joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038280
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x60
mov rax, qword [0x14020fe28]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8, rdx
mov rbx, rcx
test rdx, rdx
jne 0x14003830f
cmp dword [0x140209140], 1
jl 0x140038491
test dword [0x140209174], 0x200000
je 0x140038491
lea rax, str.logstring_is_NULL
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
lea r8, str.EsifLogMgr_DataLogWrite
mov dword [rsp + 0x20], 0xac6
mov ecx, 0x200000
call fcn.140077c20
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a56b0
add rsp, 0x60
pop rbx
ret
mov eax, dword [rcx + 0x17c]
test eax, eax
je 0x140038491
mov qword [rsp + 0x58], rbp
xor ebp, ebp
test al, 8
jbe 0x140038352
cmp byte [rcx + 0x70], bpl
je 0x140038337
test byte [rcx + 0x180], 8
jne 0x140038352
lea rdx, [rsp + 0x80]
mov rcx, r8
call fcn.1400131f0
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x78]
test al, 4
jbe 0x140038389
cmp byte [rbx + 0x70], bpl
je 0x140038365
test byte [rbx + 0x180], 4
jne 0x140038389
lea r9, [rsp + 0x80]
mov ecx, 5
lea rdx, [0x1401298c8]
call fcn.140013800
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdi
test al, 2
jbe 0x14003840a
cmp byte [rbx + 0x70], bpl
je 0x1400383a1
test byte [rbx + 0x180], 2
jne 0x14003840a
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x50], rsi
mov rcx, r8
call fcn.14003d4c0
inc eax
movsxd rsi, eax
mov rcx, rsi
call fcn.14003d510
mov rdi, rax
test rax, rax
je 0x140038400
mov r9, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call fcn.140016bb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.1400b45d4
mov r8, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x50]
test byte [rbx + 0x17c], 1
jbe 0x140038487
cmp byte [rbx + 0x70], bpl
je 0x140038422
test byte [rbx + 0x180], 1
jne 0x140038487
lea rdx, [rsp + 0x80]
mov rcx, r8
call fcn.14003d4c0
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.14003d510
mov rbx, rax
test rax, rax
je 0x140038487
mov r9, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140016bb0
mov r8, rbx
lea rdx, [0x140127acc]
mov ecx, 3
call fcn.14009c650
mov rcx, rbx
call fcn.1400b45d4
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a56b0
add rsp, 0x60
pop rbx
ret
Function at 0x14003bc70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ebp, ebp
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rcx, qword [rsi + 8]
call fcn.140002400
test eax, eax
lea rcx, [rsi + 0x10]
setne bl
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test bl, bl
je 0x14003bd9a
cmp byte [rsi + 0x71], bpl
jne 0x14003bd50
mov word [rsi + 0x71], 1
cmp byte [rsi + 0x73], bpl
jne 0x14003bcd3
mov dword [rsi + 0x180], ebp
mov byte [rsi + 0x70], 1
lea rcx, [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor r9d, r9d
mov qword [rsi + 0x40], rbp
xor edx, edx
mov dword [rsi + 0x48], ebp
xor ecx, ecx
mov r8d, 0x7fffffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov ecx, 0x10
mov dword [rsi + 0x50], ebp
mov qword [rsi + 0x58], rax
mov byte [rsi + 0x4c], bpl
call fcn.1400b45e8
mov rbx, rax
test rax, rax
je 0x14003bd50
lea rax, [0x14003af10]
mov qword [rsp + 0x28], rbp
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x14003e240]
mov qword [rbx + 8], rsi
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x30], rax
test rax, rax
jne 0x14003bd50
mov rcx, rbx
call fcn.1400b45d4
cmp dword [0x140209140], 3
jl 0x14003bd96
test dword [0x1402091a4], 0x200000
je 0x14003bd96
lea rcx, str.Participant_logging_started
mov edx, 3
mov qword [rsp + 0x28], rcx
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
mov ecx, 0x200000
mov dword [rsp + 0x20], 0x47e
lea r8, str.EsifLogMgr_StartLoggingIfRequired
call fcn.140077c20
mov eax, ebp
jmp 0x14003bde5
cmp dword [0x140209140], 1
jl 0x14003bde0
test dword [0x140209174], 0x200000
je 0x14003bde0
lea rax, str.Error_:_No_Data_to_Log
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
lea r8, str.EsifLogMgr_StartLoggingIfRequired
mov dword [rsp + 0x20], 0x479
mov ecx, 0x200000
call fcn.140077c20
mov eax, 0x3ea
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003e270
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x1401ffa70]
xor edi, edi
cmp ecx, 0x1f4
