joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400639d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063a46
bt eax, 0xa
jae 0x140063a46
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063a28
test al, 0x10
je 0x140063a28
mov rcx, rdi
call fcn.1400d2fdc
jmp 0x140063a30
mov rcx, rdi
call fcn.1400b6b3c
test eax, eax
je 0x140063a46
test rbx, rbx
je 0x140063a3f
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x140063aee
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400b5228
lea rdx, [0x1401211c8]
mov rcx, rsi
call fcn.1400d4380
test rax, rax
je 0x140063ac7
mov edx, 0x63
mov rcx, rsi
call fcn.1400a7ea0
test rax, rax
jne 0x140063ac7
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400cf7a8
cmp rax, 0x20
jne 0x140063aab
mov byte [rsp + 0x47], bpl
jmp 0x140063ac7
mov r9, 0xffffffffffffffff
lea r8, [0x1401211cc]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400e6528
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400e68f8
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x140063aeb
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a6220
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069bf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.1400a7d00
lea rax, [0x140120ad0]
mov edx, 0x104
lea rdi, [0x140121808]
mov qword [rsp + 0x20], rax
lea r9, str.override
mov r8d, 2
lea rcx, [rsp + 0xa0]
mov rsi, rdi
call fcn.140014740
lea rcx, str.gddv
call fcn.1400047b0
mov rbx, rax
test rax, rax
je 0x140069cbf
mov rcx, rax
call fcn.140063bd0
cmp byte [rbx + 0x49], 0
lea rcx, [rbx + 0x49]
cmovne rsi, rcx
nop
mov eax, 1
xchg qword [rbx + 8], rax
cmp rax, 1
je 0x140069c90
add dword [rbx + 0x10], 0xffffffff
mov eax, 0
xchg qword [rbx + 8], rax
jne 0x140069cb7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov rcx, rbx
call fcn.140009190
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
lea r8, [0x140122d1c]
mov r9b, 0xff
mov qword [rsp + 0x20], 0
mov edx, 0x221
mov qword [rsp + 0x54], 0
mov ecx, 1
mov dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x60], 0
call fcn.140041f90
mov ebx, eax
test eax, eax
jne 0x140069d24
mov rax, qword [rsp + 0x54]
test rax, rax
je 0x140069d24
cmp dword [rsp + 0x60], ebx
cmovne rdi, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140069d7b
bt eax, 0xa
jae 0x140069d7b
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140069d63
test al, 0x10
je 0x140069d63
lea rcx, [rsp + 0xa0]
call fcn.1400d2fdc
jmp 0x140069d70
lea rcx, [rsp + 0xa0]
call fcn.1400b6b3c
test eax, eax
je 0x140069d7b
mov eax, 0x1f
jmp 0x140069d8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.1400d2a94
test eax, eax
mov qword [rsp + 0x40], rsi
mov rax, qword [0x140202818]
lea r8, str.false
mov qword [rsp + 0x38], rdi
lea rdx, str.true
cmovne rdx, r8
lea r9, [0x140202820]
mov qword [rsp + 0x30], rdx
lea r8, [0x140127ad8]
mov qword [rsp + 0x28], rax
lea rdx, str._about__n___ufVersion__s__ufVersion__n___lfVersion__s__lfVersion__n___osType__s__osType__n___shellVersion__s__shellVersion__n___overrideDvExistsOnDisk__s__overrideDvExistsOnDisk__n___currentGddvDescription__s__currentGddvDescription__n___currentCacheDescription__s__currentCacheDescription__n__about__n_n
lea rax, [0x1402173e0]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140068c30
test eax, eax
mov ecx, 0xbba
cmovle ebx, ecx
mov rcx, qword [rsp + 0x54]
test rcx, rcx
je 0x140069dfe
call fcn.1400b5144
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400a6220
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140083a60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [0x14020a150], 4
mov rbx, rcx
jl 0x140083aaf
test dword [0x14020a1cc], 0x40000
je 0x140083aaf
lea rax, str.Starting_thread__n
mov edx, 4
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r8, str.CStateChangeDetection::StartThread
mov dword [rsp + 0x20], 0x5e
mov ecx, 0x40000
call fcn.140077c20
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400246b7.0]
xor r9d, r9d
mov dword [rbx + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140083aea
mov eax, 0x80004005
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x28], 0
lea r8, [0x140083cd0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x140083adf
cmp dword [0x14020a150], 4
jl 0x140083b6b
test dword [0x14020a1cc], 0x40000
je 0x140083b6b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov dword [rsp + 0x30], eax
lea r10, str.Thread_ID___d_n
mov qword [rsp + 0x28], r10
mov edx, 4
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
mov dword [rsp + 0x20], 0x75
lea r8, str.CStateChangeDetection::StartThread
mov ecx, 0x40000
call fcn.140077c20
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x140087740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp dword [0x14020a150], 3
jl 0x140087790
test dword [0x14020a1b4], 0x400000
je 0x140087790
lea rax, str.Entering_Function...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r8, str.dppe_esif_init
mov dword [rsp + 0x20], 0xc1
mov ecx, 0x400000
call fcn.140077c20
xor edi, edi
cmp dword [0x1402173b8], 4
je 0x1400877c1
call fcn.140002160
lea rcx, [0x140215230]
mov qword [0x140215228], rax
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov qword [0x140215238], rdi
mov dword [0x140215240], edi
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008780d
bt eax, 0xa
jae 0x14008780d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400877fd
test al, 0x10
je 0x1400877fd
lea rcx, str.user32.dll
call fcn.1400d2fdc
jmp 0x140087809
lea rcx, str.user32.dll
call fcn.1400b6b3c
test eax, eax
jne 0x140087882
mov ecx, 0x18
call fcn.1400b5158
mov rbx, rax
test rax, rax
je 0x140087882
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x140215278], rbx
test rcx, rcx
je 0x140087889
lea rdx, str.GetSystemMetrics
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140087879
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x140215280], rdi
jmp 0x140087889
mov qword [0x140215278], rdi
lea rcx, [0x140215248]
call fcn.140089670
call fcn.14008b3c0
cmp dword [0x14020a150], 3
mov ebx, eax
jl 0x1400878e8
test dword [0x14020a1b4], 0x400000
je 0x1400878e8
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea rax, str.Exiting_function:_Exit_code__0x_08X...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r8, str.dppe_esif_init
mov ecx, 0x400000
mov dword [rsp + 0x20], 0xda
call fcn.140077c20
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140090810
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x140090885
bt eax, 0xa
jae 0x140090885
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140090875
test al, 0x10
je 0x140090875
lea rcx, str.powrprof.dll
call fcn.1400d2fdc
jmp 0x140090881
lea rcx, str.powrprof.dll
call fcn.1400b6b3c
test eax, eax
jne 0x1400908c6
mov ecx, 0x18
call fcn.1400b5158
mov rbx, rax
test rax, rax
je 0x1400908c6
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
jmp 0x1400908c9
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Dynamic_Tuning:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.140092d50
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x140090a3d
mov rcx, qword [rbx]
test rcx, rcx
je 0x140090a11
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x1400909ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x140090a11
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140090957
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
jmp 0x140090a11
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x140090a04
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x1400246b7.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140090a1f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.1400b5144
test rdi, rdi
je 0x140090a4a
mov rcx, rdi
call fcn.1400b5144
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a6220
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140092fe0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400a7d00
lea rbp, [0x140120948]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x14012094c]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.140093610
mov ecx, pe_nt_image_headers64
call fcn.1400b5158
mov rbx, rax
test rax, rax
je 0x14009306b
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400a7d00
test rbx, rbx
je 0x1400931c0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140093197
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14012094c]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140093610
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093142
bt eax, 0xa
jae 0x140093142
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093130
bt eax, 0xa
jae 0x140093130
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093123
test al, 0x10
je 0x140093123
lea rcx, [rsp + 0x170]
call fcn.1400d2fdc
jmp 0x140093130
lea rcx, [rsp + 0x170]
call fcn.1400b6b3c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400a7d00
cmp byte [rsp + 0x5c], 0
jne 0x140093166
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400930a0
cmp byte [rsp + 0x5c], 0
je 0x14009319e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400b5228
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400b5228
cmp byte [rsp + 0x5c], 0
jne 0x1400931c0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400931b4
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400b5144
xor eax, eax
jmp 0x1400931c3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400a6220
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400931f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093248
bt eax, 0xa
jae 0x140093248
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093235
test al, 0x10
je 0x140093235
mov rcx, rbx
call fcn.1400d2fdc
jmp 0x14009323d
mov rcx, rbx
call fcn.1400b6b3c
test eax, eax
je 0x140093248
mov ecx, 0x1f
jmp 0x140093257
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d2a94
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a6220
add rsp, 0x60
pop rbx
ret

Function at 0x140093280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400932f6
bt eax, 0xa
jae 0x1400932f6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400932d8
test al, 0x10
je 0x1400932d8
mov rcx, rdi
call fcn.1400d2fdc
jmp 0x1400932e0
mov rcx, rdi
call fcn.1400b6b3c
test eax, eax
je 0x1400932f6
test rbx, rbx
je 0x1400932ef
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x14009339e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400b5228
lea rdx, [0x1401211c8]
mov rcx, rsi
call fcn.1400d4380
test rax, rax
je 0x140093377
mov edx, 0x63
mov rcx, rsi
call fcn.1400a7ea0
test rax, rax
jne 0x140093377
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400cf7a8
cmp rax, 0x20
jne 0x14009335b
mov byte [rsp + 0x47], bpl
jmp 0x140093377
mov r9, 0xffffffffffffffff
lea r8, [0x1401211cc]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400e6528
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400e68f8
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x14009339b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a6220
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400933c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093433
bt eax, 0xa
jae 0x140093433
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009341d
test al, 0x10
je 0x14009341d
mov rcx, rdi
call fcn.1400d2fdc
jmp 0x140093425
mov rcx, rdi
call fcn.1400b6b3c
test eax, eax
je 0x140093433
mov eax, 0x1f
jmp 0x1400935a7
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093477
bt eax, 0xa
jae 0x140093477
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009346b
test al, 0x10
je 0x14009346b
mov rcx, rdi
call fcn.1400d2fdc
jmp 0x140093473
mov rcx, rdi
call fcn.1400b6b3c
test eax, eax
jne 0x14009348e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d2a94
mov ebx, eax
test eax, eax
je 0x14009359d
test rdi, rdi
jne 0x140093497
xor ebx, ebx
jmp 0x1400934a7
mov edx, 0x104
mov rcx, rdi
call fcn.1400cf7a8
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400a7d00
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400b5228
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x1400934fb
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x1400934fb
dec rbx
cmp rbx, 0x104
jae 0x1400935c0
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009353f
bt eax, 0xa
jae 0x14009353f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093531
test al, 0x10
je 0x140093531
lea rcx, [rsp + 0x50]
call fcn.1400d2fdc
jmp 0x14009353b
lea rcx, [rsp + 0x50]
call fcn.1400b6b3c
test eax, eax
jne 0x140093554
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d2a94
mov ebx, eax
test eax, eax
je 0x14009359d
lea rcx, [rsp + 0x50]
call fcn.1400d2d58
mov ebx, eax
test eax, eax
je 0x14009359d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400a8408
mov rdi, rax
test rax, rax
je 0x14009359d
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400933c0
mov ebx, eax
test eax, eax
jne 0x14009359d
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d2d58
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400a6220
add rsp, 0x170
pop rdi
ret
call fcn.1400a6384
int3
Function at 0x140093690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor dil, dil
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140093817
test rdx, rdx
je 0x140093817
xorps xmm0, xmm0
mov edx, 0x100
mov rcx, rbp
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.14000dbc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093724
bt eax, 0xa
jae 0x140093724
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140093714
test al, 0x10
je 0x140093714
mov rcx, rbx
call fcn.1400d2fdc
jmp 0x14009371c
mov rcx, rbx
call fcn.1400b6b3c
test eax, eax
jne 0x14009380f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d2a94
test eax, eax
jne 0x14009380f
mov ecx, dword [rsp + 0x44]
test ecx, ecx
jle 0x14009380f
mov eax, 0x1000
mov qword [rsp + 0xb0], rsi
cmp ecx, eax
mov qword [rsp + 0x78], r14
cmovle eax, ecx
movsxd r14, eax
mov rcx, r14
call fcn.1400935d0
mov rsi, rax
test rax, rax
je 0x140093802
xor r8d, r8d
mov qword [rsp + 0x70], r15
lea rdx, [0x140120bc4]
mov rcx, rbx
call fcn.140093280
mov r15, rax
test rax, rax
je 0x1400937f5
movsxd rdi, dword [rsp + 0x44]
test rdi, rdi
je 0x1400937de
nop dword [rax]
cmp rdi, r14
mov qword [rsp + 0x20], r15
mov rbx, r14
mov r8d, 1
cmovbe rbx, rdi
mov rdx, r14
mov r9, rbx
mov rcx, rsi
call fcn.1400e6c68
cmp rax, rbx
jne 0x1400937de
mov r8, rax
mov rdx, rsi
mov rcx, rbp
sub rdi, rax
call fcn.14000dca0
test rdi, rdi
jne 0x1400937a0
mov rcx, r15
call fcn.1400e7474
mov rcx, r15
call fcn.1400e6e28
test rdi, rdi
sete dil
mov rcx, rsi
call fcn.1400b5144
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
mov rcx, rbp
call fcn.14000d9d0
movzx eax, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a6220
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x140093a60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x240
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400a7d00
xorps xmm0, xmm0
mov dword [rbx], 9
mov edx, 0x104
lea rcx, [rsp + 0x20]
movups xmmword [rbx + 4], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140093b6d
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], r15
lfence
lea ecx, [rax + 1]
lea rsi, [rcx + rcx]
mov r15d, ecx
mov rcx, rsi
call fcn.1400b5158
mov rdi, rax
test rax, rax
je 0x140093b06
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400a7d00
mov rsi, qword [rsp + 0x250]
test rdi, rdi
mov qword [rbx + 4], rdi
mov rdi, qword [rsp + 0x258]
je 0x140093b40
lfence
mov rcx, qword [rbx + 4]
lea r8, [rsp + 0x20]
mov rdx, r15
call fcn.1400ed548
lea ecx, [r14 + r14]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov r15, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400a6220
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r14
ret
mov rax, rbx
jmp 0x140093b4b
Function at 0x140097780
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140210ef8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov byte [rsp + 0x2e], 0xd
mov ecx, 0xfffffff6
mov word [rsp + 0x20], bx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6220
add rsp, 0x50
pop rbx
ret