joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b770
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ebp, ebp
add rcx, 0x10
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
mov rcx, qword [rsi + 8]
call fcn.1400023f0
test eax, eax
lea rcx, [rsi + 0x10]
setne bl
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
test bl, bl
je 0x14003b89a
cmp byte [rsi + 0x71], bpl
jne 0x14003b850
mov word [rsi + 0x71], 1
cmp byte [rsi + 0x73], bpl
jne 0x14003b7d3
mov dword [rsi + 0x180], ebp
mov byte [rsi + 0x70], 1
lea rcx, [rsi + 0x38]
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
xor r9d, r9d
mov qword [rsi + 0x40], rbp
xor edx, edx
mov dword [rsi + 0x48], ebp
xor ecx, ecx
mov r8d, 0x7fffffff
call qword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov ecx, 0x10
mov dword [rsi + 0x50], ebp
mov qword [rsi + 0x58], rax
mov byte [rsi + 0x4c], bpl
call fcn.1400bae58
mov rbx, rax
test rax, rax
je 0x14003b850
lea rax, [0x14003a9f0]
mov qword [rsp + 0x28], rbp
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x14003dd10]
mov qword [rbx + 8], rsi
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsi + 0x30], rax
test rax, rax
jne 0x14003b850
mov rcx, rbx
call fcn.1400bae44
cmp dword [0x14020e430], 3
jl 0x14003b896
test dword [0x14020e494], 0x200000
je 0x14003b896
lea rcx, str.Participant_logging_started
mov edx, 3
mov qword [rsp + 0x28], rcx
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
mov ecx, 0x200000
mov dword [rsp + 0x20], 0x47e
lea r8, str.EsifLogMgr_StartLoggingIfRequired
call fcn.140078130
mov eax, ebp
jmp 0x14003b8e5
cmp dword [0x14020e430], 1
jl 0x14003b8e0
test dword [0x14020e464], 0x200000
je 0x14003b8e0
lea rax, str.Error_:_No_Data_to_Log
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
lea r8, str.EsifLogMgr_StartLoggingIfRequired
mov dword [rsp + 0x20], 0x479
mov ecx, 0x200000
call fcn.140078130
mov eax, 0x3ea
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003dd40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x140204a70]
xor edi, edi
cmp ecx, 0x1f4
cmovge eax, ecx
xor bl, bl
mov dword [0x140204a70], eax
nop dword [rax + rax]
lea rcx, [0x1402191b8]
call fcn.140040f00
movzx ecx, bl
call fcn.14003f220
mov rsi, rax
nop word [rax + rax]
mov eax, 1
xchg qword [0x1402191c0], rax
cmp rax, 1
je 0x14003dd90
add dword [0x1402191c8], 0xffffffff
mov rax, rdi
xchg qword [0x1402191c0], rax
jne 0x14003ddc2
lea rcx, [0x1402191b8]
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockShared]
test rsi, rsi
je 0x14003ddd7
mov rcx, rsi
call fcn.140072140
mov rcx, rsi
call fcn.140071ad0
inc bl
cmp bl, 0x20
jb 0x14003dd70
mov rax, rdi
lock xadd qword [0x140204a68], rax
test al, al
je 0x14003de5b
mov ecx, 0x10
call fcn.1400bae58
mov rbx, rax
test rax, rax
jne 0x14003de17
mov edi, 0x708
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rax, [0x14003df90]
mov qword [rsp + 0x28], rdi
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x140041a30]
mov qword [rbx + 8], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1402191d0], rax
test rax, rax
jne 0x14003de5b
mov rcx, rbx
call fcn.1400bae44
mov edi, 0x3eb
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400637f0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ad180
lea rbp, [0x14012779c]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277a0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.140063f20
mov ecx, 0x110
call fcn.1400bae58
mov rbx, rax
test rax, rax
je 0x14006387b
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.1400ad180
test rbx, rbx
je 0x1400639d0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400639a7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277a0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140063f20
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063952
bt eax, 0xa
jae 0x140063952
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063940
bt eax, 0xa
jae 0x140063940
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063933
test al, 0x10
je 0x140063933
lea rcx, [rsp + 0x170]
call fcn.1400d89e4
jmp 0x140063940
lea rcx, [rsp + 0x170]
call fcn.1400bd7ac
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad180
cmp byte [rsp + 0x5c], 0