cmovge eax, ecx
xor bl, bl
mov dword [0x1401ffa70], eax
nop dword [rax + rax]
lea rcx, [0x140214018]
call fcn.140041430
movzx ecx, bl
call fcn.14003f750
mov rsi, rax
nop word [rax + rax]
mov eax, 1
xchg qword [0x140214020], rax
cmp rax, 1
je 0x14003e2c0
add dword [0x140214028], 0xffffffff
mov rax, rdi
xchg qword [0x140214020], rax
jne 0x14003e2f2
lea rcx, [0x140214018]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
test rsi, rsi
je 0x14003e307
mov rcx, rsi
call fcn.140071d20
mov rcx, rsi
call fcn.1400716a0
inc bl
cmp bl, 0x20
jb 0x14003e2a0
mov rax, rdi
lock xadd qword [0x1401ffa68], rax
test al, al
je 0x14003e38b
mov ecx, 0x10
call fcn.1400b45e8
mov rbx, rax
test rax, rax
jne 0x14003e347
mov edi, 0x708
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rax, [0x14003e4c0]
mov qword [rsp + 0x28], rdi
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x140041f60]
mov qword [rbx + 8], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140214030], rax
test rax, rax
jne 0x14003e38b
mov rcx, rbx
call fcn.1400b45d4
mov edi, 0x3eb
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400635c0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14020fe28]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400a7190
lea rbp, [0x140120918]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x14012091c]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.140063cf0
mov ecx, 0x110
call fcn.1400b45e8
mov rbx, rax
test rax, rax
je 0x14006364b
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.1400a7190
test rbx, rbx
je 0x1400637a0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140063777
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14012091c]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140063cf0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063722
bt eax, 0xa
jae 0x140063722
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063710
bt eax, 0xa
jae 0x140063710
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063703
test al, 0x10
je 0x140063703
lea rcx, [rsp + 0x170]
call fcn.1400d246c
jmp 0x140063710
lea rcx, [rsp + 0x170]
call fcn.1400b5fcc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400a7190
cmp byte [rsp + 0x5c], 0
jne 0x140063746
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140063680
cmp byte [rsp + 0x5c], 0
je 0x14006377e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400b46b8
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400b46b8
cmp byte [rsp + 0x5c], 0
jne 0x1400637a0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140063794
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400b45d4
xor eax, eax
jmp 0x1400637a3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400a56b0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400637d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14020fe28]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, r8
mov rbx, rcx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400a7190
test rbx, rbx
je 0x14006390f
xor edx, edx
lea rcx, [rsp + 0x170]
mov r8d, 0x104
call fcn.1400a7190
lea rsi, [0x140120918]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x140063937
lea rax, [rsp + 0x5c]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rbx + 8]
lea r8, [0x14012091c]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x170]
call fcn.140063cf0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400638eb
bt eax, 0xa
jae 0x1400638eb
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400638d9
bt eax, 0xa
jae 0x1400638d9
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400638cc
test al, 0x10
je 0x1400638cc
lea rcx, [rsp + 0x170]
call fcn.1400d246c
jmp 0x1400638d9
lea rcx, [rsp + 0x170]
call fcn.1400b5fcc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400a7190
cmp byte [rsp + 0x5c], 0
je 0x140063831
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rdi
call fcn.1400b46b8
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400a56b0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test eax, eax
jne 0x1400638f6
xor eax, eax
jmp 0x140063912

Function at 0x140063940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14020fe28]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063998
