joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079110
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x68
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400791bc
cmp dword [0x140277860], 1
jl 0x140079159
test dword [0x140277894], 0x200000
je 0x140079159
lea edi, [rdx + 1]
jmp 0x14007915b
xor edi, edi
mov edx, 1
mov ecx, 0x200000
call fcn.1400e3b80
test edi, edi
jne 0x140079176
test eax, eax
je 0x140079343
lea rcx, str.logstring_is_NULL
mov r9d, 1
mov qword [rsp + 0x38], rcx
mov r8d, 0x200000
lea rcx, str.C:jenkinsworkspacedptf_2SrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
mov dword [rsp + 0x30], 0xbb5
mov qword [rsp + 0x28], rcx
mov edx, eax
lea rcx, str.EsifLogMgr_DataLogWrite
mov qword [rsp + 0x20], rcx
mov ecx, edi
call fcn.1400bb960
jmp 0x140079343
mov eax, dword [rcx + 0x17c]
test eax, eax
je 0x140079343
xor edi, edi
test al, 8
jbe 0x1400791fd
cmp byte [rcx + 0x70], dil
je 0x1400791df
test byte [rcx + 0x180], 8
jne 0x1400791fd
lea rdx, [rsp + 0x90]
mov rcx, r8
call fcn.140046f30
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x88]
test al, 4
jbe 0x140079237
cmp byte [rbx + 0x70], dil
je 0x140079210
test byte [rbx + 0x180], 4
jne 0x140079237
lea r9, [rsp + 0x90]
mov ecx, 5
lea rdx, [0x140188808]
call fcn.140047520
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0x58], rsi
test al, 2
jbe 0x1400792be
cmp byte [rbx + 0x70], dil
je 0x14007924f
test byte [rbx + 0x180], 2
jne 0x1400792be
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x60], rbp
mov rcx, r8
call fcn.14007fc10
inc eax
movsxd rbp, eax
mov rcx, rbp
call fcn.14007fc60
mov rsi, rax
test rax, rax
je 0x1400792b1
mov r9, qword [rsp + 0x88]
lea rax, [rsp + 0x90]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.140049d80
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov rcx, rsi
call fcn.1401120d4
mov r8, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x60]
test byte [rbx + 0x17c], 1
jbe 0x14007933e
cmp byte [rbx + 0x70], dil
je 0x1400792d6
test byte [rbx + 0x180], 1
jne 0x14007933e
lea rdx, [rsp + 0x90]
mov rcx, r8
call fcn.14007fc10
inc eax
movsxd rsi, eax
mov rcx, rsi
call fcn.14007fc60
mov rbx, rax
test rax, rax
je 0x14007933e
mov r9, qword [rsp + 0x88]
lea rax, [rsp + 0x90]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call fcn.140049d80
mov r8, rbx
lea rdx, [0x14018633c]
mov ecx, 3
call fcn.1400dae70
mov rcx, rbx
call fcn.1401120d4
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x68
pop rdi
pop rbx
ret
Function at 0x14007d340
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebp, ebp
add rcx, 0x10
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
mov rcx, qword [rsi + 8]
call fcn.140036210
test eax, eax
lea rcx, [rsi + 0x10]
setne bl
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
test bl, bl
je 0x14007d498
cmp byte [rsi + 0x71], bpl
jne 0x14007d420
mov word [rsi + 0x71], 1
cmp byte [rsi + 0x73], bpl
jne 0x14007d3a3
mov dword [rsi + 0x180], ebp
mov byte [rsi + 0x70], 1
lea rcx, [rsi + 0x38]
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
xor r9d, r9d
mov qword [rsi + 0x40], rbp
xor edx, edx
mov dword [rsi + 0x48], ebp
xor ecx, ecx
mov r8d, 0x7fffffff
call qword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov ecx, 0x10
mov dword [rsi + 0x50], ebp
mov qword [rsi + 0x58], rax
mov byte [rsi + 0x4c], bpl
call fcn.1401120e8
mov rbx, rax
test rax, rax
je 0x14007d420
lea rax, [0x14007c4e0]
mov qword [rsp + 0x28], rbp
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x140080990]
mov qword [rbx + 8], rsi
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsi + 0x30], rax
test rax, rax
jne 0x14007d420
mov rcx, rbx
call fcn.1401120d4
cmp dword [0x140277860], 3
jl 0x14007d43a
test dword [0x1402778c4], 0x200000
mov ebx, 1
jne 0x14007d43c
mov ebx, ebp
mov edx, 3
mov ecx, 0x200000
call fcn.1400e3b80
test ebx, ebx
jne 0x14007d453
test eax, eax
je 0x14007d494
lea rcx, str.Participant_logging_started
mov r9d, 3
mov qword [rsp + 0x38], rcx
mov r8d, 0x200000
lea rcx, str.C:jenkinsworkspacedptf_2SrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
mov dword [rsp + 0x30], 0x48a
mov qword [rsp + 0x28], rcx
mov edx, eax
lea rcx, str.EsifLogMgr_StartLoggingIfRequired
mov qword [rsp + 0x20], rcx
mov ecx, ebx
call fcn.1400bb960
mov eax, ebp
jmp 0x14007d50a
mov ebx, 1
cmp dword [0x140277860], ebx
jl 0x14007d4b3
test dword [0x140277894], 0x200000
je 0x14007d4b3
mov ebp, ebx
mov edx, ebx
mov ecx, 0x200000
call fcn.1400e3b80
test ebp, ebp
jne 0x14007d4c7
test eax, eax
je 0x14007d505
lea rcx, str.Error_:_No_Data_to_Log
mov r9d, ebx
mov qword [rsp + 0x38], rcx
mov r8d, 0x200000
lea rcx, str.C:jenkinsworkspacedptf_2SrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
mov dword [rsp + 0x30], 0x485
mov qword [rsp + 0x28], rcx
mov edx, eax
lea rcx, str.EsifLogMgr_StartLoggingIfRequired
mov qword [rsp + 0x20], rcx
mov ecx, ebp
call fcn.1400bb960
mov eax, 0x3ea
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400809c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x14026e158]
xor edi, edi
cmp ecx, 0x1f4
cmovge eax, ecx
xor bl, bl
mov dword [0x14026e158], eax
nop dword [rax + rax]
lea rcx, [0x140281cd8]
call fcn.140084180
movzx ecx, bl
call fcn.140082030
mov rsi, rax
nop word [rax + rax]
mov eax, 1
xchg qword [0x140281ce0], rax
cmp rax, 1
je 0x140080a10
add dword [0x140281ce8], 0xffffffff
mov rax, rdi
xchg qword [0x140281ce0], rax
jne 0x140080a42
lea rcx, [0x140281cd8]
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockShared]
test rsi, rsi
je 0x140080a57
mov rcx, rsi
call fcn.1400b7b60
mov rcx, rsi
call fcn.1400b78b0
inc bl
cmp bl, 0x20
jb 0x1400809f0
mov rax, rdi
lock xadd qword [0x14026e150], rax
test al, al
je 0x140080adb
mov ecx, 0x10
call fcn.1401120e8
mov rbx, rax
test rax, rax
jne 0x140080a97
mov edi, 0x708
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rax, [0x140080c10]
mov qword [rsp + 0x28], rdi
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x140084cb0]
mov qword [rbx + 8], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x140281cf0], rax
test rax, rax
jne 0x140080adb
mov rcx, rbx
call fcn.1401120d4
mov edi, 0x3eb
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a8c40
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.140104310
lea rbp, [0x14017f5f4]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x14017f5f8]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.1400a9370
mov ecx, 0x110
call fcn.1401120e8
mov rbx, rax
test rax, rax
je 0x1400a8ccb
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.140104310
test rbx, rbx
je 0x1400a8e20
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400a8df7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14017f5f8]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.1400a9370
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a8da2
bt eax, 0xa
jae 0x1400a8da2
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a8d90
bt eax, 0xa
jae 0x1400a8d90
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a8d83
test al, 0x10
je 0x1400a8d83
lea rcx, [rsp + 0x170]
call fcn.14012fc74
jmp 0x1400a8d90
lea rcx, [rsp + 0x170]
call fcn.140114a3c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.140104310
cmp byte [rsp + 0x5c], 0
jne 0x1400a8dc6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x1400a8d00
cmp byte [rsp + 0x5c], 0
je 0x1400a8dfe
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1401121b8
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1401121b8
cmp byte [rsp + 0x5c], 0
jne 0x1400a8e20
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400a8e14
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1401120d4
xor eax, eax
jmp 0x1400a8e23
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140102a00
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a8e50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, r8
mov rbx, rcx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.140104310
test rbx, rbx
je 0x1400a8f8f
xor edx, edx
lea rcx, [rsp + 0x170]
mov r8d, 0x104
call fcn.140104310
lea rsi, [0x14017f5f4]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 1
jne 0x1400a8fb7
lea rax, [rsp + 0x5c]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rbx + 8]
lea r8, [0x14017f5f8]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x170]
call fcn.1400a9370
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a8f6b
bt eax, 0xa
jae 0x1400a8f6b
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a8f59
bt eax, 0xa
jae 0x1400a8f59
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a8f4c
test al, 0x10
je 0x1400a8f4c
lea rcx, [rsp + 0x170]
call fcn.14012fc74
jmp 0x1400a8f59
lea rcx, [rsp + 0x170]
call fcn.140114a3c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.140104310
cmp byte [rsp + 0x5c], 0
je 0x1400a8eb1
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rdi
call fcn.1401121b8
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140102a00
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test eax, eax
jne 0x1400a8f76
xor eax, eax
jmp 0x1400a8f92

Function at 0x1400a8fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a9018
bt eax, 0xa
jae 0x1400a9018
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a9005
test al, 0x10
je 0x1400a9005
mov rcx, rbx
call fcn.14012fc74
jmp 0x1400a900d
mov rcx, rbx
call fcn.140114a3c
test eax, eax
je 0x1400a9018
mov ecx, 0x1f
jmp 0x1400a9027
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14012f72c
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x60
pop rbx
ret
Function at 0x1400a9050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a90c6
bt eax, 0xa
jae 0x1400a90c6
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400a90a8
test al, 0x10
je 0x1400a90a8
mov rcx, rdi
call fcn.14012fc74
jmp 0x1400a90b0
mov rcx, rdi
call fcn.140114a3c
test eax, eax
je 0x1400a90c6
test rbx, rbx
je 0x1400a90bf
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x1400a916e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1401121b8
lea rdx, [0x14017fe68]
mov rcx, rsi
call fcn.140131020
test rax, rax
je 0x1400a9147
mov edx, 0x63
mov rcx, rsi
call fcn.1401044b0
test rax, rax
jne 0x1400a9147
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14012c6b8
cmp rax, 0x20
jne 0x1400a912b
mov byte [rsp + 0x47], bpl
jmp 0x1400a9147
mov r9, 0xffffffffffffffff
lea r8, [0x14017fe6c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.140143244
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140143614
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400a916b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140102a00
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400af350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.140104310
lea rax, [0x14017f780]
mov edx, 0x104
lea rdi, [0x14018163c]
mov qword [rsp + 0x20], rax
lea r9, str.override
mov r8d, 2
lea rcx, [rsp + 0xa0]
mov rsi, rdi
call fcn.140047820
lea rcx, str.gddv
call fcn.140037c70
mov rbx, rax
test rax, rax
je 0x1400af41f
mov rcx, rax
call fcn.1400a9250
cmp byte [rbx + 0x49], 0
lea rcx, [rbx + 0x49]
cmovne rsi, rcx
nop
mov eax, 1
xchg qword [rbx + 8], rax
cmp rax, 1
je 0x1400af3f0
add dword [rbx + 0x10], 0xffffffff
mov eax, 0
xchg qword [rbx + 8], rax
jne 0x1400af417
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockShared]
mov rcx, rbx
call fcn.14003c8b0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
lea r8, [0x14018199c]
mov r9b, 0xff
mov qword [rsp + 0x20], 0
mov edx, 0x221
mov qword [rsp + 0x54], 0
mov ecx, 1
mov dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x60], 0
call fcn.140084ce0
mov ebx, eax
test eax, eax
jne 0x1400af484
mov rax, qword [rsp + 0x54]
test rax, rax
je 0x1400af484
cmp dword [rsp + 0x60], ebx
cmovne rdi, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400af4db
bt eax, 0xa
jae 0x1400af4db
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400af4c3
test al, 0x10
je 0x1400af4c3
lea rcx, [rsp + 0xa0]
call fcn.14012fc74
jmp 0x1400af4d0
lea rcx, [rsp + 0xa0]
call fcn.140114a3c
test eax, eax
je 0x1400af4db
mov eax, 0x1f
jmp 0x1400af4ed
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.14012f72c
test eax, eax
mov qword [rsp + 0x40], rsi
mov rax, qword [0x14026ffd8]
lea r8, str.false
mov qword [rsp + 0x38], rdi
lea rdx, str.true
cmovne rdx, r8
lea r9, [0x14026ffe0]
mov qword [rsp + 0x30], rdx
lea r8, [0x140186318]
mov qword [rsp + 0x28], rax
lea rdx, str._about__n___ufVersion__s__ufVersion__n___lfVersion__s__lfVersion__n___osType__s__osType__n___shellVersion__s__shellVersion__n___overrideDvExistsOnDisk__s__overrideDvExistsOnDisk__n___currentGddvDescription__s__currentGddvDescription__n___currentCacheDescription__s__currentCacheDescription__n__about__n_n
lea rax, [0x14028fc80]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1400ae400
test eax, eax
mov ecx, 0xbba
cmovle ebx, ecx
mov rcx, qword [rsp + 0x54]
test rcx, rcx
je 0x1400af55e
call fcn.1401120d4
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140102a00
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400cddc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x50
cmp dword [0x140277860], 4
mov rsi, rcx
mov ebx, 1
jl 0x1400cddfb
test dword [0x1402778dc], 0x40000
je 0x1400cddfb
mov edi, ebx
jmp 0x1400cddfd
xor edi, edi
mov edx, 4
mov ecx, 0x40000
call fcn.1400e3b80
lea r14, str.C:jenkinsworkspacedptf_2SrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r15, str.CStateChangeDetection::StartThread
test edi, edi
jne 0x1400cde22
test eax, eax
je 0x1400cde55
lea rcx, str.Starting_thread__n
mov r9d, 4
mov qword [rsp + 0x38], rcx
mov r8d, 0x40000
mov dword [rsp + 0x30], 0x5e
mov edx, eax
mov qword [rsp + 0x28], r14
mov ecx, edi
mov qword [rsp + 0x20], r15
call fcn.1400bb960
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x140059157.0]
xor r9d, r9d
mov dword [rsi + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x1400cde8f
mov eax, 0x80004005
jmp 0x1400cdf30
mov qword [rsp + 0x28], 0
lea r8, [0x1400ce130]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400cde85
cmp dword [0x140277860], 4
jl 0x1400cded2
test dword [0x1402778dc], 0x40000
jne 0x1400cded4
xor ebx, ebx
mov edx, 4
mov ecx, 0x40000
call fcn.1400e3b80
mov edi, eax
test ebx, ebx
jne 0x1400cdeed
test eax, eax
je 0x1400cdf2e
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.DLL_GetThreadId]
mov dword [rsp + 0x40], eax
lea rcx, str.Thread_ID___d_n
mov qword [rsp + 0x38], rcx
mov r9d, 4
mov dword [rsp + 0x30], 0x75
mov r8d, 0x40000
mov qword [rsp + 0x28], r14
mov edx, edi
mov ecx, ebx
mov qword [rsp + 0x20], r15
call fcn.1400bb960
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
Function at 0x1400d65f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x50
cmp dword [0x140277860], 3
mov edi, 1
jl 0x1400d6623
test dword [0x1402778c4], 0x400000
je 0x1400d6623
mov ebx, edi
jmp 0x1400d6625
xor ebx, ebx
mov edx, 3
mov ecx, 0x400000
call fcn.1400e3b80
lea r14, str.C:jenkinsworkspacedptf_2SrcESIFProductsESIF_UFSourceswindppe.c
lea r15, str.dppe_esif_init
test ebx, ebx
jne 0x1400d664a
test eax, eax
je 0x1400d667d
lea rcx, str.Entering_Function...
mov r9d, 3
mov qword [rsp + 0x38], rcx
mov r8d, 0x400000
mov dword [rsp + 0x30], 0xc2
mov edx, eax
mov qword [rsp + 0x28], r14
mov ecx, ebx
mov qword [rsp + 0x20], r15
call fcn.1400bb960
cmp dword [0x140286158], 4
je 0x1400d66b4
call fcn.140035f70
lea rcx, [0x140281e60]
mov qword [0x140281e58], rax
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
mov qword [0x140281e68], 0
mov dword [0x140281e70], 0
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d6700
bt eax, 0xa
jae 0x1400d6700
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d66f0
test al, 0x10
je 0x1400d66f0
lea rcx, str.user32.dll
call fcn.14012fc74
jmp 0x1400d66fc
lea rcx, str.user32.dll
call fcn.140114a3c
test eax, eax
jne 0x1400d677f
mov ecx, 0x18
call fcn.1401120e8
mov rbx, rax
test rax, rax
je 0x1400d677f
xorps xmm0, xmm0
lea rcx, str.user32.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rcx, qword [rbx]
mov qword [0x140281eb0], rbx
test rcx, rcx
je 0x1400d678a
lea rdx, str.GetSystemMetrics
mov qword [rsp + 0x60], rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400d6771
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov qword [0x140281eb8], rsi
mov rsi, qword [rsp + 0x60]
jmp 0x1400d678a
mov qword [0x140281eb0], 0
lea rcx, [0x140281e78]
call fcn.1400d7f70
call fcn.1400dab50
cmp dword [0x140277860], 3
mov ebx, eax
jl 0x1400d67b2
test dword [0x1402778c4], 0x400000
jne 0x1400d67b4
xor edi, edi
mov edx, 3
mov ecx, 0x400000
call fcn.1400e3b80
test edi, edi
jne 0x1400d67cb
test eax, eax
je 0x1400d6802
mov dword [rsp + 0x40], ebx
lea rcx, str.Exiting_function:_Exit_code__0x_08X...
mov qword [rsp + 0x38], rcx
mov r9d, 3
mov dword [rsp + 0x30], 0xd9
mov r8d, 0x400000
mov qword [rsp + 0x28], r14
mov edx, eax
mov ecx, edi
mov qword [rsp + 0x20], r15
call fcn.1400bb960
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
Function at 0x1400e4320
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x50
lea rbp, [0x140281f00]
xor ebx, ebx
mov rcx, rbp
mov edi, ebx
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
inc dword [0x140281f14]
cmp dword [0x140277860], 4
jl 0x1400e4364
test dword [0x1402778dc], 0x10000
lea esi, [rbx + 1]
jne 0x1400e4366
mov esi, ebx
mov edx, 4
mov ecx, 0x10000
call fcn.1400e3b80
lea r15, str.C:jenkinsworkspacedptf_2SrcESIFProductsESIF_UFSourceswinesif_uf_hid.c
mov edx, eax
test esi, esi
jne 0x1400e4386
test eax, eax
je 0x1400e43c8
mov eax, dword [0x140281f14]
mov r9d, 4
mov dword [rsp + 0x40], eax
mov r8d, 0x10000
lea rax, str.Refcount___d_n
mov ecx, esi
mov qword [rsp + 0x38], rax
lea rax, str.EsifHid_Enable
mov dword [rsp + 0x30], 0x162
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.1400bb960
cmp dword [0x140281f14], 1
jne 0x1400e4553
mov qword [rsp + 0x70], r14
call fcn.1400e4a90
cmp dword [0x140277860], 4
jl 0x1400e43f9
test dword [0x1402778dc], 0x10000
je 0x1400e43f9
mov edi, 1
mov edx, 4
mov ecx, 0x10000
call fcn.1400e3b80
lea r14, str.EsifHid_Start
test edi, edi
jne 0x1400e4417
test eax, eax
je 0x1400e444a
lea rcx, str.Starting_HID_ETW_tracking_n
mov r9d, 4
mov qword [rsp + 0x38], rcx
mov r8d, 0x10000
mov dword [rsp + 0x30], 0x128
mov edx, eax
mov qword [rsp + 0x28], r15
mov ecx, edi
mov qword [rsp + 0x20], r14
call fcn.1400bb960
mov r8, rbp
lea rdx, [0x1400e4be0]
lea rcx, [0x140281f20]
call fcn.140034e80
mov ecx, 0x10
mov byte [0x140281f30], 1
mov qword [0x140281f28], rbx
mov edi, ebx
call fcn.1401120e8
mov rsi, rax
test rax, rax
jne 0x1400e4489
mov edi, 0x708
jmp 0x1400e44cd
lea rax, [0x1400e3d50]
mov qword [rsp + 0x28], rbx
mov r9, rsi
mov qword [rsi], rax
lea r8, [0x1400e4c80]
mov qword [rsi + 8], rbp
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x140281f18], rax
test rax, rax
jne 0x1400e453f
mov rcx, rsi
call fcn.1401120d4
mov edi, 0x3eb
lea rcx, [0x140281f20]
call fcn.140035210
cmp dword [0x140277860], 1
jl 0x1400e44f3
test dword [0x140277894], 0x10000
mov esi, 1
jne 0x1400e44f5
mov esi, ebx
mov edx, 1
mov ecx, 0x10000
call fcn.1400e3b80
test esi, esi
jne 0x1400e450c
test eax, eax
je 0x1400e453f
lea rcx, str.Unable_to_create_HID_ETW_control_thread_n
mov r9d, 1
mov qword [rsp + 0x38], rcx
mov r8d, 0x10000
mov dword [rsp + 0x30], 0x139
mov edx, eax
mov qword [rsp + 0x28], r15
mov ecx, esi
mov qword [rsp + 0x20], r14
call fcn.1400bb960
mov r14, qword [rsp + 0x70]
test edi, edi
je 0x1400e4553
call fcn.1400e4a90
dec dword [0x140281f14]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
cmp byte [0x140281f30], bl
setne bl
mov ecx, ebx
call fcn.1400e4a10
mov rbx, qword [rsp + 0x78]
mov eax, edi
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop rdi
pop rsi
ret