jne 0x140063976
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x1400638b0
cmp byte [rsp + 0x5c], 0
je 0x1400639ae
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400baf28
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400baf28
cmp byte [rsp + 0x5c], 0
jne 0x1400639d0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400639c4
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bae44
xor eax, eax
jmp 0x1400639d3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ab870
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, r8
mov rbx, rcx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400ad180
test rbx, rbx
je 0x140063b3f
xor edx, edx
lea rcx, [rsp + 0x170]
mov r8d, 0x104
call fcn.1400ad180
lea rsi, [0x14012779c]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 1
jne 0x140063b67
lea rax, [rsp + 0x5c]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rbx + 8]
lea r8, [0x1401277a0]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x170]
call fcn.140063f20
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063b1b
bt eax, 0xa
jae 0x140063b1b
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063b09
bt eax, 0xa
jae 0x140063b09
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063afc
test al, 0x10
je 0x140063afc
lea rcx, [rsp + 0x170]
call fcn.1400d89e4
jmp 0x140063b09
lea rcx, [rsp + 0x170]
call fcn.1400bd7ac
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad180
cmp byte [rsp + 0x5c], 0
je 0x140063a61
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rdi
call fcn.1400baf28
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ab870
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test eax, eax
jne 0x140063b26
xor eax, eax
jmp 0x140063b42

Function at 0x140063b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063bc8
bt eax, 0xa
jae 0x140063bc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063bb5
test al, 0x10
je 0x140063bb5
mov rcx, rbx
call fcn.1400d89e4
jmp 0x140063bbd
mov rcx, rbx
call fcn.1400bd7ac
test eax, eax
je 0x140063bc8
mov ecx, 0x1f
jmp 0x140063bd7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d849c
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x60
pop rbx
ret
Function at 0x140063c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063c76
bt eax, 0xa
jae 0x140063c76
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063c58
test al, 0x10
je 0x140063c58
mov rcx, rdi
call fcn.1400d89e4
jmp 0x140063c60
mov rcx, rdi
call fcn.1400bd7ac
test eax, eax
je 0x140063c76
test rbx, rbx
je 0x140063c6f
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x140063d1e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400baf28
lea rdx, [0x140128018]
mov rcx, rsi
call fcn.1400d9d90
test rax, rax
je 0x140063cf7
mov edx, 0x63
mov rcx, rsi
call fcn.1400ad320
test rax, rax
jne 0x140063cf7
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400d5428
cmp rax, 0x20
jne 0x140063cdb
mov byte [rsp + 0x47], bpl
jmp 0x140063cf7
mov r9, 0xffffffffffffffff
lea r8, [0x14012801c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400ebfb4
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ec384
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x140063d1b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ab870
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006a000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.1400ad180
lea rax, [0x140127920]
mov edx, 0x104
lea rdi, [0x140128798]
mov qword [rsp + 0x20], rax
lea r9, str.override
mov r8d, 2
lea rcx, [rsp + 0xa0]
mov rsi, rdi
call fcn.140013cb0
lea rcx, str.gddv
call fcn.140003d20
mov rbx, rax
test rax, rax
je 0x14006a0cf
mov rcx, rax
call fcn.140063e00
cmp byte [rbx + 0x49], 0
lea rcx, [rbx + 0x49]
cmovne rsi, rcx
nop
mov eax, 1
xchg qword [rbx + 8], rax
cmp rax, 1
je 0x14006a0a0
add dword [rbx + 0x10], 0xffffffff
mov eax, 0
xchg qword [rbx + 8], rax
jne 0x14006a0c7
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockShared]
mov rcx, rbx
call fcn.140008870
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
lea r8, [0x140129d9c]
mov r9b, 0xff
mov qword [rsp + 0x20], 0
mov edx, 0x221
mov qword [rsp + 0x54], 0
mov ecx, 1
mov dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x60], 0