bt eax, 0xa
jae 0x140063998
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063985
test al, 0x10
je 0x140063985
mov rcx, rbx
call fcn.1400d246c
jmp 0x14006398d
mov rcx, rbx
call fcn.1400b5fcc
test eax, eax
je 0x140063998
mov ecx, 0x1f
jmp 0x1400639a7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d1f24
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a56b0
add rsp, 0x60
pop rbx
ret
Function at 0x1400639d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14020fe28]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063a46
bt eax, 0xa
jae 0x140063a46
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063a28
test al, 0x10
je 0x140063a28
mov rcx, rdi
call fcn.1400d246c
jmp 0x140063a30
mov rcx, rdi
call fcn.1400b5fcc
test eax, eax
je 0x140063a46
test rbx, rbx
je 0x140063a3f
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x140063aee
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400b46b8
lea rdx, [0x140121198]
mov rcx, rsi
call fcn.1400d3810
test rax, rax
je 0x140063ac7
mov edx, 0x63
mov rcx, rsi
call fcn.1400a7330
test rax, rax
jne 0x140063ac7
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400cec38
cmp rax, 0x20
jne 0x140063aab
mov byte [rsp + 0x47], bpl
jmp 0x140063ac7
mov r9, 0xffffffffffffffff
lea r8, [0x14012119c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400e59b8
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400e5d88
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x140063aeb
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a56b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069bf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x14020fe28]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.1400a7190
lea rax, [0x140120aa0]
mov edx, 0x104
lea rdi, [0x1401217d8]
mov qword [rsp + 0x20], rax
lea r9, str.override
mov r8d, 2
lea rcx, [rsp + 0xa0]
mov rsi, rdi
call fcn.140014740
lea rcx, str.gddv
call fcn.1400047b0
mov rbx, rax
test rax, rax
je 0x140069cbf
mov rcx, rax
call fcn.140063bd0
cmp byte [rbx + 0x49], 0
lea rcx, [rbx + 0x49]
cmovne rsi, rcx
nop
mov eax, 1
xchg qword [rbx + 8], rax
cmp rax, 1
je 0x140069c90
add dword [rbx + 0x10], 0xffffffff
mov eax, 0
xchg qword [rbx + 8], rax
jne 0x140069cb7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov rcx, rbx
call fcn.140009190
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
lea r8, [0x140122cec]
mov r9b, 0xff
mov qword [rsp + 0x20], 0
mov edx, 0x221
mov qword [rsp + 0x54], 0
mov ecx, 1
mov dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x60], 0
call fcn.140041f90
mov ebx, eax
test eax, eax
jne 0x140069d24
mov rax, qword [rsp + 0x54]
test rax, rax
je 0x140069d24
cmp dword [rsp + 0x60], ebx
cmovne rdi, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140069d7b
bt eax, 0xa
jae 0x140069d7b
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140069d63
test al, 0x10
je 0x140069d63
lea rcx, [rsp + 0xa0]
call fcn.1400d246c
jmp 0x140069d70
lea rcx, [rsp + 0xa0]
call fcn.1400b5fcc
test eax, eax
je 0x140069d7b
mov eax, 0x1f
jmp 0x140069d8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.1400d1f24
test eax, eax
mov qword [rsp + 0x40], rsi
mov rax, qword [0x140201808]
lea r8, str.false
mov qword [rsp + 0x38], rdi
lea rdx, str.true
cmovne rdx, r8
lea r9, [0x140201810]
mov qword [rsp + 0x30], rdx
lea r8, [0x140127aa8]
mov qword [rsp + 0x28], rax
lea rdx, str._about__n___ufVersion__s__ufVersion__n___lfVersion__s__lfVersion__n___osType__s__osType__n___shellVersion__s__shellVersion__n___overrideDvExistsOnDisk__s__overrideDvExistsOnDisk__n___currentGddvDescription__s__currentGddvDescription__n___currentCacheDescription__s__currentCacheDescription__n__about__n_n
lea rax, [0x1402162e0]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140068c30
test eax, eax
mov ecx, 0xbba
cmovle ebx, ecx
mov rcx, qword [rsp + 0x54]
test rcx, rcx
je 0x140069dfe
call fcn.1400b45d4
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400a56b0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140083a60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [0x140209140], 4
mov rbx, rcx
jl 0x140083aaf
test dword [0x1402091bc], 0x40000
je 0x140083aaf
lea rax, str.Starting_thread__n
mov edx, 4
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r8, str.CStateChangeDetection::StartThread
mov dword [rsp + 0x20], 0x5e
mov ecx, 0x40000
call fcn.140077c20
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400246b7.0]
xor r9d, r9d
mov dword [rbx + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140083aea
mov eax, 0x80004005
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x28], 0
lea r8, [0x140083cd0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x140083adf
cmp dword [0x140209140], 4
jl 0x140083b6b
test dword [0x1402091bc], 0x40000
je 0x140083b6b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov dword [rsp + 0x30], eax
lea r10, str.Thread_ID___d_n
mov qword [rsp + 0x28], r10
mov edx, 4
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
mov dword [rsp + 0x20], 0x75
lea r8, str.CStateChangeDetection::StartThread
mov ecx, 0x40000
call fcn.140077c20
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x140087740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
sub rsp, 0x40
cmp dword [0x140209140], 3
jl 0x14008778c
test dword [0x1402091a4], 0x400000
je 0x14008778c
lea rax, str.Entering_Function...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r8, str.dppe_esif_init
mov dword [rsp + 0x20], 0xc1
mov ecx, 0x400000
call fcn.140077c20
xor esi, esi
cmp dword [0x1402162b8], 4
je 0x1400877bd
call fcn.140002160
lea rcx, [0x140214170]
mov qword [0x140214168], rax
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov qword [0x140214178], rsi
mov dword [0x140214180], esi
lea rcx, str.user32.dll
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008780e
bt eax, 0xa
jae 0x14008780e
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400877fe
test al, 0x10
je 0x1400877fe
lea rcx, str.user32.dll
call fcn.1400d246c
jmp 0x14008780a
lea rcx, str.user32.dll
call fcn.1400b5fcc
test eax, eax
jne 0x14008788d
mov ecx, 0x18
call fcn.1400b45e8
mov rbx, rax
test rax, rax
je 0x14008788d
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x1402141b8], rbx
test rcx, rcx
je 0x140087894
lea rdx, str.GetSystemMetrics
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14008787f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x1402141c0], rdi
mov rdi, qword [rsp + 0x58]
jmp 0x140087894
mov qword [0x1402141b8], rsi
lea rcx, [0x140214188]
call fcn.140089670
cmp dword [0x140209140], 3
mov rbx, qword [rsp + 0x50]
jl 0x1400878ef
test dword [0x1402091a4], 0x400000
je 0x1400878ef
lea rax, str.Exiting_function:_Exit_code__0x_08X...
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r8, str.dppe_esif_init
mov dword [rsp + 0x20], 0xd8
mov edx, 3
mov ecx, 0x400000
call fcn.140077c20
xor eax, eax
add rsp, 0x40
pop rsi
ret
Function at 0x14008fd40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14020fe28]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x14008fdb5
bt eax, 0xa
jae 0x14008fdb5
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008fda5
test al, 0x10
je 0x14008fda5
lea rcx, str.powrprof.dll
call fcn.1400d246c
jmp 0x14008fdb1
lea rcx, str.powrprof.dll
call fcn.1400b5fcc
test eax, eax
jne 0x14008fdf6
mov ecx, 0x18
call fcn.1400b45e8
mov rbx, rax
test rax, rax
je 0x14008fdf6
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
jmp 0x14008fdf9
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Dynamic_Tuning:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.140092280
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x14008ff6d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008ff41
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x14008fedc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x14008ff41
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x14008fe87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
jmp 0x14008ff41
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x14008ff34
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x1400246b7.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008ff4f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.1400b45d4
test rdi, rdi
je 0x14008ff7a
mov rcx, rdi
call fcn.1400b45d4
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a56b0
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret