joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ada0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp dword [0x140213620], 3
jl 0x14008adf0
test dword [0x140213684], 0x400000
je 0x14008adf0
lea rax, str.Entering_Function...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r8, str.dppe_esif_init
mov dword [rsp + 0x20], 0xc1
mov ecx, 0x400000
call fcn.140079050
xor edi, edi
cmp dword [0x140220a38], 4
je 0x14008ae21
call fcn.140002160
lea rcx, [0x14021e6b8]
mov qword [0x14021e6b0], rax
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov qword [0x14021e6c0], rdi
mov dword [0x14021e6c8], edi
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008ae6d
bt eax, 0xa
jae 0x14008ae6d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008ae5d
test al, 0x10
je 0x14008ae5d
lea rcx, str.user32.dll
call fcn.1400d95ec
jmp 0x14008ae69
lea rcx, str.user32.dll
call fcn.1400bd14c
test eax, eax
jne 0x14008aee2
mov ecx, 0x18
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x14008aee2
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x14021e700], rbx
test rcx, rcx
je 0x14008aee9
lea rdx, str.GetSystemMetrics
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14008aed9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x14021e708], rdi
jmp 0x14008aee9
mov qword [0x14021e700], rdi
lea rcx, [0x14021e6d0]
call fcn.14008cd20
call fcn.14008eed0
cmp dword [0x140213620], 3
mov ebx, eax
jl 0x14008af48
test dword [0x140213684], 0x400000
je 0x14008af48
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea rax, str.Exiting_function:_Exit_code__0x_08X...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r8, str.dppe_esif_init
mov ecx, 0x400000
mov dword [rsp + 0x20], 0xda
call fcn.140079050
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400930a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
lea rbp, [0x14021e750]
xor edi, edi
mov rcx, rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x14021e764]
inc eax
cmp dword [0x140213620], 4
mov dword [0x14021e764], eax
jl 0x14009311f
test dword [0x14021369c], 0x10000
je 0x14009311f
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
lea rax, str.Refcount___d_n
mov ecx, 0x10000
mov qword [rsp + 0x28], rax
lea r8, str.EsifHid_Enable
lea edx, [rdi + 4]
mov dword [rsp + 0x20], 0x156
call fcn.140079050
mov eax, dword [0x14021e764]
cmp eax, 1
jne 0x140093212
mov qword [rsp + 0x50], rsi
call fcn.1400935e0
mov r8, rbp
lea rdx, [0x1400936c0]
lea rcx, [0x14021e770]
call fcn.140001060
mov ecx, 0x10
mov byte [0x14021e778], 1
call fcn.1400bb768
mov rsi, rax
test rax, rax
jne 0x140093168
mov ebx, 0x708
jmp 0x1400931ac
lea rax, [0x140092c40]
mov qword [rsp + 0x28], rdi
mov r9, rsi
mov qword [rsi], rax
lea r8, [0x140093720]
mov qword [rsi + 8], rbp
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14021e768], rax
test rax, rax
jne 0x1400931fe
mov rcx, rsi
call fcn.1400bb754
mov ebx, 0x3eb
lea rcx, [0x14021e770]
call fcn.1400013f0
cmp dword [0x140213620], 1
jl 0x1400931fe
test dword [0x140213654], 0x10000
je 0x1400931fe
lea rax, str.Unable_to_create_HID_ETW_control_thread_n
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
lea r8, str.EsifHid_Start
mov dword [rsp + 0x20], 0x12f
mov ecx, 0x10000
call fcn.140079050
mov rsi, qword [rsp + 0x50]
test ebx, ebx
je 0x140093212
call fcn.1400935e0
dec dword [0x14021e764]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp byte [0x14021e778], dil
setne dil
mov ecx, edi
call fcn.140093560
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140095a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x140095ad5
bt eax, 0xa
jae 0x140095ad5
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140095ac5
test al, 0x10
je 0x140095ac5
lea rcx, str.powrprof.dll
call fcn.1400d95ec
jmp 0x140095ad1
lea rcx, str.powrprof.dll
call fcn.1400bd14c
test eax, eax
jne 0x140095b16
mov ecx, 0x18
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x140095b16
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
jmp 0x140095b19
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Dynamic_Tuning:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.140097fb0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x140095c8d