call fcn.140041a60
mov ebx, eax
test eax, eax
jne 0x14006a134
mov rax, qword [rsp + 0x54]
test rax, rax
je 0x14006a134
cmp dword [rsp + 0x60], ebx
cmovne rdi, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006a18b
bt eax, 0xa
jae 0x14006a18b
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006a173
test al, 0x10
je 0x14006a173
lea rcx, [rsp + 0xa0]
call fcn.1400d89e4
jmp 0x14006a180
lea rcx, [rsp + 0xa0]
call fcn.1400bd7ac
test eax, eax
je 0x14006a18b
mov eax, 0x1f
jmp 0x14006a19d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.1400d849c
test eax, eax
mov qword [rsp + 0x40], rsi
mov rax, qword [0x140206c28]
lea r8, str.false
mov qword [rsp + 0x38], rdi
lea rdx, str.true
cmovne rdx, r8
lea r9, [0x140206c30]
mov qword [rsp + 0x30], rdx
lea r8, [0x14012ed28]
mov qword [rsp + 0x28], rax
lea rdx, str._about__n___ufVersion__s__ufVersion__n___lfVersion__s__lfVersion__n___osType__s__osType__n___shellVersion__s__shellVersion__n___overrideDvExistsOnDisk__s__overrideDvExistsOnDisk__n___currentGddvDescription__s__currentGddvDescription__n___currentCacheDescription__s__currentCacheDescription__n__about__n_n
lea rax, [0x140222ac0]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140069040
test eax, eax
mov ecx, 0xbba
cmovle ebx, ecx
mov rcx, qword [rsp + 0x54]
test rcx, rcx
je 0x14006a20e
call fcn.1400bae44
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400ab870
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140085390
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [0x14020e430], 4
mov rbx, rcx
jl 0x1400853df
test dword [0x14020e4ac], 0x40000
je 0x1400853df
lea rax, str.Starting_thread__n
mov edx, 4
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r8, str.CStateChangeDetection::StartThread
mov dword [rsp + 0x20], 0x5e
mov ecx, 0x40000
call fcn.140078130
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x140023f47.0]
xor r9d, r9d
mov dword [rbx + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x14008541a
mov eax, 0x80004005
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x28], 0
lea r8, [0x140085600]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x14008540f
cmp dword [0x14020e430], 4
jl 0x14008549b
test dword [0x14020e4ac], 0x40000
je 0x14008549b
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetThreadId]
mov dword [rsp + 0x30], eax
lea r10, str.Thread_ID___d_n
mov qword [rsp + 0x28], r10
mov edx, 4
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
mov dword [rsp + 0x20], 0x75
lea r8, str.CStateChangeDetection::StartThread
mov ecx, 0x40000
call fcn.140078130
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x14008a120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp dword [0x14020e430], 3
jl 0x14008a170
test dword [0x14020e494], 0x400000
je 0x14008a170
lea rax, str.Entering_Function...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r8, str.dppe_esif_init
mov dword [rsp + 0x20], 0xc1
mov ecx, 0x400000
call fcn.140078130
xor edi, edi
cmp dword [0x14021b698], 4
je 0x14008a1a1
call fcn.140002150
lea rcx, [0x140219330]
mov qword [0x140219328], rax
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
mov qword [0x140219338], rdi
mov dword [0x140219340], edi
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008a1ed
bt eax, 0xa
jae 0x14008a1ed
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14008a1dd
test al, 0x10
je 0x14008a1dd
lea rcx, str.user32.dll
call fcn.1400d89e4
jmp 0x14008a1e9
lea rcx, str.user32.dll
call fcn.1400bd7ac
test eax, eax
jne 0x14008a262
mov ecx, 0x18
call fcn.1400bae58
mov rbx, rax
test rax, rax
je 0x14008a262
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x140219380], rbx
test rcx, rcx
je 0x14008a269
lea rdx, str.GetSystemMetrics
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14008a259
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x140219388], rdi
jmp 0x14008a269
mov qword [0x140219380], rdi
lea rcx, [0x140219348]
call fcn.14008c0a0
call fcn.14008e250
cmp dword [0x14020e430], 3
mov ebx, eax
jl 0x14008a2c8
test dword [0x14020e494], 0x400000
je 0x14008a2c8
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea rax, str.Exiting_function:_Exit_code__0x_08X...
mov edx, 3
mov qword [rsp + 0x28], rax
lea r8, str.dppe_esif_init
mov ecx, 0x400000
mov dword [rsp + 0x20], 0xda
call fcn.140078130
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140092030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
lea rbp, [0x1402193d0]
xor edi, edi
mov rcx, rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
mov eax, dword [0x1402193e4]
inc eax
cmp dword [0x14020e430], 4
mov dword [0x1402193e4], eax
jl 0x1400920af
test dword [0x14020e4ac], 0x10000
je 0x1400920af
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
lea rax, str.Refcount___d_n
mov ecx, 0x10000
mov qword [rsp + 0x28], rax
lea r8, str.EsifHid_Enable
lea edx, [rdi + 4]
mov dword [rsp + 0x20], 0x152
call fcn.140078130
mov eax, dword [0x1402193e4]
cmp eax, 1
jne 0x1400921a2
mov qword [rsp + 0x50], rsi
call fcn.140092560
mov r8, rbp
lea rdx, [0x140092640]
lea rcx, [0x1402193f0]
call fcn.140001060
mov ecx, 0x10
mov byte [0x1402193f8], 1
call fcn.1400bae58
mov rsi, rax
test rax, rax
jne 0x1400920f8
mov ebx, 0x708
jmp 0x14009213c
lea rax, [0x140091bd0]
mov qword [rsp + 0x28], rdi
mov r9, rsi
mov qword [rsi], rax
lea r8, [0x1400926a0]
mov qword [rsi + 8], rbp
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1402193e8], rax
test rax, rax
jne 0x14009218e
mov rcx, rsi
call fcn.1400bae44
mov ebx, 0x3eb
lea rcx, [0x1402193f0]
call fcn.1400013f0
cmp dword [0x14020e430], 1
jl 0x14009218e
test dword [0x14020e464], 0x10000
je 0x14009218e
lea rax, str.Unable_to_create_HID_ETW_control_thread_n
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
lea r8, str.EsifHid_Start
mov dword [rsp + 0x20], 0x12b
mov ecx, 0x10000
call fcn.140078130
mov rsi, qword [rsp + 0x50]
test ebx, ebx
je 0x1400921a2
call fcn.140092560
dec dword [0x1402193e4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
cmp byte [0x1402193f8], dil
setne dil
mov ecx, edi
call fcn.1400924e0
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400949e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x140094a55
bt eax, 0xa
jae 0x140094a55
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140094a45
test al, 0x10
je 0x140094a45
lea rcx, str.powrprof.dll
call fcn.1400d89e4
jmp 0x140094a51
lea rcx, str.powrprof.dll
call fcn.1400bd7ac
test eax, eax
jne 0x140094a96
mov ecx, 0x18
call fcn.1400bae58
mov rbx, rax
test rax, rax
je 0x140094a96
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x140094a99
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Dynamic_Tuning:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.140096f30
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x140094c0d
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094be1
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140094b7c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x140094be1
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140094b27
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x140094be1
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x140094bd4
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x140023f47.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094bef
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.1400bae44
test rdi, rdi
je 0x140094c1a
mov rcx, rdi
call fcn.1400bae44
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret