joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400105b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r14, r8
mov r12, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400106af
test rdx, rdx
je 0x1400106af
cmp dword [rcx + 4], 2
jne 0x1400106af
mov ecx, dword [rcx]
sub ecx, 1
je 0x140010696
cmp ecx, 1
jne 0x1400106af
mov rax, qword [rdi + 0x20]
mov rsi, qword [rdi + 8]
lea rbp, [rax + r8]
test rsi, rsi
je 0x14001061c
cmp qword [rdi + 0x10], rbp
jae 0x14001066d
and rbp, 0xfffffffffffffe00
mov qword [rsp + 0x40], rbx
add rbp, 0x200
mov rcx, rsi
mov rdx, rbp
mov rbx, rsi
call fcn.1400d4e04
test rbx, rbx
mov rsi, rax
mov rbx, qword [rsp + 0x40]
jne 0x14001065c
test rax, rax
je 0x1400106af
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1400ad590
test rsi, rsi
je 0x1400106af
mov rax, qword [rdi + 0x20]
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rbp
lea rcx, [rsi + rax]
mov r8, r14
mov rdx, r12
call fcn.140010790
add qword [rdi + 0x20], r14
mov r15, r14
mov rcx, qword [rdi + 0x20]
cmp rcx, qword [rdi + 0x18]
cmovbe rcx, qword [rdi + 0x18]
mov qword [rdi + 0x18], rcx
jmp 0x1400106af
mov r9, qword [rdi + 0x10]
test r9, r9
je 0x1400106af
mov edx, 1
mov rcx, r12
call fcn.1400ee07c
mov r15, rax
mov rbp, qword [rsp + 0x48]
mov rax, r15
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140012db0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor edi, edi
movsxd rbx, ecx
mov r14, r9
mov r15, r8
mov rsi, rdx
test rdx, rdx
je 0x140012deb
mov edx, 0x104
mov rcx, rsi
call fcn.1400d5838
mov rbp, rax
jmp 0x140012ded
mov ebp, edi
imul rbx, rbx, 0x38
lea r12, [0x140217950]
mov qword [rsp + 0x78], rbx
lea rax, [rbx + r12]
mov rcx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
cmp qword [rbx + r12 + 0x28], rdi
je 0x140012f5c
mov qword [rsp + 0x70], r13
call fcn.1400053e0
mov qword [rsp + 0x28], r14
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rcx, qword [rax]
or rcx, 2
call fcn.1400d4cd4
test eax, eax
mov rcx, 0xffffffffffffffff
cmovs eax, ecx
movsxd r12, eax
add r12, 2
mov rcx, r12
lea r13d, [rax + 2]
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x140012f57
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400ad590
mov r9, r15
mov qword [rsp + 0x20], r14
mov r8, 0xffffffffffffffff
mov rdx, r12
mov rcx, rbx
call fcn.140016160
mov r9d, eax
test r12, r12
je 0x140012ea5
cmp eax, 0xffffffff
jne 0x140012ea5
lea r9d, [r13 - 1]
mov rax, rbx
cmp byte [rbx], dil
je 0x140012ec3
nop dword [rax]
cmp byte [rax + 1], dil
je 0x140012ec3
cmp byte [rax], 0xa
jne 0x140012ebe
mov byte [rax], 9
inc rax
jmp 0x140012eb0
test rsi, rsi
je 0x140012f1b
cmp r9d, ebp
jle 0x140012f1b
lea edi, [r9 + rbp]
cmp edi, r13d
jge 0x140012f1b
lfence
movsxd rcx, ebp
mov r8, rsi
movsxd rax, r9d
sub rax, rcx
add rax, rbx
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140012f03
inc rax
test ecx, ecx
jne 0x140012ef0
test edx, edx
je 0x140012f1b
lfence
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call fcn.1400143c0
mov r9d, edi
mov rsi, qword [rsp + 0x78]
lea rbp, [0x140217950]
movsxd r8, r9d
mov edx, 1
mov rcx, rbx
mov r9, qword [rsi + rbp + 0x28]
call fcn.1400ee07c
cmp byte [rsi + rbp + 0x30], 0
mov edi, eax
je 0x140012f4f
mov rcx, qword [rsi + rbp + 0x28]
call fcn.1400ed2e0
mov rcx, rbx
call fcn.1400bb254
mov r13, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140014120
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140014193
bt eax, 0xa
jae 0x140014193
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001417d
test al, 0x10
je 0x14001417d
mov rcx, rdi
call fcn.1400d8df4
jmp 0x140014185
mov rcx, rdi
call fcn.1400bdbbc
test eax, eax
je 0x140014193
mov eax, 0x1f
jmp 0x140014307
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400141d7
bt eax, 0xa
jae 0x1400141d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400141cb
test al, 0x10
je 0x1400141cb
mov rcx, rdi
call fcn.1400d8df4
jmp 0x1400141d3
mov rcx, rdi
call fcn.1400bdbbc
test eax, eax
jne 0x1400141ee
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d88ac
mov ebx, eax
test eax, eax
je 0x1400142fd
test rdi, rdi
jne 0x1400141f7
xor ebx, ebx
jmp 0x140014207
mov edx, 0x104
mov rcx, rdi
call fcn.1400d5838
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400ad590
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400bb338
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x14001425b
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x14001425b
dec rbx
cmp rbx, 0x104
jae 0x140014320
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001429f
bt eax, 0xa
jae 0x14001429f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140014291
test al, 0x10
je 0x140014291
lea rcx, [rsp + 0x50]
call fcn.1400d8df4
jmp 0x14001429b
lea rcx, [rsp + 0x50]
call fcn.1400bdbbc
test eax, eax
jne 0x1400142b4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d88ac
mov ebx, eax
test eax, eax
je 0x1400142fd
lea rcx, [rsp + 0x50]
call fcn.1400d8b70
mov ebx, eax
test eax, eax
je 0x1400142fd
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400adc98
mov rdi, rax
test rax, rax
je 0x1400142fd
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.140014120
mov ebx, eax
test eax, eax
jne 0x1400142fd
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d8b70
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x170
pop rdi
ret
call fcn.1400abde4
int3
Function at 0x14001d9e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x428
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x410], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.1400ad590
call fcn.140002150
mov qword [0x140217b10], rax
test rax, rax
jne 0x14001da39
mov eax, 0x708
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x428
ret
xor r9d, r9d
mov qword [rsp + 0x420], rdi
mov edx, 0x80
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x390]
lea r8d, [r9 + 7]
call fcn.140013cf0
lea r8, [rsp + 0x30]
lea rdx, str.upe_.dll
lea rcx, [rsp + 0x390]
call fcn.14001f340
mov rdi, rax
test rax, rax
je 0x14001dc58
mov qword [rsp + 0x430], rbx
mov qword [rsp + 0x438], rsi
lea rsi, [0x14012779c]
nop
mov ecx, 0x30
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x14001dc2a
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movups xmmword [rax], xmm0
mov edx, 0x2e
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
call fcn.1400ad730
test rax, rax
je 0x14001dafa
lea rcx, [rsp + 0x30]
mov byte [rax], 0
call fcn.1400d8f08
mov qword [rbx + 0x18], rax
mov rdx, rbx
mov rcx, qword [0x140217b10]
call fcn.140001fa0
jmp 0x14001db02
mov rcx, rbx
call fcn.1400bb254
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x140
call fcn.1400ad590
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x104
call fcn.1400ad590
nop dword [rax]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 1
jne 0x14001dc03
lea rax, [rsp + 0x16c]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rdi + 8]
lea r8, [0x1401277a0]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x280]
call fcn.14001f840
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001dbf3
bt eax, 0xa
jae 0x14001dbf3
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001dbde
bt eax, 0xa
jae 0x14001dbde
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001dbd1
test al, 0x10
je 0x14001dbd1
lea rcx, [rsp + 0x280]
call fcn.1400d8df4
jmp 0x14001dbde
lea rcx, [rsp + 0x280]
call fcn.1400bdbbc
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x140
call fcn.1400ad590
cmp byte [rsp + 0x16c], 0
je 0x14001db30
jmp 0x14001dc07
test eax, eax
je 0x14001dc2a
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x16c]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400bb338
jmp 0x14001daa0
mov rcx, qword [rdi]
mov rsi, qword [rsp + 0x438]
mov rbx, qword [rsp + 0x430]
cmp rcx, 0xffffffffffffffff
je 0x14001dc50
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rdi], 0xffffffffffffffff
mov rcx, rdi
call fcn.1400bb254
mov rdi, qword [rsp + 0x420]
xor eax, eax
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x428
ret
Function at 0x14001f340
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ad590
lea rbp, [0x14012779c]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277a0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.14001f840
mov ecx, 0x110
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x14001f3cb
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.1400ad590
test rbx, rbx
je 0x14001f520
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x14001f4f7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277a0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.14001f840
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f4a2
bt eax, 0xa
jae 0x14001f4a2
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f490
bt eax, 0xa
jae 0x14001f490
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f483
test al, 0x10
je 0x14001f483
lea rcx, [rsp + 0x170]
call fcn.1400d8df4
jmp 0x14001f490
lea rcx, [rsp + 0x170]
call fcn.1400bdbbc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad590
