003e1bc
mov rdi, qword [0x14007e1b0]
test rdi, rdi
jne 0x1400282a8
mov ecx, 0x3c0
call fcn.14003cde0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002829e
mov rcx, rax
call fcn.140027800
mov rdi, rax
jmp 0x1400282a1
mov rdi, rsi
mov qword [0x14007e1b0], rdi
lea rax, [rsp + 0x890]
test rax, rax
je 0x1400283e0
cmp dword [rdi], 0
je 0x1400283e0
mov byte [rsp + 0x90], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov edx, 0x1e
lea rcx, [rsp + 0x70]
call fcn.140041648
lea r8, str.INFO
mov edx, 0x1e
lea rcx, [rsp + 0x50]
call fcn.14003d4e8
cmp byte [rsp + 0x890], 0
setne sil
lea rcx, [rdi + 0xc]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea r9, str.__s:_0x_X__s__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003f430
test esi, esi
je 0x140028369
lea r8, [rsp + 0x890]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003d54c
lea r8, [0x1400614a8]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003d54c
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [rdi + 4], 2
je 0x1400283a5
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.140028dc0
test byte [rdi + 4], 4
je 0x1400283b9
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rdi + 4], 8
je 0x1400283d3
lea rcx, [rdi + 0x320]
lea rdx, [rsp + 0x90]
call fcn.140029410
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x10a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140028400
Capabilities:
Print debug messages

Disassembly:
test ecx, 0x40e
je 0x14002862b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x10a0
call fcn.14003ee70
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x1090], rax
mov rbx, r8
xor esi, esi
cmp qword [0x14007e1b0], rsi
jne 0x140028488
mov ecx, 0x3c0
call fcn.14003cde0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14002846d
mov rcx, rax
call fcn.140027800
jmp 0x140028470
mov rax, rsi
mov qword [0x14007e1b0], rax
test rax, rax
je 0x140028611
mov rbx, qword [rsp + 0x10d0]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x890]
call fcn.14003efe0
lea rax, [rsp + 0x10d8]
mov qword [rsp + 0x20], rax
mov r9, rbx
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x890]
call fcn.14003e1bc
cmp byte [rsp + 0x890], 0
je 0x140028611
call fcn.140027a30
mov rdi, rax
lea rax, [rsp + 0x890]
test rax, rax
je 0x140028611
cmp dword [rdi], 0
je 0x140028611
mov byte [rsp + 0x90], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov edx, 0x1e
lea rcx, [rsp + 0x70]
call fcn.140041648
lea r8, str.INFO
mov edx, 0x1e
lea rcx, [rsp + 0x50]
call fcn.14003d4e8
cmp byte [rsp + 0x890], 0
setne sil
lea rcx, [rdi + 0xc]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea r9, str.__s:_0x_X__s__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003f430
test esi, esi
je 0x14002859a
lea r8, [rsp + 0x890]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003d54c
lea r8, [0x1400614a8]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003d54c
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [rdi + 4], 2
je 0x1400285d6
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.140028dc0
test byte [rdi + 4], 4
je 0x1400285ea
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rdi + 4], 8
je 0x140028604
lea rcx, [rdi + 0x320]
lea rdx, [rsp + 0x90]
call fcn.140029410
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x10a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002840c
Capabilities:
Print debug messages

Disassembly:
test ecx, 0x40e
je 0x14002862b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x10a0
call fcn.14003ee70
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x1090], rax
mov rbx, r8
xor esi, esi
cmp qword [0x14007e1b0], rsi
jne 0x140028488
mov ecx, 0x3c0
call fcn.14003cde0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14002846d
mov rcx, rax
call fcn.140027800
jmp 0x140028470
mov rax, rsi
mov qword [0x14007e1b0], rax
test rax, rax
je 0x140028611
mov rbx, qword [rsp + 0x10d0]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x890]
call fcn.14003efe0
lea rax, [rsp + 0x10d8]
mov qword [rsp + 0x20], rax
mov r9, rbx
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x890]
call fcn.14003e1bc
cmp byte [rsp + 0x890], 0
je 0x140028611
call fcn.140027a30
mov rdi, rax
lea rax, [rsp + 0x890]
test rax, rax
je 0x140028611
cmp dword [rdi], 0
je 0x140028611
mov byte [rsp + 0x90], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov edx, 0x1e
lea rcx, [rsp + 0x70]
call fcn.140041648
lea r8, str.INFO
mov edx, 0x1e
lea rcx, [rsp + 0x50]
call fcn.14003d4e8
cmp byte [rsp + 0x890], 0
setne sil
lea rcx, [rdi + 0xc]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea r9, str.__s:_0x_X__s__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003f430
test esi, esi
je 0x14002859a
lea r8, [rsp + 0x890]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003d54c
lea r8, [0x1400614a8]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.14003d54c
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [rdi + 4], 2
je 0x1400285d6
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.140028dc0
test byte [rdi + 4], 4
je 0x1400285ea
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rdi + 4], 8
je 0x140028604
lea rcx, [rdi + 0x320]
lea rdx, [rsp + 0x90]
call fcn.140029410
lea rcx, [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x10a0
pop rdi
pop rsi
pop rbx
ret