mov rcx, qword [rbx]
test rcx, rcx
je 0x140095c61
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140095bfc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x140095c61
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140095ba7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
jmp 0x140095c61
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x140095c54
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x140023ef7.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140095c6f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.1400bb754
test rdi, rdi
je 0x140095c9a
mov rcx, rdi
call fcn.1400bb754
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140098240
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ae310
lea rbp, [0x1401277ec]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277f0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.140098870
mov ecx, pe_nt_image_headers64
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x1400982cb
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400ae310
test rbx, rbx
je 0x140098420
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400983f7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277f0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140098870
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400983a2
bt eax, 0xa
jae 0x1400983a2
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098390
bt eax, 0xa
jae 0x140098390
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098383
test al, 0x10
je 0x140098383
lea rcx, [rsp + 0x170]
call fcn.1400d95ec
jmp 0x140098390
lea rcx, [rsp + 0x170]
call fcn.1400bd14c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ae310
cmp byte [rsp + 0x5c], 0
jne 0x1400983c6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140098300
cmp byte [rsp + 0x5c], 0
je 0x1400983fe
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb838
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb838
cmp byte [rsp + 0x5c], 0
jne 0x140098420
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140098414
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb754
xor eax, eax
jmp 0x140098423
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140098450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400984a8
bt eax, 0xa
jae 0x1400984a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098495
test al, 0x10
je 0x140098495
mov rcx, rbx
call fcn.1400d95ec
jmp 0x14009849d
mov rcx, rbx
call fcn.1400bd14c
test eax, eax
je 0x1400984a8
mov ecx, 0x1f
jmp 0x1400984b7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d90a4
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x60
pop rbx
ret

Function at 0x1400984e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098556
bt eax, 0xa
jae 0x140098556
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098538
test al, 0x10
je 0x140098538
mov rcx, rdi
call fcn.1400d95ec
jmp 0x140098540
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
je 0x140098556
test rbx, rbx
je 0x14009854f
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x1400985fe
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400bb838
lea rdx, [0x140128068]
mov rcx, rsi
call fcn.1400da990
test rax, rax
je 0x1400985d7
mov edx, 0x63
mov rcx, rsi
call fcn.1400ae4b0
test rax, rax
jne 0x1400985d7
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400d5db8
cmp rax, 0x20
jne 0x1400985bb
mov byte [rsp + 0x47], bpl
jmp 0x1400985d7
mov r9, 0xffffffffffffffff
lea r8, [0x14012806c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400ecb38
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ecf08
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400985fb
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140098620
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098693
bt eax, 0xa
jae 0x140098693
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009867d
test al, 0x10
je 0x14009867d
mov rcx, rdi
call fcn.1400d95ec
jmp 0x140098685
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
je 0x140098693
