joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d4870
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x50
cmp dword [0x14027edf0], 4
mov rsi, rcx
mov ebx, 1
jl 0x1400d48ab
test dword [0x14027ee6c], 0x40000
je 0x1400d48ab
mov edi, ebx
jmp 0x1400d48ad
xor edi, edi
mov edx, 4
mov ecx, 0x40000
call fcn.1400e8cc0
lea r14, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r15, str.CStateChangeDetection::StartThread
test edi, edi
jne 0x1400d48d2
test eax, eax
je 0x1400d4905
lea rcx, str.Starting_thread__n
mov r9d, 4
mov qword [rsp + 0x38], rcx
mov r8d, 0x40000
mov dword [rsp + 0x30], 0x5e
mov edx, eax
mov qword [rsp + 0x28], r14
mov ecx, edi
mov qword [rsp + 0x20], r15
call fcn.1400bfc30
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x14005bcf7.0]
xor r9d, r9d
mov dword [rsi + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x1400d493f
mov eax, 0x80004005
jmp 0x1400d49e0
mov qword [rsp + 0x28], 0
lea r8, [0x1400d4be0]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400d4935
cmp dword [0x14027edf0], 4
jl 0x1400d4982
test dword [0x14027ee6c], 0x40000
jne 0x1400d4984
xor ebx, ebx
mov edx, 4
mov ecx, 0x40000
call fcn.1400e8cc0
mov edi, eax
test ebx, ebx
jne 0x1400d499d
test eax, eax
je 0x1400d49de
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.DLL_GetThreadId]
mov dword [rsp + 0x40], eax
lea rcx, str.Thread_ID___d_n
mov qword [rsp + 0x38], rcx
mov r9d, 4
mov dword [rsp + 0x30], 0x75
mov r8d, 0x40000
mov qword [rsp + 0x28], r14
mov edx, edi
mov ecx, ebx
mov qword [rsp + 0x20], r15
call fcn.1400bfc30
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
Function at 0x1400dd0a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x50
cmp dword [0x14027edf0], 3
mov edi, 1
jl 0x1400dd0d3
test dword [0x14027ee54], 0x400000
je 0x1400dd0d3
mov ebx, edi
jmp 0x1400dd0d5
xor ebx, ebx
mov edx, 3
mov ecx, 0x400000
call fcn.1400e8cc0
lea r14, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswindppe.c
lea r15, str.dppe_esif_init
test ebx, ebx
jne 0x1400dd0fa
test eax, eax
je 0x1400dd12d
lea rcx, str.Entering_Function...
mov r9d, 3
mov qword [rsp + 0x38], rcx
mov r8d, 0x400000
mov dword [rsp + 0x30], 0xc2
mov edx, eax
mov qword [rsp + 0x28], r14
mov ecx, ebx
mov qword [rsp + 0x20], r15
call fcn.1400bfc30
cmp dword [0x14028d6d8], 4
je 0x1400dd164
call fcn.140035f70
lea rcx, [0x140289408]
mov qword [0x140289400], rax
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
mov qword [0x140289410], 0
mov dword [0x140289418], 0
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400dd1b0
bt eax, 0xa
jae 0x1400dd1b0
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400dd1a0
test al, 0x10
je 0x1400dd1a0
lea rcx, str.user32.dll
call fcn.1401338c4
jmp 0x1400dd1ac
lea rcx, str.user32.dll
call fcn.14011868c
test eax, eax
jne 0x1400dd22f
mov ecx, 0x18
call fcn.140115d38
mov rbx, rax
test rax, rax
je 0x1400dd22f
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x140289458], rbx
test rcx, rcx
je 0x1400dd23a
lea rdx, str.GetSystemMetrics
mov qword [rsp + 0x60], rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400dd221
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x140289460], rsi
mov rsi, qword [rsp + 0x60]
jmp 0x1400dd23a
mov qword [0x140289458], 0
lea rcx, [0x140289420]
call fcn.1400dea20
call fcn.1400e1790
cmp dword [0x14027edf0], 3
mov ebx, eax
jl 0x1400dd262
test dword [0x14027ee54], 0x400000
jne 0x1400dd264
xor edi, edi
mov edx, 3
mov ecx, 0x400000
call fcn.1400e8cc0
test edi, edi
jne 0x1400dd27b
test eax, eax
je 0x1400dd2b2
mov dword [rsp + 0x40], ebx
lea rcx, str.Exiting_function:_Exit_code__0x_08X...
mov qword [rsp + 0x38], rcx
mov r9d, 3
mov dword [rsp + 0x30], 0xd9
mov r8d, 0x400000
mov qword [rsp + 0x28], r14
mov edx, eax
mov ecx, edi
mov qword [rsp + 0x20], r15
call fcn.1400bfc30
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
Function at 0x1400e9460
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x50
lea rbp, [0x1402894a0]
xor ebx, ebx
mov rcx, rbp
mov edi, ebx
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
inc dword [0x1402894b4]
cmp dword [0x14027edf0], 4
jl 0x1400e94a4
test dword [0x14027ee6c], 0x10000
lea esi, [rbx + 1]
jne 0x1400e94a6
mov esi, ebx
mov edx, 4
mov ecx, 0x10000
call fcn.1400e8cc0
lea r15, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
mov edx, eax
test esi, esi
jne 0x1400e94c6
test eax, eax
je 0x1400e9508
mov eax, dword [0x1402894b4]
mov r9d, 4
mov dword [rsp + 0x40], eax
mov r8d, 0x10000
lea rax, str.Refcount___d_n
mov ecx, esi
mov qword [rsp + 0x38], rax
lea rax, str.EsifHid_Enable
mov dword [rsp + 0x30], 0x162
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.1400bfc30
cmp dword [0x1402894b4], 1
jne 0x1400e9693
mov qword [rsp + 0x70], r14
call fcn.1400e9bd0
cmp dword [0x14027edf0], 4
jl 0x1400e9539
test dword [0x14027ee6c], 0x10000
je 0x1400e9539
mov edi, 1
mov edx, 4
mov ecx, 0x10000
call fcn.1400e8cc0
lea r14, str.EsifHid_Start
test edi, edi
jne 0x1400e9557
test eax, eax
je 0x1400e958a
lea rcx, str.Starting_HID_ETW_tracking_n
mov r9d, 4
mov qword [rsp + 0x38], rcx
mov r8d, 0x10000
mov dword [rsp + 0x30], pe_nt_image_headers64
mov edx, eax
mov qword [rsp + 0x28], r15
mov ecx, edi
mov qword [rsp + 0x20], r14
call fcn.1400bfc30
mov r8, rbp
lea rdx, [0x1400e9d20]
lea rcx, [0x1402894c0]
call fcn.140034e80
mov ecx, 0x10
mov byte [0x1402894d0], 1
mov qword [0x1402894c8], rbx
mov edi, ebx
call fcn.140115d38
mov rsi, rax
test rax, rax
jne 0x1400e95c9
mov edi, 0x708
jmp 0x1400e960d
lea rax, [0x1400e8e90]
mov qword [rsp + 0x28], rbx
mov r9, rsi
mov qword [rsi], rax
lea r8, [0x1400e9dc0]
mov qword [rsi + 8], rbp
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1402894b8], rax
test rax, rax
jne 0x1400e967f
mov rcx, rsi
call fcn.140115d24
mov edi, 0x3eb
lea rcx, [0x1402894c0]
call fcn.140035210
cmp dword [0x14027edf0], 1
jl 0x1400e9633
test dword [0x14027ee24], 0x10000
mov esi, 1
jne 0x1400e9635
mov esi, ebx
mov edx, 1
mov ecx, 0x10000
call fcn.1400e8cc0
test esi, esi
jne 0x1400e964c
test eax, eax
je 0x1400e967f
lea rcx, str.Unable_to_create_HID_ETW_control_thread_n
mov r9d, 1
mov qword [rsp + 0x38], rcx
mov r8d, 0x10000
mov dword [rsp + 0x30], 0x139
mov edx, eax
mov qword [rsp + 0x28], r15
mov ecx, esi
mov qword [rsp + 0x20], r14
call fcn.1400bfc30
mov r14, qword [rsp + 0x70]
test edi, edi
je 0x1400e9693
call fcn.1400e9bd0
dec dword [0x1402894b4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
cmp byte [0x1402894d0], bl
setne bl
mov ecx, ebx
call fcn.1400e9b50
mov rbx, qword [rsp + 0x78]
mov eax, edi
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop rdi
pop rsi
ret
Function at 0x1400ec500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x1400ec575
bt eax, 0xa
jae 0x1400ec575
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ec565
test al, 0x10
je 0x1400ec565
lea rcx, str.powrprof.dll
call fcn.1401338c4
jmp 0x1400ec571
lea rcx, str.powrprof.dll
call fcn.14011868c
test eax, eax
jne 0x1400ec5b6
mov ecx, 0x18
call fcn.140115d38
mov rbx, rax
test rax, rax
je 0x1400ec5b6
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x1400ec5b9
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Innovation_Platform_Framework:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.1400ee2e0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x1400ec72d
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ec701
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x1400ec69c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x1400ec701
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x1400ec647
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x1400ec701
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x1400ec6f4
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x14005bcf7.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ec70f
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.140115d24
test rdi, rdi
je 0x1400ec73a
mov rcx, rdi
call fcn.140115d24
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140106650
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ee570
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.140107f60
lea rbp, [0x140183f5c]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x140183f60]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.1400eeba0
mov ecx, 0x110
call fcn.140115d38
mov rbx, rax
test rax, rax
je 0x1400ee5fb
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.140107f60
test rbx, rbx
je 0x1400ee750
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400ee727
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x140183f60]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.1400eeba0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee6d2
bt eax, 0xa
jae 0x1400ee6d2
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee6c0
bt eax, 0xa
jae 0x1400ee6c0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee6b3
test al, 0x10
je 0x1400ee6b3
lea rcx, [rsp + 0x170]
call fcn.1401338c4
jmp 0x1400ee6c0
lea rcx, [rsp + 0x170]
call fcn.14011868c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.140107f60
cmp byte [rsp + 0x5c], 0
jne 0x1400ee6f6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x1400ee630
cmp byte [rsp + 0x5c], 0
je 0x1400ee72e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.140115e08
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.140115e08
cmp byte [rsp + 0x5c], 0
jne 0x1400ee750
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400ee744
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.140115d24
xor eax, eax
jmp 0x1400ee753
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140106650
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ee780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee7d8
bt eax, 0xa
jae 0x1400ee7d8
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee7c5
test al, 0x10
je 0x1400ee7c5
mov rcx, rbx
call fcn.1401338c4
jmp 0x1400ee7cd
mov rcx, rbx
call fcn.14011868c
test eax, eax
je 0x1400ee7d8
mov ecx, 0x1f
jmp 0x1400ee7e7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14013337c
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140106650
add rsp, 0x60
pop rbx
ret

Function at 0x1400ee810
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee886
bt eax, 0xa
jae 0x1400ee886
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee868
test al, 0x10
je 0x1400ee868
mov rcx, rdi
call fcn.1401338c4
jmp 0x1400ee870
mov rcx, rdi
call fcn.14011868c
test eax, eax
je 0x1400ee886
test rbx, rbx
je 0x1400ee87f
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x1400ee92e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.140115e08
lea rdx, [0x1401847c8]
mov rcx, rsi
call fcn.140134c70
test rax, rax
je 0x1400ee907
mov edx, 0x63
mov rcx, rsi
call fcn.140108100
test rax, rax
jne 0x1400ee907
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140130308
cmp rax, 0x20
jne 0x1400ee8eb
mov byte [rsp + 0x47], bpl
jmp 0x1400ee907
mov r9, 0xffffffffffffffff
lea r8, [0x1401847cc]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.140146e94
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140147264
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400ee92b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140106650
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ee950
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee9c3
bt eax, 0xa
jae 0x1400ee9c3
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee9ad
test al, 0x10
je 0x1400ee9ad
mov rcx, rdi
call fcn.1401338c4
jmp 0x1400ee9b5
mov rcx, rdi
call fcn.14011868c
test eax, eax
je 0x1400ee9c3
mov eax, 0x1f
jmp 0x1400eeb37
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400eea07
bt eax, 0xa
jae 0x1400eea07
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400ee9fb
test al, 0x10
je 0x1400ee9fb
mov rcx, rdi
call fcn.1401338c4
jmp 0x1400eea03
mov rcx, rdi
call fcn.14011868c
test eax, eax
jne 0x1400eea1e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14013337c
mov ebx, eax
test eax, eax
je 0x1400eeb2d
test rdi, rdi
jne 0x1400eea27
xor ebx, ebx
jmp 0x1400eea37
mov edx, 0x104
mov rcx, rdi
call fcn.140130308
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140107f60
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.140115e08
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x1400eea8b
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x1400eea8b
dec rbx
cmp rbx, 0x104
jae 0x1400eeb50
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400eeacf
bt eax, 0xa
jae 0x1400eeacf
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400eeac1
test al, 0x10
je 0x1400eeac1
lea rcx, [rsp + 0x50]
call fcn.1401338c4
jmp 0x1400eeacb
lea rcx, [rsp + 0x50]
call fcn.14011868c
test eax, eax
jne 0x1400eeae4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14013337c
mov ebx, eax
test eax, eax
je 0x1400eeb2d
lea rcx, [rsp + 0x50]
call fcn.140133640
mov ebx, eax
test eax, eax
je 0x1400eeb2d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.140108668
mov rdi, rax
test rax, rax
je 0x1400eeb2d
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400ee950
mov ebx, eax
test eax, eax
jne 0x1400eeb2d
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.140133640
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140106650
add rsp, 0x170
pop rdi
ret
call fcn.1401067b4
int3
Function at 0x1400eec20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor dil, dil
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400eeda7
test rdx, rdx
je 0x1400eeda7
xorps xmm0, xmm0
mov edx, 0x100
mov rcx, rbp
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.140041610
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400eecb4
bt eax, 0xa
jae 0x1400eecb4
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400eeca4
test al, 0x10
je 0x1400eeca4
mov rcx, rbx
call fcn.1401338c4
jmp 0x1400eecac
mov rcx, rbx
call fcn.14011868c
test eax, eax
jne 0x1400eed9f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14013337c
test eax, eax
jne 0x1400eed9f
mov ecx, dword [rsp + 0x44]
test ecx, ecx
jle 0x1400eed9f
mov eax, 0x1000
mov qword [rsp + 0xb0], rsi
cmp ecx, eax
mov qword [rsp + 0x78], r14
cmovle eax, ecx
movsxd r14, eax
mov rcx, r14
call fcn.1400eeb60
mov rsi, rax
test rax, rax
je 0x1400eed92
xor r8d, r8d
mov qword [rsp + 0x70], r15
lea rdx, [0x1401841d4]
mov rcx, rbx
call fcn.1400ee810
mov r15, rax
test rax, rax
je 0x1400eed85
movsxd rdi, dword [rsp + 0x44]
test rdi, rdi
je 0x1400eed6e
nop dword [rax]
cmp rdi, r14
mov qword [rsp + 0x20], r15
mov rbx, r14
mov r8d, 1
cmovbe rbx, rdi
mov rdx, r14
mov r9, rbx
mov rcx, rsi
call fcn.1401475a4
cmp rax, rbx
jne 0x1400eed6e
mov r8, rax
mov rdx, rsi
mov rcx, rbp
sub rdi, rax
call fcn.1400416f0
test rdi, rdi
jne 0x1400eed30
mov rcx, r15
call fcn.140147db0
mov rcx, r15
call fcn.140147764
test rdi, rdi
sete dil
mov rcx, rsi
call fcn.140115d24
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
mov rcx, rbp
call fcn.140041420
movzx eax, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140106650
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400eeff0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x240
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140107f60
xorps xmm0, xmm0
mov dword [rbx], 9
mov edx, 0x104
lea rcx, [rsp + 0x20]
movups xmmword [rbx + 4], xmm0
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400ef0fd
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], r15
lfence
lea ecx, [rax + 1]
lea rsi, [rcx + rcx]
mov r15d, ecx
mov rcx, rsi
call fcn.140115d38
mov rdi, rax
test rax, rax
je 0x1400ef096
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140107f60
mov rsi, qword [rsp + 0x250]
test rdi, rdi
mov qword [rbx + 4], rdi
mov rdi, qword [rsp + 0x258]
je 0x1400ef0d0
lfence
mov rcx, qword [rbx + 4]
lea r8, [rsp + 0x20]
mov rdx, r15
call fcn.14014e348
lea ecx, [r14 + r14]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov r15, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140106650
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r14
ret
mov rax, rbx
jmp 0x1400ef0db
Function at 0x1400f2d60
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x20], 0x238
xor eax, eax
lea rcx, [rsp + 0x4c]
xor edx, edx
mov dword [rsp + 0x28], eax
mov r8d, 0x20c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
call fcn.140107f60
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x1400f2e3a
mov qword [rsp + 0x280], rbx
nop word [rax + rax]
lea rdx, str.ipf_helper.exe
lea rcx, [rsp + 0x4c]
call fcn.14014e3f0
test eax, eax
jne 0x1400f2e21
mov r8d, dword [rsp + 0x28]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400f2e21
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x1400f2de0
mov rbx, qword [rsp + 0x280]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140106650
add rsp, 0x270
pop rdi
ret
Function at 0x1400f5670
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov byte [rsp + 0x2e], 0xd
mov ecx, 0xfffffff6
mov word [rsp + 0x20], bx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140106650
add rsp, 0x50
pop rbx
ret