cmp byte [rsp + 0x5c], 0
jne 0x14001f4c6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x14001f400
cmp byte [rsp + 0x5c], 0
je 0x14001f4fe
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb338
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb338
cmp byte [rsp + 0x5c], 0
jne 0x14001f520
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14001f514
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb254
xor eax, eax
jmp 0x14001f523
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400abc80
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002e800
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ad590
lea rbp, [0x14012779c]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277a0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.14002ea50
mov ecx, 0x110
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x14002e88b
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.1400ad590
test rbx, rbx
je 0x14002e9e0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x14002e9b7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277a0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.14002ea50
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002e962
bt eax, 0xa
jae 0x14002e962
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002e950
bt eax, 0xa
jae 0x14002e950
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002e943
test al, 0x10
je 0x14002e943
lea rcx, [rsp + 0x170]
call fcn.1400d8df4
jmp 0x14002e950
lea rcx, [rsp + 0x170]
call fcn.1400bdbbc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad590
cmp byte [rsp + 0x5c], 0
jne 0x14002e986
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x14002e8c0
cmp byte [rsp + 0x5c], 0
je 0x14002e9be
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb338
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb338
cmp byte [rsp + 0x5c], 0
jne 0x14002e9e0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14002e9d4
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb254
xor eax, eax
jmp 0x14002e9e3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400abc80
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140037d50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x60
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140037ddf
cmp dword [0x14020e430], 1
jl 0x140037f61
test dword [0x14020e464], 0x200000
je 0x140037f61
lea rax, str.logstring_is_NULL
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
lea r8, str.EsifLogMgr_DataLogWrite
mov dword [rsp + 0x20], 0xade
mov ecx, 0x200000
call fcn.140078180
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x60
pop rbx
ret
mov eax, dword [rcx + 0x17c]
test eax, eax
je 0x140037f61
mov qword [rsp + 0x58], rbp
xor ebp, ebp
test al, 8
jbe 0x140037e22
cmp byte [rcx + 0x70], bpl
je 0x140037e07
test byte [rcx + 0x180], 8
jne 0x140037e22
lea rdx, [rsp + 0x80]
mov rcx, r8
call fcn.1400127a0
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x78]
test al, 4
jbe 0x140037e59
cmp byte [rbx + 0x70], bpl
je 0x140037e35
test byte [rbx + 0x180], 4
jne 0x140037e59
lea r9, [rsp + 0x80]
mov ecx, 5
lea rdx, [0x140130b38]
call fcn.140012db0
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdi
test al, 2
jbe 0x140037eda
cmp byte [rbx + 0x70], bpl
je 0x140037e71
test byte [rbx + 0x180], 2
jne 0x140037eda
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x50], rsi
mov rcx, r8
call fcn.14003cfe0
inc eax
movsxd rsi, eax
mov rcx, rsi
call fcn.14003d030
mov rdi, rax
test rax, rax
je 0x140037ed0
mov r9, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call fcn.140016160
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov rcx, rdi
call fcn.1400bb254
mov r8, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x50]
test byte [rbx + 0x17c], 1
jbe 0x140037f57
cmp byte [rbx + 0x70], bpl
je 0x140037ef2
test byte [rbx + 0x180], 1
jne 0x140037f57
lea rdx, [rsp + 0x80]
mov rcx, r8
call fcn.14003cfe0
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.14003d030
mov rbx, rax
test rax, rax
je 0x140037f57
mov r9, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140016160
mov r8, rbx
lea rdx, [0x14012ed4c]
mov ecx, 3
call fcn.1400a2bd0
mov rcx, rbx
call fcn.1400bb254
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400abc80
add rsp, 0x60
pop rbx
ret
Function at 0x14003b7c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ebp, ebp
add rcx, 0x10
call qword [sym.imp.KERNEL32.DLL_AcquireSRWLockExclusive]
mov rcx, qword [rsi + 8]
call fcn.1400023f0
test eax, eax
lea rcx, [rsi + 0x10]
setne bl
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockExclusive]
test bl, bl
je 0x14003b8ea
cmp byte [rsi + 0x71], bpl
jne 0x14003b8a0
mov word [rsi + 0x71], 1
cmp byte [rsi + 0x73], bpl
jne 0x14003b823
mov dword [rsi + 0x180], ebp
mov byte [rsi + 0x70], 1
lea rcx, [rsi + 0x38]
call qword [sym.imp.KERNEL32.DLL_InitializeSRWLock]
xor r9d, r9d
mov qword [rsi + 0x40], rbp
xor edx, edx
mov dword [rsi + 0x48], ebp
xor ecx, ecx
mov r8d, 0x7fffffff
call qword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov ecx, 0x10
mov dword [rsi + 0x50], ebp
mov qword [rsi + 0x58], rax
mov byte [rsi + 0x4c], bpl
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x14003b8a0
lea rax, [0x14003aa40]
mov qword [rsp + 0x28], rbp
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x14003dd60]
mov qword [rbx + 8], rsi
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsi + 0x30], rax
test rax, rax
jne 0x14003b8a0
mov rcx, rbx
call fcn.1400bb254
cmp dword [0x14020e430], 3
jl 0x14003b8e6
test dword [0x14020e494], 0x200000
je 0x14003b8e6
lea rcx, str.Participant_logging_started
mov edx, 3
mov qword [rsp + 0x28], rcx
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
mov ecx, 0x200000
mov dword [rsp + 0x20], 0x47e
lea r8, str.EsifLogMgr_StartLoggingIfRequired
call fcn.140078180
mov eax, ebp
jmp 0x14003b935
cmp dword [0x14020e430], 1
jl 0x14003b930
test dword [0x14020e464], 0x200000
je 0x14003b930
lea rax, str.Error_:_No_Data_to_Log
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
lea r8, str.EsifLogMgr_StartLoggingIfRequired
mov dword [rsp + 0x20], 0x479
mov ecx, 0x200000
call fcn.140078180
mov eax, 0x3ea
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003dd90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x140204a70]
xor edi, edi
cmp ecx, 0x1f4
cmovge eax, ecx
xor bl, bl
mov dword [0x140204a70], eax
nop dword [rax + rax]
lea rcx, [0x1402191b8]
call fcn.140040f50
movzx ecx, bl
call fcn.14003f270
mov rsi, rax
nop word [rax + rax]
mov eax, 1
xchg qword [0x1402191c0], rax
cmp rax, 1
je 0x14003dde0
add dword [0x1402191c8], 0xffffffff
mov rax, rdi
xchg qword [0x1402191c0], rax
jne 0x14003de12
lea rcx, [0x1402191b8]
call qword [sym.imp.KERNEL32.DLL_ReleaseSRWLockShared]
test rsi, rsi
je 0x14003de27
mov rcx, rsi
call fcn.140072190
mov rcx, rsi
call fcn.140071b20
inc bl
cmp bl, 0x20
jb 0x14003ddc0
mov rax, rdi
lock xadd qword [0x140204a68], rax
test al, al
je 0x14003deab
mov ecx, 0x10
call fcn.1400bb268
mov rbx, rax
test rax, rax
jne 0x14003de67
mov edi, 0x708
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rax, [0x14003dfe0]
mov qword [rsp + 0x28], rdi
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x140041a80]
mov qword [rbx + 8], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1402191d0], rax
test rax, rax
jne 0x14003deab
mov rcx, rbx
call fcn.1400bb254
mov edi, 0x3eb
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140063840
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ad590
lea rbp, [0x14012779c]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277a0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.140063f70
mov ecx, 0x110
call fcn.1400bb268
mov rbx, rax
test rax, rax
je 0x1400638cb
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.1400ad590
test rbx, rbx
je 0x140063a20
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400639f7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277a0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140063f70
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400639a2
bt eax, 0xa
jae 0x1400639a2
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063990
bt eax, 0xa
jae 0x140063990
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140063983
test al, 0x10
je 0x140063983
lea rcx, [rsp + 0x170]
call fcn.1400d8df4
jmp 0x140063990
lea rcx, [rsp + 0x170]
call fcn.1400bdbbc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad590
cmp byte [rsp + 0x5c], 0
jne 0x1400639c6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x140063900
cmp byte [rsp + 0x5c], 0
je 0x1400639fe
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb338
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb338
cmp byte [rsp + 0x5c], 0
jne 0x140063a20
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140063a14
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb254
xor eax, eax
jmp 0x140063a23
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400abc80
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret