joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, r8
mov rbx, rcx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400ad590
test rbx, rbx
je 0x140063b8f
xor edx, edx
lea rcx, [rsp + 0x170]
mov r8d, 0x104
call fcn.1400ad590
lea rsi, [0x14012779c]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 1
jne 0x140063bb7
lea rax, [rsp + 0x5c]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rbx + 8]
lea r8, [0x1401277a0]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x170]
call fcn.140063f70
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063b6b
bt eax, 0xa
jae 0x140063b6b
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063b59
bt eax, 0xa
jae 0x140063b59
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063b4c
test al, 0x10
je 0x140063b4c
lea rcx, [rsp + 0x170]
call fcn.1400d8df4
jmp 0x140063b59
lea rcx, [rsp + 0x170]
call fcn.1400bdbbc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad590
cmp byte [rsp + 0x5c], 0
je 0x140063ab1
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rdi
call fcn.1400bb338
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400abc80
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test eax, eax
jne 0x140063b76
xor eax, eax
jmp 0x140063b92

Function at 0x140063bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063c18
bt eax, 0xa
jae 0x140063c18
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063c05
test al, 0x10
je 0x140063c05
mov rcx, rbx
call fcn.1400d8df4
jmp 0x140063c0d
mov rcx, rbx
call fcn.1400bdbbc
test eax, eax
je 0x140063c18
mov ecx, 0x1f
jmp 0x140063c27
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d88ac
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x60
pop rbx
ret
Function at 0x140063c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063cc6
bt eax, 0xa
jae 0x140063cc6
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063ca8
test al, 0x10
je 0x140063ca8
mov rcx, rdi
call fcn.1400d8df4
jmp 0x140063cb0
mov rcx, rdi
call fcn.1400bdbbc
test eax, eax
je 0x140063cc6
test rbx, rbx
je 0x140063cbf
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x140063d6e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400bb338
lea rdx, [0x140128018]
mov rcx, rsi
call fcn.1400da1a0
test rax, rax
je 0x140063d47
mov edx, 0x63
mov rcx, rsi
call fcn.1400ad730
test rax, rax
jne 0x140063d47
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400d5838
cmp rax, 0x20
jne 0x140063d2b
mov byte [rsp + 0x47], bpl
jmp 0x140063d47
mov r9, 0xffffffffffffffff
lea r8, [0x14012801c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400ec3c4
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ec794
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x140063d6b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400abc80
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006a050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.1400ad590
lea rax, [0x140127920]
mov edx, 0x104
lea rdi, [0x140128798]
mov qword [rsp + 0x20], rax
lea r9, str.override
mov r8d, 2
lea rcx, [rsp + 0xa0]
mov rsi, rdi
call fcn.140013cf0
lea rcx, str.gddv
call fcn.140003d60
mov rbx, rax
test rax, rax
je 0x14006a11f
mov rcx, rax
call fcn.140063e50
cmp byte [rbx + 0x49], 0
lea rcx, [rbx + 0x49]
cmovne rsi, rcx
nop
mov eax, 1
xchg qword [rbx + 8], rax
cmp rax, 1
je 0x14006a0f0
add dword [rbx + 0x10], 0xffffffff
mov eax, 0
xchg qword [rbx + 8], rax
jne 0x14006a117
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockShared]
mov rcx, rbx
call fcn.1400088b0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
lea r8, [0x140129d9c]
mov r9b, 0xff
mov qword [rsp + 0x20], 0
mov edx, 0x221
mov qword [rsp + 0x54], 0
mov ecx, 1
mov dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x60], 0
call fcn.140041ab0
mov ebx, eax
test eax, eax
jne 0x14006a184
mov rax, qword [rsp + 0x54]
test rax, rax
je 0x14006a184
cmp dword [rsp + 0x60], ebx
cmovne rdi, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006a1db
bt eax, 0xa
jae 0x14006a1db
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006a1c3
test al, 0x10
je 0x14006a1c3
lea rcx, [rsp + 0xa0]
call fcn.1400d8df4
jmp 0x14006a1d0
lea rcx, [rsp + 0xa0]
call fcn.1400bdbbc
test eax, eax
je 0x14006a1db
mov eax, 0x1f
jmp 0x14006a1ed
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.1400d88ac
test eax, eax
mov qword [rsp + 0x40], rsi
mov rax, qword [0x140206c28]
lea r8, str.false
mov qword [rsp + 0x38], rdi
lea rdx, str.true
cmovne rdx, r8
lea r9, [0x140206c30]
mov qword [rsp + 0x30], rdx
lea r8, [0x14012ed28]
mov qword [rsp + 0x28], rax
lea rdx, str._about__n___ufVersion__s__ufVersion__n___lfVersion__s__lfVersion__n___osType__s__osType__n___shellVersion__s__shellVersion__n___overrideDvExistsOnDisk__s__overrideDvExistsOnDisk__n___currentGddvDescription__s__currentGddvDescription__n___currentCacheDescription__s__currentCacheDescription__n__about__n_n
lea rax, [0x140222ac0]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140069090
test eax, eax
mov ecx, 0xbba
cmovle ebx, ecx
mov rcx, qword [rsp + 0x54]
test rcx, rcx
je 0x14006a25e
call fcn.1400bb254
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400abc80
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140085640
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [0x14020e430], 4
mov rbx, rcx
jl 0x14008568f
test dword [0x14020e4ac], 0x40000
je 0x14008568f
lea rax, str.Starting_thread__n
mov edx, 4
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r8, str.CStateChangeDetection::StartThread
mov dword [rsp + 0x20], 0x5e
mov ecx, 0x40000
call fcn.140078180
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x140023f87.0]
xor r9d, r9d
mov dword [rbx + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400856ca
mov eax, 0x80004005
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x28], 0
lea r8, [0x1400858b0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x1400856bf
cmp dword [0x14020e430], 4
jl 0x14008574b
test dword [0x14020e4ac], 0x40000
je 0x14008574b
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetThreadId]
mov dword [rsp + 0x30], eax
lea r10, str.Thread_ID___d_n
mov qword [rsp + 0x28], r10
mov edx, 4
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
mov dword [rsp + 0x20], 0x75
lea r8, str.CStateChangeDetection::StartThread
mov ecx, 0x40000
call fcn.140078180
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x14008a3d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp dword [0x14020e430], 3
jl 0x14008a420
test dword [0x14020e494], 0x400000
je 0x14008a420
lea rax, str.Entering_Function...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r8, str.dppe_esif_init
mov dword [rsp + 0x20], 0xc1
mov ecx, 0x400000
call fcn.140078180
xor edi, edi
cmp dword [0x14021b698], 4
je 0x14008a451
call fcn.140002150
lea rcx, [0x140219338]
mov qword [0x140219330], rax
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
mov qword [0x140219340], rdi
mov dword [0x140219348], edi
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008a49d
bt eax, 0xa
jae 0x14008a49d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008a48d
test al, 0x10
je 0x14008a48d
lea rcx, str.user32.dll
call fcn.1400d8df4
jmp 0x14008a499
lea rcx, str.user32.dll
call fcn.1400bdbbc
test eax, eax
jne 0x14008a512
mov ecx, 0x18
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x14008a512
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x140219388], rbx
test rcx, rcx
je 0x14008a519
lea rdx, str.GetSystemMetrics
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14008a509
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x140219390], rdi
jmp 0x14008a519
mov qword [0x140219388], rdi
lea rcx, [0x140219350]
call fcn.14008c350
call fcn.14008e500
cmp dword [0x14020e430], 3
mov ebx, eax
jl 0x14008a578
test dword [0x14020e494], 0x400000
je 0x14008a578
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea rax, str.Exiting_function:_Exit_code__0x_08X...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r8, str.dppe_esif_init
mov ecx, 0x400000
mov dword [rsp + 0x20], 0xda
call fcn.140078180
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140092330
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
lea rbp, [0x1402193e0]
xor edi, edi
mov rcx, rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
mov eax, dword [0x1402193f4]
inc eax
cmp dword [0x14020e430], 4
mov dword [0x1402193f4], eax
jl 0x1400923af
test dword [0x14020e4ac], 0x10000
je 0x1400923af
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
lea rax, str.Refcount___d_n
mov ecx, 0x10000
mov qword [rsp + 0x28], rax
lea r8, str.EsifHid_Enable
lea edx, [rdi + 4]
mov dword [rsp + 0x20], 0x162
call fcn.140078180
mov eax, dword [0x1402193f4]
cmp eax, 1
jne 0x1400924ef
mov qword [rsp + 0x50], rsi
call fcn.140092930
cmp dword [0x14020e430], 4
jl 0x140092408
test dword [0x14020e4ac], 0x10000
je 0x140092408
lea rax, str.Starting_HID_ETW_tracking_n
mov edx, 4
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
lea r8, str.EsifHid_Start
mov dword [rsp + 0x20], 0x128
mov ecx, 0x10000
call fcn.140078180
mov r8, rbp
lea rdx, [0x140092a50]
lea rcx, [0x140219400]
call fcn.140001060
mov ecx, 0x10
mov byte [0x140219410], 1
mov qword [0x140219408], rdi
call fcn.1400bb268
mov rsi, rax
test rax, rax
jne 0x140092445
mov ebx, 0x708
jmp 0x140092489
lea rax, [0x140091e80]
mov qword [rsp + 0x28], rdi
mov r9, rsi
mov qword [rsi], rax
lea r8, [0x140092ab0]
mov qword [rsi + 8], rbp
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1402193f8], rax
test rax, rax
jne 0x1400924db
mov rcx, rsi
call fcn.1400bb254
mov ebx, 0x3eb
lea rcx, [0x140219400]
call fcn.1400013f0
cmp dword [0x14020e430], 1
jl 0x1400924db
test dword [0x14020e464], 0x10000
je 0x1400924db
lea rax, str.Unable_to_create_HID_ETW_control_thread_n
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
lea r8, str.EsifHid_Start
mov dword [rsp + 0x20], 0x139
mov ecx, 0x10000
call fcn.140078180
mov rsi, qword [rsp + 0x50]
test ebx, ebx
je 0x1400924ef
call fcn.140092930
dec dword [0x1402193f4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
cmp byte [0x140219410], dil
setne dil
mov ecx, edi
call fcn.1400928b0
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140094df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x140094e65
bt eax, 0xa
jae 0x140094e65
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140094e55
test al, 0x10
je 0x140094e55
lea rcx, str.powrprof.dll
call fcn.1400d8df4
jmp 0x140094e61
lea rcx, str.powrprof.dll
call fcn.1400bdbbc
test eax, eax
jne 0x140094ea6
mov ecx, 0x18
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x140094ea6
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x140094ea9
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Dynamic_Tuning:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.140097340
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x14009501d
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094ff1
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140094f8c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x140094ff1
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140094f37
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x140094ff1
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x140094fe4
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x140023f87.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094fff
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.1400bb254
test rdi, rdi
je 0x14009502a
mov rcx, rdi
call fcn.1400bb254
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400975d0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ad590
lea rbp, [0x14012779c]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277a0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.140097c00
mov ecx, 0x110
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x14009765b
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.1400ad590
test rbx, rbx
je 0x1400977b0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140097787
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277a0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140097c00
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097732
bt eax, 0xa
jae 0x140097732
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097720
bt eax, 0xa
jae 0x140097720
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097713
test al, 0x10
je 0x140097713
lea rcx, [rsp + 0x170]
call fcn.1400d8df4
jmp 0x140097720
lea rcx, [rsp + 0x170]
call fcn.1400bdbbc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad590
cmp byte [rsp + 0x5c], 0
jne 0x140097756
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x140097690
cmp byte [rsp + 0x5c], 0
je 0x14009778e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb338
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb338
cmp byte [rsp + 0x5c], 0
jne 0x1400977b0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400977a4
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb254
xor eax, eax
jmp 0x1400977b3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400abc80
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400977e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097838
bt eax, 0xa
jae 0x140097838
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097825
test al, 0x10
je 0x140097825
mov rcx, rbx
call fcn.1400d8df4
jmp 0x14009782d
mov rcx, rbx
call fcn.1400bdbbc
test eax, eax
je 0x140097838
mov ecx, 0x1f
jmp 0x140097847
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d88ac
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x60
pop rbx
ret

Function at 0x140097870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400978e6
bt eax, 0xa
jae 0x1400978e6
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400978c8
test al, 0x10
je 0x1400978c8
mov rcx, rdi
call fcn.1400d8df4
jmp 0x1400978d0
mov rcx, rdi
call fcn.1400bdbbc
test eax, eax
je 0x1400978e6
test rbx, rbx
je 0x1400978df
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x14009798e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400bb338
lea rdx, [0x140128018]
mov rcx, rsi
call fcn.1400da1a0
test rax, rax
je 0x140097967
mov edx, 0x63
mov rcx, rsi
call fcn.1400ad730
test rax, rax
jne 0x140097967
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400d5838
cmp rax, 0x20
jne 0x14009794b
mov byte [rsp + 0x47], bpl
jmp 0x140097967
mov r9, 0xffffffffffffffff
lea r8, [0x14012801c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400ec3c4
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ec794
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x14009798b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400abc80
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400979b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097a23
bt eax, 0xa
jae 0x140097a23
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097a0d
test al, 0x10
je 0x140097a0d
mov rcx, rdi
call fcn.1400d8df4
jmp 0x140097a15
mov rcx, rdi
call fcn.1400bdbbc
test eax, eax
je 0x140097a23
mov eax, 0x1f
jmp 0x140097b97
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097a67
bt eax, 0xa
jae 0x140097a67
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097a5b
test al, 0x10
je 0x140097a5b
mov rcx, rdi
call fcn.1400d8df4
jmp 0x140097a63
mov rcx, rdi
call fcn.1400bdbbc
test eax, eax
jne 0x140097a7e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d88ac
mov ebx, eax
test eax, eax
je 0x140097b8d
test rdi, rdi
jne 0x140097a87
xor ebx, ebx
jmp 0x140097a97
mov edx, 0x104
mov rcx, rdi
call fcn.1400d5838
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400ad590
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400bb338
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x140097aeb
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x140097aeb
dec rbx
cmp rbx, 0x104
jae 0x140097bb0
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097b2f
bt eax, 0xa
jae 0x140097b2f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097b21
test al, 0x10
je 0x140097b21
lea rcx, [rsp + 0x50]
call fcn.1400d8df4
jmp 0x140097b2b
lea rcx, [rsp + 0x50]
call fcn.1400bdbbc
test eax, eax
jne 0x140097b44
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d88ac
mov ebx, eax
test eax, eax
je 0x140097b8d
lea rcx, [rsp + 0x50]
call fcn.1400d8b70
mov ebx, eax
test eax, eax
je 0x140097b8d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400adc98
mov rdi, rax
test rax, rax
je 0x140097b8d
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400979b0
mov ebx, eax
test eax, eax
jne 0x140097b8d
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d8b70
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x170
pop rdi
ret
call fcn.1400abde4
int3