joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062b90
Capabilities:
Get common file path

Disassembly:
jmp 0x140062b90
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
mov dword [rcx], 9
xor eax, eax
mov rbx, rcx
mov qword [rcx + 4], rax
mov qword [rcx + 0xc], rax
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
test eax, eax
je 0x140062c44
mov qword [rsp + 0x30], rsi
mov esi, ebp
mov qword [rsp + 0x38], rdi
add rsi, rsi
mov rcx, rsi
call fcn.14006c500
mov rdi, rax
test rax, rax
je 0x140062bed
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14006c5d0
mov rsi, qword [rsp + 0x30]
mov qword [rbx + 4], rdi
test rdi, rdi
je 0x140062c3f
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140062c33
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x140062c18
call fcn.14006c470
mov rdi, qword [rsp + 0x38]
mov qword [rbx + 4], 0
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
lea ecx, [rax + rax]
mov dword [rbx + 0x10], ecx
lea eax, [rcx + 2]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret

Function at 0x140062c90
Capabilities:
Get common file path

Disassembly:
jmp 0x140062c90
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov dword [rcx], 9
xor eax, eax
mov rbx, rcx
mov qword [rcx + 4], rax
mov qword [rcx + 0xc], rax
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test eax, eax
je 0x140062d4a
mov qword [rsp + 0x30], rbp
mov ebp, esi
mov qword [rsp + 0x38], rdi
add rbp, rbp
mov rcx, rbp
call fcn.14006c500
mov rdi, rax
test rax, rax
je 0x140062ced
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.14006c5d0
mov rbp, qword [rsp + 0x30]
mov qword [rbx + 4], rdi
test rdi, rdi
je 0x140062d45
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140062d2f
lea ecx, [rax + 1]
cmp esi, ecx
jne 0x140062d2f
mov rdi, qword [rsp + 0x38]
add eax, eax
lea ecx, [rsi + rsi]
mov dword [rbx + 0x10], eax
mov rax, rbx
mov dword [rbx + 0xc], ecx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x140062d3d
call fcn.14006c470
mov qword [rbx + 4], 0
mov rdi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x1400670a0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400fae80]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov ebx, 1
mov ecx, 0xfffffff6
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x2c], ebx
mov byte [rsp + 0x36], reloc.WSOCK32.dll_listen
mov word [rsp + 0x28], bx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006cfe0
add rsp, 0x50
pop rbx
ret
Function at 0x1400672e0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0xc0
xor ebx, ebx
mov r12, r8
mov rdi, rdx
lea rcx, [rsp + 0x58]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [rsp + 0x50], ebx
call fcn.14006c5d0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, qword [rdi]
mov rsi, rax
test rcx, rcx
jne 0x140067327
mov eax, ebx
jmp 0x140067331
mov edx, 0x1fff
call fcn.140072070
cmp word [rsi], 0x22
jne 0x14006733b
add rax, 2
mov rdx, qword [rdi + 8]
lea rcx, [rsi + rax*2]
call fcn.1400746e8
mov r14, rax
test rax, rax
jne 0x140067369
lea rdx, str.Unable_to_parse_command_line._n
lea ecx, [rax + 3]
call fcn.140001410
mov eax, 0x708
jmp 0x140067520
mov rcx, qword [rdi + 8]
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xe8], r15
test rcx, rcx
jne 0x140067387
mov rax, rbx
jmp 0x140067391
mov edx, 0x1fff
call fcn.140072070
mov edx, 0x1fff
mov rcx, rsi
lea r15, [r14 + rax*2]
call fcn.140072070
mov rcx, qword [rdi + 8]
lea rsi, [rax + 1]
test rcx, rcx
jne 0x1400673b4
mov rax, rbx
jmp 0x1400673be
mov edx, 0x1fff
call fcn.140072070
lea rcx, str.server__i
mov edx, 0x1fff
sub rsi, rax
call fcn.140072070
lea r14, [rax + 2]
add r14, rsi
lea rbp, [r14 + r14]
mov rcx, rbp
call fcn.14006c500
mov rsi, rax
test rax, rax
je 0x1400674fa
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.14006c5d0
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.14006c5d0
mov eax, 0x22
mov rdx, r14
mov word [rsi], ax
mov r8, qword [rdi]
mov rcx, rsi
call fcn.140074660
lea r8, [0x1400d823c]
mov rdx, r14
mov rcx, rsi
call fcn.140074660
lea r8, [0x1400d8240]
mov rdx, r14
mov rcx, rsi
call fcn.140074660
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.140074660
mov qword [rsp + 0x48], r12
lea rax, [0x1400d6794]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x8c], 1
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, 0x3eb
test eax, eax
cmove ebx, ecx
mov rcx, rsi
call fcn.14006c470
mov eax, ebx
jmp 0x140067510
lea rdx, str.Unable_to_allocate_memory._n
mov ecx, 3
call fcn.140001410
mov eax, 0x708
mov rbp, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1400679e0
Capabilities:
Create thread

Disassembly:
jmp 0x1400679e0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov r14d, r9d
mov edi, r8d
mov rbx, rcx
test rcx, rcx
je 0x140067b5f
mov r8, rdx
add rcx, 8
mov edx, 0x104
call fcn.140075830
test eax, eax
jne 0x140067b5f
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x50], rbp
mov dword [rbx + 0x240], r15d
mov ecx, eax
mov qword [rbx + 0x248], r15
mov dword [rbx + 0x210], edi
mov dword [rbx + 0x214], r14d
mov qword [rbx + 0x218], r15
mov dword [rbx + 0x220], eax
mov qword [rbx + 0x230], r15
mov qword [rbx + 0x238], r15
mov dword [rbx + 0x224], 0x20008
mov dword [rbx + 0x228], 0x20008
mov ebp, eax
call fcn.14006c500
mov rdi, rax
test rax, rax
je 0x140067a95
mov r8d, ebp
xor edx, edx
mov rcx, rax
call fcn.14006c5d0
mov rbp, qword [rsp + 0x50]
mov qword [rbx + 0x218], rdi
test rdi, rdi
je 0x140067b5f
mov ecx, 0x298
call fcn.14006c500
mov rdi, rax
test rax, rax
je 0x140067acc
xor edx, edx
mov r8d, 0x298
mov rcx, rax
call fcn.14006c5d0
mov qword [rbx], rdi
test rdi, rdi
je 0x140067b5f
mov dword [rsp + 0x20], r14d
mov r9d, 1
lea rdx, [rbx + 8]
mov rcx, rdi
cmp dword [rbx + 0x210], r15d
jne 0x140067af8
xor r8d, r8d
jmp 0x140067afb
mov r8d, r9d
call fcn.14000112c
test eax, eax
je 0x140067b5f
cmp qword [rbx + 0x218], r15
je 0x140067b5f
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x230], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x238], rax
cmp qword [rbx], r15
je 0x140067b4f
lea r8, [0x140067d90]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x248], rax
cmp qword [rbx + 0x248], r15
je 0x140067b5f
mov eax, 1
jmp 0x140067b6a
mov rcx, rbx
call fcn.1400019a6
mov eax, r15d
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140067f90
Capabilities:
Write file on windows

Disassembly:
jmp 0x140068b70
jmp 0x140067f90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140067fe5
mov rcx, qword [rcx]
test rcx, rcx
je 0x140067fe5
call fcn.140001127
test eax, eax
je 0x140067fe5
cmp qword [rbx + 0x248], 0
je 0x140067fe5
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14000119f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x140068b9d
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x140068bb8
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x40]
cmp dword [rcx + 0x218], edi
jne 0x140068be2
mov rcx, qword [rcx + 0x208]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x258], rdi
mov qword [rsp + 0x48], rsi
lea rsi, [rcx + 0x250]
mov rcx, qword [rcx + 0x208]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x140068c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140068c46
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140068100
Capabilities:
Connect pipe

Disassembly:
jmp 0x140068100
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x208]
xor eax, eax
cmp rcx, 0xffffffffffffffff
je 0x140068168
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
cmp dword [rdi + 0x214], eax
jne 0x14006814d
cmp dword [rdi + 0x218], eax
jne 0x14006816e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x14006814d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x14006815c
mov ebx, 1
mov dword [rdi + 0x210], 1
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, [rdi + 0x278]
mov qword [rdi + 0x278], rax
mov qword [rdi + 0x280], rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x140068152
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140068146
mov rcx, qword [rdi + 0x208]
lea r9d, [rbx + 1]
lea r8, [rsp + 0x30]
lea rdx, [rdi + 0x278]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebx, eax
test eax, eax
jne 0x140068152
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140068a30
Capabilities:
Read file on windows

Disassembly:
jmp 0x140068a30
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x140068a5d
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x140068a78
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x40]
cmp dword [rcx + 0x218], edi
jne 0x140068aa2
mov rcx, qword [rcx + 0x208]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x230], rdi
mov qword [rsp + 0x48], rsi
lea rsi, [rcx + 0x228]
mov rcx, qword [rcx + 0x208]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test eax, eax
jne 0x140068b08
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140068b06
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140068b70
Capabilities:
Write file on windows

Disassembly:
jmp 0x140068b70
jmp 0x140067f90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140067fe5
mov rcx, qword [rcx]
test rcx, rcx
je 0x140067fe5
call fcn.140001127
test eax, eax
je 0x140067fe5
cmp qword [rbx + 0x248], 0
je 0x140067fe5
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14000119f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x140068b9d
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x140068bb8
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x40]
cmp dword [rcx + 0x218], edi
jne 0x140068be2
mov rcx, qword [rcx + 0x208]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x258], rdi
mov qword [rsp + 0x48], rsi
lea rsi, [rcx + 0x250]
mov rcx, qword [rcx + 0x208]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x140068c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140068c46
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140068d70
Capabilities:
Terminate process

Disassembly:
jmp 0x140068d70
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 1
xor eax, eax
lock cmpxchg dword [rcx], edi
je 0x140068da3
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [rbx], edi
jne 0x140068d90
dec dword [rbx + 4]
mov eax, dword [rbx + 4]
mov edi, 0
cmovs eax, edi
mov dword [rbx + 4], eax
test eax, eax
jne 0x140068e4c
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x140068dfb
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140068ded
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x60], rdi
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], rdi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140068e34
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0x48]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140068e34
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 8]
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x58], 0xffffffff
call fcn.1400018f7
xchg dword [rbx], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140069310
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x120
xor ebx, ebx
mov rsi, rcx
lea rcx, [rax - 0x70]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [rax - 0x78], ebx
call fcn.14006c5d0
xor eax, eax
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x98]
xor edi, edi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x74], rdi
call fcn.1400010e1
movups xmm0, xmmword [rax]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x90], eax
movups xmmword [rsp + 0x80], xmm0
mov r8, qword [rsp + 0x84]
test r8, r8
je 0x140069474
lea rdx, str.__s_
lea rcx, [rsp + 0x98]
mov qword [rsi + 0x48], rbx
mov qword [rsi + 0x50], rbx
call fcn.1400013ed
movups xmm0, xmmword [rax]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x68], xmm0
mov rdi, qword [rsp + 0x6c]
test rdi, rdi
je 0x140069481
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0xb0], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
jne 0x14006945d
cmp dword [section..data], 1
jl 0x140069474
test byte [0x1400f602d], 1
je 0x140069474
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
lea r9, str..._rsrc_app.c
mov dword [rsp + 0x30], eax
lea rax, str.Unable_to_start_capture_program._Error___d
lea r8, str.rsrc_app_start_app_in_current_session
mov qword [rsp + 0x28], rax
mov ecx, edx
mov dword [rsp + 0x20], 0x190
call fcn.140001a82
jmp 0x140069474
mov rax, qword [rsp + 0x50]
mov ebx, 1
mov qword [rsi + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x50], rax
test rdi, rdi
je 0x140069481
mov rcx, rdi
call fcn.14006c470
lea r11, [rsp + 0x120]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140069500
Capabilities:
Create thread