mov eax, 0x1f
jmp 0x140098807
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400986d7
bt eax, 0xa
jae 0x1400986d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400986cb
test al, 0x10
je 0x1400986cb
mov rcx, rdi
call fcn.1400d95ec
jmp 0x1400986d3
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
jne 0x1400986ee
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d90a4
mov ebx, eax
test eax, eax
je 0x1400987fd
test rdi, rdi
jne 0x1400986f7
xor ebx, ebx
jmp 0x140098707
mov edx, 0x104
mov rcx, rdi
call fcn.1400d5db8
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400ae310
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400bb838
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x14009875b
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x14009875b
dec rbx
cmp rbx, 0x104
jae 0x140098820
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009879f
bt eax, 0xa
jae 0x14009879f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098791
test al, 0x10
je 0x140098791
lea rcx, [rsp + 0x50]
call fcn.1400d95ec
jmp 0x14009879b
lea rcx, [rsp + 0x50]
call fcn.1400bd14c
test eax, eax
jne 0x1400987b4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d90a4
mov ebx, eax
test eax, eax
je 0x1400987fd
lea rcx, [rsp + 0x50]
call fcn.1400d9368
mov ebx, eax
test eax, eax
je 0x1400987fd
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400aea18
mov rdi, rax
test rax, rax
je 0x1400987fd
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.140098620
mov ebx, eax
test eax, eax
jne 0x1400987fd
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d9368
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x170
pop rdi
ret
call fcn.1400ac994
int3
Function at 0x1400988f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor dil, dil
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140098a77
test rdx, rdx
je 0x140098a77
xorps xmm0, xmm0
mov edx, 0x100
mov rcx, rbp
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.14000d0f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098984
bt eax, 0xa
jae 0x140098984
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140098974
test al, 0x10
je 0x140098974
mov rcx, rbx
call fcn.1400d95ec
jmp 0x14009897c
mov rcx, rbx
call fcn.1400bd14c
test eax, eax
jne 0x140098a6f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d90a4
test eax, eax
jne 0x140098a6f
mov ecx, dword [rsp + 0x44]
test ecx, ecx
jle 0x140098a6f
mov eax, 0x1000
mov qword [rsp + 0xb0], rsi
cmp ecx, eax
mov qword [rsp + 0x78], r14
cmovle eax, ecx
movsxd r14, eax
mov rcx, r14
call fcn.140098830
mov rsi, rax
test rax, rax
je 0x140098a62
xor r8d, r8d
mov qword [rsp + 0x70], r15
lea rdx, [0x140127a64]
mov rcx, rbx
call fcn.1400984e0
mov r15, rax
test rax, rax
je 0x140098a55
movsxd rdi, dword [rsp + 0x44]
test rdi, rdi
je 0x140098a3e
nop dword [rax]
cmp rdi, r14
mov qword [rsp + 0x20], r15
mov rbx, r14
mov r8d, 1
cmovbe rbx, rdi
mov rdx, r14
mov r9, rbx
mov rcx, rsi
call fcn.1400ed278
cmp rax, rbx
jne 0x140098a3e
mov r8, rax
mov rdx, rsi
mov rcx, rbp
sub rdi, rax
call fcn.14000d1d0
test rdi, rdi
jne 0x140098a00
mov rcx, r15
call fcn.1400eda84
mov rcx, r15
call fcn.1400ed438
test rdi, rdi
sete dil
mov rcx, rsi
call fcn.1400bb754
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
mov rcx, rbp
call fcn.14000cf00
movzx eax, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x140098cc0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x240
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400ae310
xorps xmm0, xmm0
mov dword [rbx], 9
mov edx, 0x104
lea rcx, [rsp + 0x20]
movups xmmword [rbx + 4], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140098dcd
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], r15
lfence
lea ecx, [rax + 1]
lea rsi, [rcx + rcx]
mov r15d, ecx
mov rcx, rsi
call fcn.1400bb768
mov rdi, rax
test rax, rax
je 0x140098d66
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400ae310
mov rsi, qword [rsp + 0x250]
test rdi, rdi
mov qword [rbx + 4], rdi
mov rdi, qword [rsp + 0x258]
je 0x140098da0
lfence
mov rcx, qword [rbx + 4]
lea r8, [rsp + 0x20]
mov rdx, r15
call fcn.1400f3b58
lea ecx, [r14 + r14]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov r15, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r14
ret
mov rax, rbx
jmp 0x140098dab
Function at 0x14009dd60
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov byte [rsp + 0x2e], 0xd
mov ecx, 0xfffffff6
mov word [rsp + 0x20], bx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x50
pop rbx
ret
Function at 0x14009de30
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r14
sub rsp, 0xd0
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor eax, eax
mov r12, r8
mov dword [rsp + 0x54], eax
mov rdi, rdx
mov qword [r11 - 0x64], rax
xor ebx, ebx
mov dword [r11 - 0x5c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, qword [rdi]
mov rsi, rax
test rcx, rcx
jne 0x14009de7e
mov ecx, ebx
jmp 0x14009de8b
mov edx, 0x1fff
call fcn.1400d6034
mov rcx, rax
cmp word [rsi], 0x22
lea rax, [rcx + 2]
mov rdx, qword [rdi + 8]
cmovne rax, rcx
lea rcx, [rsi + rax*2]
call fcn.1400afed4
mov r14, rax
test rax, rax
jne 0x14009dec5
lea rdx, str.Unable_to_parse_command_line._n
lea ecx, [rax + 3]
call fcn.140012790
mov eax, 0x708
jmp 0x14009e07c
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x100], rbp
mov qword [rsp + 0x118], r15
test rcx, rcx
jne 0x14009dee3
mov rax, rbx
jmp 0x14009deed
mov edx, 0x1fff
call fcn.1400d6034
mov edx, 0x1fff
lea r15, [r14 + rax*2]
mov rcx, rsi
call fcn.1400d6034
mov rcx, qword [rdi + 8]
lea rsi, [rax + 1]
test rcx, rcx
jne 0x14009df10
mov rax, rbx
jmp 0x14009df1a
mov edx, 0x1fff
call fcn.1400d6034
mov edx, 0x1fff
lea rcx, str.server__i
sub rsi, rax
call fcn.1400d6034
lea r14, [rax + 2]
add r14, rsi
lea rbp, [r14 + r14]
mov rcx, rbp
call fcn.1400bb768
mov rsi, rax
test rax, rax
je 0x14009e056
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1400ae310
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.1400ae310
mov eax, 0x22
mov rdx, r14
mov word [rsi], ax
mov rcx, rsi
mov r8, qword [rdi]
call fcn.1400f3d0c
lea r8, [0x1401e03bc]
mov rdx, r14
mov rcx, rsi
call fcn.1400f3d0c
lea r8, [0x1401e03c0]
mov rdx, r14
mov rcx, rsi
call fcn.1400f3d0c
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.1400f3d0c
mov qword [rsp + 0x48], r12
lea rax, [0x1401dc048]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x28], 0x8000000
xor ecx, ecx
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x8c], 1
mov qword [rsp + 0x58], rbx
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov ecx, 0x3eb
cmove ebx, ecx
mov rcx, rsi
call fcn.1400bb754
mov eax, ebx
jmp 0x14009e06c
lea rdx, str.Unable_to_allocate_memory._n
mov ecx, 3
call fcn.140012790
mov eax, 0x708
mov rbp, qword [rsp + 0x100]
mov r15, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0xd0
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009f060
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14009f0b7
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x14009f0b7
call fcn.14009fb30
test eax, eax
je 0x14009f0b7
cmp qword [rbx + 0x270], 0
je 0x14009f0b7
mov rcx, qword [rbx + 0x28]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14009fc20
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14009f3a0
Capabilities:
Connect pipe

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
xor eax, eax
mov rcx, qword [rcx + 0x208]
cmp rcx, 0xffffffffffffffff
je 0x14009f417
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
cmp dword [rdi + 0x214], eax
jne 0x14009f3fc
cmp dword [rdi + 0x218], eax
jne 0x14009f42a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x14009f3fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x14009f40b
mov ebx, 1
mov dword [rdi + 0x210], 1
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x30
pop rdi
ret
lea rdx, [rdi + 0x278]
mov qword [rdi + 0x278], rax
mov qword [rdi + 0x280], rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x14009f401
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14009f3f5
mov rcx, qword [rdi + 0x208]
lea r9d, [rbx + 1]
lea r8, [rsp + 0x20]
lea rdx, [rdi + 0x278]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebx, eax
test eax, eax
jne 0x14009f401
jmp 0x14009f40d