joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cbe40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x50
cmp dword [0x140274810], 4
mov rsi, rcx
mov ebx, 1
jl 0x1400cbe7b
test dword [0x14027488c], 0x40000
je 0x1400cbe7b
mov edi, ebx
jmp 0x1400cbe7d
xor edi, edi
mov edx, 4
mov ecx, 0x40000
call fcn.1400e1c40
lea r14, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r15, str.CStateChangeDetection::StartThread
test edi, edi
jne 0x1400cbea2
test eax, eax
je 0x1400cbed5
lea rcx, str.Starting_thread__n
mov r9d, 4
mov qword [rsp + 0x38], rcx
mov r8d, 0x40000
mov dword [rsp + 0x30], 0x5e
mov edx, eax
mov qword [rsp + 0x28], r14
mov ecx, edi
mov qword [rsp + 0x20], r15
call fcn.1400ba210
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x140059157.0]
xor r9d, r9d
mov dword [rsi + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x1400cbf0f
mov eax, 0x80004005
jmp 0x1400cbfb0
mov qword [rsp + 0x28], 0
lea r8, [0x1400cc1b0]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400cbf05
cmp dword [0x140274810], 4
jl 0x1400cbf52
test dword [0x14027488c], 0x40000
jne 0x1400cbf54
xor ebx, ebx
mov edx, 4
mov ecx, 0x40000
call fcn.1400e1c40
mov edi, eax
test ebx, ebx
jne 0x1400cbf6d
test eax, eax
je 0x1400cbfae
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.DLL_GetThreadId]
mov dword [rsp + 0x40], eax
lea rcx, str.Thread_ID___d_n
mov qword [rsp + 0x38], rcx
mov r9d, 4
mov dword [rsp + 0x30], 0x75
mov r8d, 0x40000
mov qword [rsp + 0x28], r14
mov edx, edi
mov ecx, ebx
mov qword [rsp + 0x20], r15
call fcn.1400ba210
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
Function at 0x1400d4670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x50
cmp dword [0x140274810], 3
mov edi, 1
jl 0x1400d46a3
test dword [0x140274874], 0x400000
je 0x1400d46a3
mov ebx, edi
jmp 0x1400d46a5
xor ebx, ebx
mov edx, 3
mov ecx, 0x400000
call fcn.1400e1c40
lea r14, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r15, str.dppe_esif_init
test ebx, ebx
jne 0x1400d46ca
test eax, eax
je 0x1400d46fd
lea rcx, str.Entering_Function...
mov r9d, 3
mov qword [rsp + 0x38], rcx
mov r8d, 0x400000
mov dword [rsp + 0x30], 0xc2
mov edx, eax
mov qword [rsp + 0x28], r14
mov ecx, ebx
mov qword [rsp + 0x20], r15
call fcn.1400ba210
cmp dword [0x1402830d8], 4
je 0x1400d4734
call fcn.140035f70
lea rcx, [0x14027ede0]
mov qword [0x14027edd8], rax
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
mov qword [0x14027ede8], 0
mov dword [0x14027edf0], 0
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d4780
bt eax, 0xa
jae 0x1400d4780
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d4770
test al, 0x10
je 0x1400d4770
lea rcx, str.user32.dll
call fcn.14012db94
jmp 0x1400d477c
lea rcx, str.user32.dll
call fcn.14011295c
test eax, eax
jne 0x1400d47ff
mov ecx, 0x18
call fcn.140110008
mov rbx, rax
test rax, rax
je 0x1400d47ff
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x14027ee30], rbx
test rcx, rcx
je 0x1400d480a
lea rdx, str.GetSystemMetrics
mov qword [rsp + 0x60], rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400d47f1
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x14027ee38], rsi
mov rsi, qword [rsp + 0x60]
jmp 0x1400d480a
mov qword [0x14027ee30], 0
lea rcx, [0x14027edf8]
call fcn.1400d6030
call fcn.1400d8c10
cmp dword [0x140274810], 3
mov ebx, eax
jl 0x1400d4832
test dword [0x140274874], 0x400000
jne 0x1400d4834
xor edi, edi
mov edx, 3
mov ecx, 0x400000
call fcn.1400e1c40
test edi, edi
jne 0x1400d484b
test eax, eax
je 0x1400d4882
mov dword [rsp + 0x40], ebx
lea rcx, str.Exiting_function:_Exit_code__0x_08X...
mov qword [rsp + 0x38], rcx
mov r9d, 3
mov dword [rsp + 0x30], 0xd9
mov r8d, 0x400000
mov qword [rsp + 0x28], r14
mov edx, eax
mov ecx, edi
mov qword [rsp + 0x20], r15
call fcn.1400ba210
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
Function at 0x1400e23e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x50
lea rbp, [0x14027ee80]
xor ebx, ebx
mov rcx, rbp
mov edi, ebx
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
inc dword [0x14027ee94]
cmp dword [0x140274810], 4
jl 0x1400e2424
test dword [0x14027488c], 0x10000
lea esi, [rbx + 1]
jne 0x1400e2426
mov esi, ebx
mov edx, 4
mov ecx, 0x10000
call fcn.1400e1c40
lea r15, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
mov edx, eax
test esi, esi
jne 0x1400e2446
test eax, eax
je 0x1400e2488
mov eax, dword [0x14027ee94]
mov r9d, 4
mov dword [rsp + 0x40], eax
mov r8d, 0x10000
lea rax, str.Refcount___d_n
mov ecx, esi
mov qword [rsp + 0x38], rax
lea rax, str.EsifHid_Enable
mov dword [rsp + 0x30], 0x162
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.1400ba210
cmp dword [0x14027ee94], 1
jne 0x1400e2613
mov qword [rsp + 0x70], r14
call fcn.1400e2b50
cmp dword [0x140274810], 4
jl 0x1400e24b9
test dword [0x14027488c], 0x10000
je 0x1400e24b9
mov edi, 1
mov edx, 4
mov ecx, 0x10000
call fcn.1400e1c40
lea r14, str.EsifHid_Start
test edi, edi
jne 0x1400e24d7
test eax, eax
je 0x1400e250a
lea rcx, str.Starting_HID_ETW_tracking_n
mov r9d, 4
mov qword [rsp + 0x38], rcx
mov r8d, 0x10000
mov dword [rsp + 0x30], 0x128
mov edx, eax
mov qword [rsp + 0x28], r15
mov ecx, edi
mov qword [rsp + 0x20], r14
call fcn.1400ba210
mov r8, rbp
lea rdx, [0x1400e2ca0]
lea rcx, [0x14027eea0]
call fcn.140034e80
mov ecx, 0x10
mov byte [0x14027eeb0], 1
mov qword [0x14027eea8], rbx
mov edi, ebx
call fcn.140110008
mov rsi, rax
test rax, rax
jne 0x1400e2549
mov edi, 0x708
jmp 0x1400e258d
lea rax, [0x1400e1e10]
mov qword [rsp + 0x28], rbx
mov r9, rsi
mov qword [rsi], rax
lea r8, [0x1400e2d40]
mov qword [rsi + 8], rbp
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x14027ee98], rax
test rax, rax
jne 0x1400e25ff
mov rcx, rsi
call fcn.14010fff4
mov edi, 0x3eb
lea rcx, [0x14027eea0]
call fcn.140035210
cmp dword [0x140274810], 1
jl 0x1400e25b3
test dword [0x140274844], 0x10000
mov esi, 1
jne 0x1400e25b5
mov esi, ebx
mov edx, 1
mov ecx, 0x10000
call fcn.1400e1c40
test esi, esi
jne 0x1400e25cc
test eax, eax
je 0x1400e25ff
lea rcx, str.Unable_to_create_HID_ETW_control_thread_n
mov r9d, 1
mov qword [rsp + 0x38], rcx
mov r8d, 0x10000
mov dword [rsp + 0x30], 0x139
mov edx, eax
mov qword [rsp + 0x28], r15
mov ecx, esi
mov qword [rsp + 0x20], r14
call fcn.1400ba210
mov r14, qword [rsp + 0x70]
test edi, edi
je 0x1400e2613
call fcn.1400e2b50
dec dword [0x14027ee94]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
cmp byte [0x14027eeb0], bl
setne bl
mov ecx, ebx
call fcn.1400e2ad0
mov rbx, qword [rsp + 0x78]
mov eax, edi
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop rdi
pop rsi
ret
Function at 0x1400e5340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x1400e53b5
bt eax, 0xa
jae 0x1400e53b5
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e53a5
test al, 0x10
je 0x1400e53a5
lea rcx, str.powrprof.dll
call fcn.14012db94
jmp 0x1400e53b1
lea rcx, str.powrprof.dll
call fcn.14011295c
test eax, eax
jne 0x1400e53f6
mov ecx, 0x18
call fcn.140110008
mov rbx, rax
test rax, rax
je 0x1400e53f6
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x1400e53f9
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Innovation_Platform_Framework:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.1400e7120
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x1400e556d
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e5541
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x1400e54dc
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x1400e5541
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x1400e5487
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x1400e5541
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x1400e5534
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x140059157.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e554f
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.14010fff4
test rdi, rdi
je 0x1400e557a
mov rcx, rdi
call fcn.14010fff4
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140100920
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400e73b0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.140102230
lea rbp, [0x14017d5dc]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x14017d5e0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.1400e79e0
mov ecx, 0x110
call fcn.140110008
mov rbx, rax
test rax, rax
je 0x1400e743b
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.140102230
test rbx, rbx
je 0x1400e7590
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400e7567
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14017d5e0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.1400e79e0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7512
bt eax, 0xa
jae 0x1400e7512
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7500
bt eax, 0xa
jae 0x1400e7500
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e74f3
test al, 0x10
je 0x1400e74f3
lea rcx, [rsp + 0x170]
call fcn.14012db94
jmp 0x1400e7500
lea rcx, [rsp + 0x170]
call fcn.14011295c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.140102230
cmp byte [rsp + 0x5c], 0
jne 0x1400e7536
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x1400e7470
cmp byte [rsp + 0x5c], 0
je 0x1400e756e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1401100d8
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1401100d8
cmp byte [rsp + 0x5c], 0
jne 0x1400e7590
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400e7584
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.14010fff4
xor eax, eax
jmp 0x1400e7593
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140100920
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e75c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7618
bt eax, 0xa
jae 0x1400e7618
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7605
test al, 0x10
je 0x1400e7605
mov rcx, rbx
call fcn.14012db94
jmp 0x1400e760d
mov rcx, rbx
call fcn.14011295c
test eax, eax
je 0x1400e7618
mov ecx, 0x1f
jmp 0x1400e7627
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14012d64c
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140100920
add rsp, 0x60
pop rbx
ret

Function at 0x1400e7650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e76c6
bt eax, 0xa
jae 0x1400e76c6
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e76a8
test al, 0x10
je 0x1400e76a8
mov rcx, rdi
call fcn.14012db94
jmp 0x1400e76b0
mov rcx, rdi
call fcn.14011295c
test eax, eax
je 0x1400e76c6
test rbx, rbx
je 0x1400e76bf
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x1400e776e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1401100d8
lea rdx, [0x14017de48]
mov rcx, rsi
call fcn.14012ef40
test rax, rax
je 0x1400e7747
mov edx, 0x63
mov rcx, rsi
call fcn.1401023d0
test rax, rax
jne 0x1400e7747
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14012a5d8
cmp rax, 0x20
jne 0x1400e772b
mov byte [rsp + 0x47], bpl
jmp 0x1400e7747
mov r9, 0xffffffffffffffff
lea r8, [0x14017de4c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.140141164
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140141534
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400e776b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140100920
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e7790
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7803
bt eax, 0xa
jae 0x1400e7803
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e77ed
test al, 0x10
je 0x1400e77ed
mov rcx, rdi
call fcn.14012db94
jmp 0x1400e77f5
mov rcx, rdi
call fcn.14011295c
test eax, eax
je 0x1400e7803
mov eax, 0x1f
jmp 0x1400e7977
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7847
bt eax, 0xa
jae 0x1400e7847
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e783b
test al, 0x10
je 0x1400e783b
mov rcx, rdi
call fcn.14012db94
jmp 0x1400e7843
mov rcx, rdi
call fcn.14011295c
test eax, eax
jne 0x1400e785e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14012d64c
mov ebx, eax
test eax, eax
je 0x1400e796d
test rdi, rdi
jne 0x1400e7867
xor ebx, ebx
jmp 0x1400e7877
mov edx, 0x104
mov rcx, rdi
call fcn.14012a5d8
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140102230
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1401100d8
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x1400e78cb
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x1400e78cb
dec rbx
cmp rbx, 0x104
jae 0x1400e7990
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e790f
bt eax, 0xa
jae 0x1400e790f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7901
test al, 0x10
je 0x1400e7901
lea rcx, [rsp + 0x50]
call fcn.14012db94
jmp 0x1400e790b
lea rcx, [rsp + 0x50]
call fcn.14011295c
test eax, eax
jne 0x1400e7924
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14012d64c
mov ebx, eax
test eax, eax
je 0x1400e796d
lea rcx, [rsp + 0x50]
call fcn.14012d910
mov ebx, eax
test eax, eax
je 0x1400e796d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.140102938
mov rdi, rax
test rax, rax
je 0x1400e796d
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400e7790
mov ebx, eax
test eax, eax
jne 0x1400e796d
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.14012d910
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140100920
add rsp, 0x170
pop rdi
ret
call fcn.140100a84
int3
Function at 0x1400e7a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor dil, dil
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400e7be7
test rdx, rdx
je 0x1400e7be7
xorps xmm0, xmm0
mov edx, 0x100
mov rcx, rbp
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.140041550
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7af4
bt eax, 0xa
jae 0x1400e7af4
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e7ae4
test al, 0x10
je 0x1400e7ae4
mov rcx, rbx
call fcn.14012db94
jmp 0x1400e7aec
mov rcx, rbx
call fcn.14011295c
test eax, eax
jne 0x1400e7bdf
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14012d64c
test eax, eax
jne 0x1400e7bdf
mov ecx, dword [rsp + 0x44]
test ecx, ecx
jle 0x1400e7bdf
mov eax, 0x1000
mov qword [rsp + 0xb0], rsi
cmp ecx, eax
mov qword [rsp + 0x78], r14
cmovle eax, ecx
movsxd r14, eax
mov rcx, r14
call fcn.1400e79a0
mov rsi, rax
test rax, rax
je 0x1400e7bd2
xor r8d, r8d
mov qword [rsp + 0x70], r15
lea rdx, [0x14017d854]
mov rcx, rbx
call fcn.1400e7650
mov r15, rax
test rax, rax
je 0x1400e7bc5
movsxd rdi, dword [rsp + 0x44]
test rdi, rdi
je 0x1400e7bae
nop dword [rax]
cmp rdi, r14
mov qword [rsp + 0x20], r15
mov rbx, r14
mov r8d, 1
cmovbe rbx, rdi
mov rdx, r14
mov r9, rbx
mov rcx, rsi
call fcn.140141874
cmp rax, rbx
jne 0x1400e7bae
mov r8, rax
mov rdx, rsi
mov rcx, rbp
sub rdi, rax
call fcn.140041630
test rdi, rdi
jne 0x1400e7b70
mov rcx, r15
call fcn.140142080
mov rcx, r15
call fcn.140141a34
test rdi, rdi
sete dil
mov rcx, rsi
call fcn.14010fff4
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
mov rcx, rbp
call fcn.140041360
movzx eax, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140100920
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400e7e30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x240
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140102230
xorps xmm0, xmm0
mov dword [rbx], 9
mov edx, 0x104
lea rcx, [rsp + 0x20]
movups xmmword [rbx + 4], xmm0
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400e7f3d
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], r15
lfence
lea ecx, [rax + 1]
lea rsi, [rcx + rcx]
mov r15d, ecx
mov rcx, rsi
call fcn.140110008
mov rdi, rax
test rax, rax
je 0x1400e7ed6
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140102230
mov rsi, qword [rsp + 0x250]
test rdi, rdi
mov qword [rbx + 4], rdi
mov rdi, qword [rsp + 0x258]
je 0x1400e7f10
lfence
mov rcx, qword [rbx + 4]
lea r8, [rsp + 0x20]
mov rdx, r15
call fcn.140148458
lea ecx, [r14 + r14]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov r15, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140100920
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r14
ret
mov rax, rbx
jmp 0x1400e7f1b
Function at 0x1400ed200
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x20], 0x238
xor eax, eax
lea rcx, [rsp + 0x4c]
xor edx, edx
mov dword [rsp + 0x28], eax
mov r8d, 0x20c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
call fcn.140102230
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x1400ed2da
mov qword [rsp + 0x280], rbx
nop word [rax + rax]
lea rdx, str.ipf_helper.exe
lea rcx, [rsp + 0x4c]
call fcn.140148500
test eax, eax
jne 0x1400ed2c1
mov r8d, dword [rsp + 0x28]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400ed2c1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x1400ed280
mov rbx, qword [rsp + 0x280]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140100920
add rsp, 0x270
pop rdi
ret
Function at 0x1400ef990
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov byte [rsp + 0x2e], 0xd
mov ecx, 0xfffffff6
mov word [rsp + 0x20], bx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140100920
add rsp, 0x50
pop rbx
ret