Disassembly:
jmp 0x140069500
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov edi, 1
xor eax, eax
lock cmpxchg dword [rcx], edi
je 0x140069533
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [rbx], edi
jne 0x140069520
xor esi, esi
cmp qword [rbx + 0x60], rsi
jne 0x1400695ff
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x140069591
cmp dword [section..data], edi
jl 0x1400695fd
test byte [0x1400f602d], dil
je 0x1400695fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str.Unable_to_create_the_helper_app_stop_event._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd2
jmp 0x1400695e6
lea r8, [0x140069770]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x60], rax
test rax, rax
jne 0x1400695ff
cmp dword [section..data], edi
jl 0x1400695fd
test byte [0x1400f602d], dil
je 0x1400695fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str.Unable_to_create_the_helper_app_maintenance_thread._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xdd
lea r9, str..._rsrc_app.c
lea r8, str.rsrc_app_start_persistent_app
mov edx, edi
mov ecx, edi
call fcn.140001a82
mov edi, esi
xchg dword [rbx], esi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x140069890
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x70
mov dword [rcx], 9
xor eax, eax
mov rbx, rcx
mov qword [rcx + 4], rax
mov qword [rcx + 0xc], rax
lea rcx, [rsp + 0x58]
call fcn.1400017fd
movups xmm0, xmmword [rax]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x40], xmm0
cmp qword [rsp + 0x44], 0
je 0x140069983
mov r8, qword [rsp + 0x44]
lea r9, str.DPTF
lea rdx, str._s_s
lea rcx, [rsp + 0x58]
call fcn.1400013ed
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x140069979
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140069979
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140069979
cmp dword [section..data], 1
jl 0x140069963
test byte [0x1400f602d], 1
je 0x140069963
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
lea r9, str..._rsrc_file.c
mov dword [rsp + 0x30], eax
lea rax, str.Unable_to_create_temporary_directory._Error___d
lea r8, str.rsc_dll_create_esif_temp_directory
mov qword [rsp + 0x28], rax
mov ecx, edx
mov dword [rsp + 0x20], 0x11a
call fcn.140001a82
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x140069971
call fcn.14006c470
mov qword [rbx + 4], 0
mov rcx, qword [rsp + 0x44]
call fcn.14006c470
mov rax, rbx
add rsp, 0x70
pop rbx
ret
Function at 0x1400699d0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x70
mov dword [rcx], 9
xor eax, eax
mov rbx, rcx
mov qword [rcx + 4], rax
mov qword [rcx + 0xc], rax
lea rcx, [rsp + 0x58]
mov rsi, rdx
call fcn.140069890
movups xmm0, xmmword [rax]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x40], xmm0
cmp qword [rsp + 0x44], 0
je 0x140069ac7
mov r9, qword [rsi + 4]
mov r8, qword [rsp + 0x44]
lea rdx, [0x1400d8850]
lea rcx, [rsp + 0x58]
call fcn.1400013ed
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x140069abd
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140069abd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140069abd
cmp dword [section..data], 1
jl 0x140069aa7
test byte [0x1400f602d], 1
je 0x140069aa7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
lea r9, str..._rsrc_file.c
mov dword [rsp + 0x30], eax
lea rax, str.Unable_to_create_temporary_directory._Error___d
lea r8, str.rsc_dll_create_esif_temp_sub_directory
mov qword [rsp + 0x28], rax
mov ecx, edx
mov dword [rsp + 0x20], 0xf2
call fcn.140001a82
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x140069ab5
call fcn.14006c470
mov qword [rbx + 4], 0
mov rcx, qword [rsp + 0x44]
call fcn.14006c470
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rsi
ret

Function at 0x140069de0
Capabilities:
Delete directory
Delete file

Disassembly:
jmp 0x140069de0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 4]
test rcx, rcx
je 0x140069dff
call fcn.14006c470
mov qword [rbx + 4], 0
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x140069e24
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x140069e1c
call fcn.14006c470
mov qword [rbx + 0x2c], 0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140069e49
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140069e41
call fcn.14006c470
mov qword [rbx + 0x18], 0
add rsp, 0x20
pop rbx
ret