joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d588
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
xor ebx, ebx
mov ecx, dword [0x1400bad1c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop dword [rax + rax]
test eax, eax
jne 0x14004d60e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14004d5e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14004d60e
jmp 0x14004d5ec
mov ebx, 0x80004005
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutilityprivilege.c
mov r9d, ebx
lea rcx, str.SetImpersonationCount
mov r8d, 0x44
call fcn.140046874
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14004d620
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
xor r15d, r15d
xor edi, edi
mov r12d, r8d
mov r14, rdx
mov ebp, ecx
bt ecx, 0x11
jb 0x14004d762
lea r9, [0x1400bad18]
xor r8d, r8d
lea rdx, [0x14004d570]
lea rcx, [0x14004d4d0]
call fcn.14005cfa0
mov ebx, eax
test eax, eax
jns 0x14004d69d
mov r9d, eax
lea r8d, [r15 + 0x60]
and qword [rsp + 0x20], rdi
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutilityprivilege.c
lea rcx, str.WimApplyPrivileges
call fcn.140046874
jmp 0x14004d762
mov ecx, dword [0x1400bad1c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14004d6e7
lea ecx, [rax + 2]
call qword [sym.imp.ntdll.dll_RtlImpersonateSelf]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x14004d6e1
or ebx, 0x10000000
jge 0x14004d762
mov r9d, ebx
lea r8d, [rsi + 0x72]
jmp 0x14004d680
mov r15d, 1
lea rcx, [rsi + 1]
call fcn.14004d588
mov ebx, eax
test eax, eax
jns 0x14004d6fe
mov r8d, 0x7b
jmp 0x14004d733
cmp edi, r12d
jae 0x14004d762
mov ecx, dword [r14 + rdi*8]
lea r9, [r14 + 4]
mov r8b, 1
lea r9, [r9 + rdi*8]
mov dl, r8b
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
nop dword [rax + rax]
inc edi
test eax, eax
jns 0x14004d6fe
mov ebx, eax
mov r8d, 0x8b
bts ebx, 0x1c
xor eax, eax
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutilityprivilege.c
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea rcx, str.WimApplyPrivileges
call fcn.140046874
test r15d, r15d
je 0x14004d762
mov r8d, edi
mov rdx, r14
mov ecx, ebp
call fcn.14004d78c
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14004d78c
Capabilities:
Get thread local storage value

Disassembly:
bt ecx, 0x11
jb 0x14004d834
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov ecx, dword [0x1400bad1c]
mov ebp, r8d
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop dword [rax + rax]
xor esi, esi
mov rbx, rax
test ebp, ebp
je 0x14004d7fe
mov rdi, r14
cmp byte [rdi + 4], 0
jne 0x14004d7f4
mov ecx, dword [rdi]
lea r9, [r14 + 4]
lea r9, [r9 + rsi*8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
nop dword [rax + rax]
inc esi
add rdi, 8
cmp esi, ebp
jb 0x14004d7d3
dec rbx
mov rcx, rbx
call fcn.14004d588
test rbx, rbx
jne 0x14004d81a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14004ec84
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rsi, qword [rsp + 0xb0]
mov rdi, r9
mov rbx, r8
mov r13, rdx
mov r12, rcx
mov r14d, 1
test rsi, rsi
je 0x14004ecce
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov dword [rsi + 0x10], eax
test rbx, rbx
je 0x14004ee73
mov qword [rsp + 0xb0], r9
test rsi, rsi
je 0x14004ecf9
lea rcx, [rsp + 0x30]
call fcn.14004101c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov dword [rsi + 0x10], eax
mov r15, qword [rsp + 0x30]
xor ebp, ebp
lea r14d, [rbp + 1]
test rbx, rbx
je 0x14004ee1a
cmp dword [rsp + 0xa4], 0
mov ebp, dword [rsp + 0xc0]
jne 0x14004ed23
cmp ebp, ebx
cmova ebp, ebx
test rdi, rdi
je 0x14004ed6c
movabs rax, 0x6666666666666667
imul rdi
sar rdx, 0x16
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rdx + rdx*4]
shl rcx, 0x15
cmp rdi, rcx
jne 0x14004ed6c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x948e
mov rcx, r12
call fcn.1400286f0
cmp eax, 0xffffffff
je 0x14004edf8
mov eax, dword [rsp + 0xb4]
lea r9, [rsp + 0x38]
mov rdx, qword [rsp + 0xb8]
mov r8d, ebp
and qword [rsp + 0x38], 0
mov rcx, r13
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
and dword [rsp + 0x20], 0
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], edi
call fcn.1400316a4
test eax, eax
je 0x14004ee09
mov eax, ebp
add rdi, rax
sub rbx, rax
test rsi, rsi
je 0x14004ede3
mov rdx, qword [rsp + 0xb8]
xor r9d, r9d
mov rcx, qword [r15]
mov r8d, ebp
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x14004ede3
mov ecx, 7
int 0x29
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa0], rbx
jmp 0x14004ecfe
mov ecx, 0x4d3
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
xor r14d, r14d
test rsi, rsi
je 0x14004ee61
mov rcx, qword [r15]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 0x14]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
nop dword [rax + rax]
test eax, eax
jns 0x14004ee43
mov ecx, 7
int 0x29
mov rcx, qword [r15]
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
nop dword [rax + rax]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test ebp, ebp
je 0x14004ee73
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004eea0
Capabilities:
Get file size

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r12d, r12d
xor eax, eax
mov dword [rbp - 0x18], eax
xorps xmm0, xmm0
mov qword [rbp - 0x38], r12
mov rbx, r9
mov qword [rbp - 0x30], r12
mov rsi, r8
mov dword [rbp - 0x40], r12d
mov r14, rdx
mov r15, rcx
movups xmmword [rbp - 0x28], xmm0
test rcx, rcx
je 0x14004f05a
cmp rdx, 0xffffffffffffffff
je 0x14004f05a
test r8, r8
je 0x14004f05a
cmp word [r8], r12w
je 0x14004f05a
mov rdi, qword [rbp + 0x60]
test rdi, rdi
je 0x14004f05a
lea rdx, [rbp - 0x38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
je 0x14004f005
mov rax, qword [rbp - 0x38]
cmp rax, rbx
jne 0x14004f005
mov rcx, qword [rdi]
cmp rcx, qword [0x1400bace0]
jne 0x14004ef6e
mov rcx, qword [rdi + 8]
cmp rcx, qword [0x1400bace8]
jne 0x14004ef6e
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [0x1400bacf0]
jne 0x14004ef6e
test rax, rax
je 0x14004efd8
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp - 0x40]
mov rcx, r15
lea rdx, [rbp - 0x30]
call fcn.14002e6f8
test eax, eax
je 0x14004efdd
mov eax, dword [rbp - 0x40]
mov rdx, r14
mov r9, qword [0x1400bac90]
mov rcx, r15
mov r8, qword [rbp - 0x38]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call fcn.14004ec84
test eax, eax
je 0x14004efdd
mov rax, qword [rdi]
cmp rax, qword [rbp - 0x28]
jne 0x14004efdd
mov rax, qword [rdi + 8]
cmp rax, qword [rbp - 0x20]
jne 0x14004efdd
mov eax, dword [rdi + 0x10]
cmp eax, dword [rbp - 0x18]
jne 0x14004efdd
mov ebx, r12d
jmp 0x14004f056
mov ebx, 0x80070241
mov qword [rsp + 0x20], r12
mov r9d, ebx
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmainhash_x.c
mov r8d, 0xf4
lea rcx, str.VerifyFileByHandle
call fcn.140046874
jmp 0x14004f056
mov ebx, 0x8007000d
mov qword [rsp + 0x20], r12
lea rdi, str.VerifyFileByHandle
mov r9d, ebx
mov rcx, rdi
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmainhash_x.c
mov r8d, 0xd5
call fcn.140046874
mov dword [rsp + 0x30], 0xd6
lea r9, str.Incorrect_filesize._Could_be_corrupted
mov qword [rsp + 0x28], rdi
mov r8, rsi
mov rdx, r15
mov dword [rsp + 0x20], ebx
mov ecx, 1
call fcn.14002aaa0
mov eax, ebx
jmp 0x14004f05f
mov eax, 0x80070057
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140096bd0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004f984
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
and qword [rax - 0x18], 0
mov rbp, rdx
mov r14, rcx
lea rdx, [rax - 0x18]
mov rcx, qword [r9]
mov rdi, r9
mov esi, r8d
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x14004fa01
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14004fa3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14004fa42
mov eax, dword [rsp + 0x80]
mov r9, rdi
mov r8d, esi
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r14
call fcn.14004f818
mov ebx, eax
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov ebx, 0x80004005
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_sparserestore.c
mov r9d, ebx
lea rcx, str.WIMExtractToHandleFromMountReparseData
mov r8d, 0x1b7
call fcn.140046874
jmp 0x14004fa1f

Function at 0x14004fc0c
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
cmp dword [0x1400b83d8], ebx
mov qword [rsp + 0x70], rbx
jne 0x14004fc32
mov ebx, 1
jmp 0x14004fcdb
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004fcd6
test rdi, rdi
je 0x14004fcd6
mov r9d, 8
mov dword [rsp + 0x20], 0x43
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x14004fc90
mov rax, qword [rsp + 0x70]
cmp eax, 1
jne 0x14004fc7f
mov dword [rdi], eax
jmp 0x14004fcdb
cmp eax, 2
jne 0x14004fc88
mov dword [rdi], eax
jmp 0x14004fcdb
test eax, eax
jne 0x14004fcdb
mov dword [rdi], ebx
jmp 0x14004fcdb
cmp eax, 0xc0000003
jne 0x14004fcce
xor edx, edx
mov dword [rsp + 0x30], 0x50
lea rax, str.GetFileStorageTierClass
mov dword [0x1400b83d8], ebx
mov qword [rsp + 0x28], rax
lea r9, str.StorageTiering_not_supported
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea ecx, [rdx + 2]
call fcn.14002aaa0
jmp 0x14004fc28
bts eax, 0x1c
mov ebx, eax
jmp 0x14004fcdb
mov ebx, 0x80070057
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14004fcf0
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
cmp dword [0x1400b83d8], ebx
jne 0x14004fd0a
mov ebx, 1
jmp 0x14004fdcb
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004fdc6
cmp edx, 3
jae 0x14004fdc6
mov qword [rsp + 0x70], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
cmp edx, 1
jne 0x14004fd39
mov dword [rsp + 0x70], edx
jmp 0x14004fd46
cmp edx, 2
jne 0x14004fdcb
mov dword [rsp + 0x70], edx
mov r9d, 8
mov dword [rsp + 0x20], 0x43
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ecx, 0x80000000
mov edx, eax
add eax, ecx
test ecx, eax
jne 0x14004fdcb
cmp edx, 0xc000000d
je 0x14004fdcb
cmp edx, 0xc0000003
jne 0x14004fdbe
xor edx, edx
mov dword [rsp + 0x30], 0xa1
lea rax, str.SetFileStorageTierClass
mov dword [0x1400b83d8], ebx
mov qword [rsp + 0x28], rax
lea r9, str.StorageTiering_not_supported
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea ecx, [rdx + 2]
call fcn.14002aaa0
jmp 0x14004fd00
bts edx, 0x1c
mov ebx, edx
jmp 0x14004fdcb
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x140050d1c
Capabilities:
Delete file
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rbx, rdx
mov r12, rcx
mov edi, 1
xor esi, esi
call fcn.140034134
and qword [rsp + 0x80], rsi
mov rbp, rax
test r14, r14
je 0x140050d5f
test byte [r14 + 0x1c], 0x10
cmovne esi, edi
lea edx, [rsi + rsi]
mov rcx, rbx
lea r8, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140050ea7
cmp qword [rsp + 0x80], 0
je 0x140050ea7
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000100
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140050e81
mov r8, qword [rsp + 0x80]
lea rcx, [0x140050cb0]
and qword [rsp + 0x88], 0
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_ReadEncryptedFileRaw]
nop dword [rax + rax]
lea rdx, [rsp + 0x88]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
jne 0x140050e8f
lea rcx, [r14 + 0x20]
mov rax, qword [rcx]
cmp rax, qword [0x1400bace0]
jne 0x140050e7a
mov rax, qword [rcx + 8]
cmp rax, qword [0x1400bace8]
jne 0x140050e7a
mov eax, dword [rcx + 0x10]
cmp eax, dword [0x1400bacf0]
jne 0x140050e7a
and dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r12
mov rdx, rbp
call fcn.140035c30
test eax, eax
je 0x140050e81
test esi, esi
jne 0x140050e91
mov rdx, qword [r14 + 0x38]
mov rcx, r12
call fcn.140010d80
jmp 0x140050e91
mov ebx, 0x32
jmp 0x140050e8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
xor edi, edi
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
nop dword [rax + rax]
jmp 0x140050ea9
xor edi, edi
test rbp, rbp
je 0x140050edd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test ebx, ebx
je 0x140050eef
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140050f10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, dword [0x1400b83dc]
xor ebx, ebx
mov edi, ecx
lea esi, [rbx + 1]
cmp edx, 0xffffffff
jne 0x140050fb2
xorps xmm0, xmm0
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x28]
lea rcx, str.WIM_Enumerate_Directory_Reparse_Point
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
dec eax
cmp eax, 0xf
ja 0x140050fa0
lea r8, [rsp + 0x20]
lea rdx, [0x14009e38c]
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcrt.dll_swscanf_s]
nop dword [rax + rax]
mov edx, dword [0x1400b83dc]
test eax, eax
cmovg edx, dword [rsp + 0x20]
jmp 0x140050fa6
mov edx, dword [0x1400b83dc]
cmp edx, 0xffffffff
cmove edx, esi
mov dword [0x1400b83dc], edx
test edx, edx
je 0x140050fc6
bt edi, 0x1c
jb 0x140050fc4
cmp edi, 0x80000018
jne 0x140050fc6
mov ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140050fec
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x50], 0
xor eax, eax
xorps xmm1, xmm1
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x50]
mov rsi, r8
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
mov r9d, 0x200000
mov r8d, 0x180
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm1
movups xmmword [rbp - 0x28], xmm1
call fcn.1400518f4
mov ebx, eax
test eax, eax
jns 0x140051073
mov r9d, eax
mov r8d, 0xfd
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
lea rcx, str.FIOClearAttributes
call fcn.140046874
jmp 0x14005113a
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x38]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
lea rdx, [rbp - 0x48]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x1400510ae
mov ebx, eax
mov r8d, 0x108
bts ebx, 0x1c
mov r9d, ebx
jmp 0x140051055
mov eax, dword [rbp - 0x48]
test eax, eax
jns 0x1400510c6
mov ebx, eax
mov r8d, 0x109
bts ebx, 0x1c
mov r9d, ebx
jmp 0x140051055
mov edi, dword [rbp - 0x18]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x48]
xor eax, eax
mov dword [rsp + 0x20], 4
xorps xmm0, xmm0
mov qword [rbp - 0x18], rax
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x18], 0x80
lea r9d, [rax + 0x28]
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x14005111d
mov ebx, eax
mov r8d, 0x11a
bts ebx, 0x1c
mov r9d, ebx
jmp 0x140051055
mov eax, dword [rbp - 0x48]
test eax, eax
jns 0x140051138
mov ebx, eax
mov r8d, 0x11b
bts ebx, 0x1c
mov r9d, ebx
jmp 0x140051055
mov dword [rsi], edi
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14005114f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140051ac8
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rax - 0x18], xmm0
xor ebx, ebx
mov r14, rdx
mov rbp, rcx
mov esi, 0x10c
test rbx, rbx
je 0x140051b1c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
add esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, esi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140051c36
mov r9d, esi
mov dword [rsp + 0x20], 9
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
cmp eax, 0x80000005
je 0x140051af7
test eax, eax
js 0x140051bec
mov eax, dword [rsp + 0x30]
test eax, eax
js 0x140051be4
mov ebp, dword [rbx]
add ebp, 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebp
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140051bc3
mov r9d, 0x8007000e
mov r8d, 0x3a9
mov edi, r9d
jmp 0x140051bfb
mov r8, rbp
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov r8d, dword [rbx]
lea rdx, [rbx + 4]
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov qword [r14], rsi
jmp 0x140051c14
mov r8d, 0x39e
jmp 0x140051bf2
mov r8d, 0x39d
mov edi, eax
bts edi, 0x1c
mov r9d, edi
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
lea rcx, str.FIOGetFileNameByHandle
call fcn.140046874
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140051c5e
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
mov r9d, 0x8007000e
lea rcx, str.FIOGetFileNameByHandle
mov r8d, 0x390
mov edi, r9d
call fcn.140046874
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x14005280c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rdx
xor edi, edi
and qword [rax - 0x38], rdi
lea rdx, [rax - 0x38]
xor esi, esi
mov r15, r8
and dword [rax + 0x20], esi
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x1400528ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov ebx, 0x80070000
or ecx, ebx
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140052882
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
jmp 0x140052887
mov edi, 0x80004005
mov r8d, 0x5eb
and qword [rsp + 0x20], rsi
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
mov r9d, edi
lea rcx, str.FIOReadHandleIntoBuffer
call fcn.140046874
jmp 0x140052945
cmp dword [rsp + 0x34], esi
je 0x1400528c0
mov edi, 0x8007007a
mov r8d, 0x5f6
jmp 0x14005288d
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
jne 0x1400528fc
mov edi, 0x8007000e
mov r8d, 0x5fa
jmp 0x14005288d
mov rax, qword [rsp + 0x30]
mov dword [r15], eax
test eax, eax
je 0x140052942
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
sub eax, esi
mov edx, esi
add rdx, rbp
mov r8d, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x14005295f
add esi, dword [rsp + 0x88]
mov rax, qword [rsp + 0x30]
cmp esi, eax
jb 0x140052908
mov qword [r14], rbp
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov ebx, 0x80070000
or ecx, ebx
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140052996
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
jmp 0x14005299b
mov edi, 0x80004005
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
mov r9d, edi
lea rcx, str.FIOReadHandleIntoBuffer
mov r8d, 0x60c
call fcn.140046874
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140052945