joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f2c0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ae310
lea rbp, [0x1401277ec]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277f0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.14001f7c0
mov ecx, pe_nt_image_headers64
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x14001f34b
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400ae310
test rbx, rbx
je 0x14001f4a0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x14001f477
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277f0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.14001f7c0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f422
bt eax, 0xa
jae 0x14001f422
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f410
bt eax, 0xa
jae 0x14001f410
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f403
test al, 0x10
je 0x14001f403
lea rcx, [rsp + 0x170]
call fcn.1400d95ec
jmp 0x14001f410
lea rcx, [rsp + 0x170]
call fcn.1400bd14c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ae310
cmp byte [rsp + 0x5c], 0
jne 0x14001f446
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14001f380
cmp byte [rsp + 0x5c], 0
je 0x14001f47e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb838
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb838
cmp byte [rsp + 0x5c], 0
jne 0x14001f4a0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14001f494
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb754
xor eax, eax
jmp 0x14001f4a3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002e770
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ae310
lea rbp, [0x1401277ec]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277f0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.14002e9c0
mov ecx, pe_nt_image_headers64
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x14002e7fb
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400ae310
test rbx, rbx
je 0x14002e950
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x14002e927
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277f0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.14002e9c0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002e8d2
bt eax, 0xa
jae 0x14002e8d2
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002e8c0
bt eax, 0xa
jae 0x14002e8c0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002e8b3
test al, 0x10
je 0x14002e8b3
lea rcx, [rsp + 0x170]
call fcn.1400d95ec
jmp 0x14002e8c0
lea rcx, [rsp + 0x170]
call fcn.1400bd14c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ae310
cmp byte [rsp + 0x5c], 0
jne 0x14002e8f6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14002e830
cmp byte [rsp + 0x5c], 0
je 0x14002e92e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb838
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb838
cmp byte [rsp + 0x5c], 0
jne 0x14002e950
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14002e944
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb754
xor eax, eax
jmp 0x14002e953
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140038090
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x60
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8, rdx
mov rbx, rcx
test rdx, rdx
jne 0x14003811f
cmp dword [0x140213620], 1
jl 0x1400382a1
test dword [0x140213654], 0x200000
je 0x1400382a1
lea rax, str.logstring_is_NULL
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
lea r8, str.EsifLogMgr_DataLogWrite
mov dword [rsp + 0x20], 0xb85
mov ecx, 0x200000
call fcn.140079050
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x60
pop rbx
ret
mov eax, dword [rcx + 0x17c]
test eax, eax
je 0x1400382a1
mov qword [rsp + 0x58], rbp
xor ebp, ebp
test al, 8
jbe 0x140038162
cmp byte [rcx + 0x70], bpl
je 0x140038147
test byte [rcx + 0x180], 8
jne 0x140038162
lea rdx, [rsp + 0x80]
mov rcx, r8
call fcn.140012720
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x78]
test al, 4
jbe 0x140038199
cmp byte [rbx + 0x70], bpl
je 0x140038175
test byte [rbx + 0x180], 4
jne 0x140038199
lea r9, [rsp + 0x80]
mov ecx, 5
lea rdx, [0x140131208]
call fcn.140012d30
mov eax, dword [rbx + 0x17c]
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdi
test al, 2
jbe 0x14003821a
cmp byte [rbx + 0x70], bpl
je 0x1400381b1
test byte [rbx + 0x180], 2
jne 0x14003821a
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x50], rsi
mov rcx, r8
call fcn.14003dd30
inc eax
movsxd rsi, eax
mov rcx, rsi
call fcn.14003dd80
mov rdi, rax
test rax, rax
je 0x140038210
mov r9, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call fcn.1400160e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.1400bb754
mov r8, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x50]
test byte [rbx + 0x17c], 1
jbe 0x140038297
cmp byte [rbx + 0x70], bpl
je 0x140038232
test byte [rbx + 0x180], 1
jne 0x140038297
lea rdx, [rsp + 0x80]
mov rcx, r8
call fcn.14003dd30
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.14003dd80
mov rbx, rax
test rax, rax
je 0x140038297
mov r9, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call fcn.1400160e0
mov r8, rbx
lea rdx, [0x14012ee2c]
mov ecx, 3
call fcn.1400a3790
mov rcx, rbx
call fcn.1400bb754
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x60
pop rbx
ret
Function at 0x14003bd20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ebp, ebp
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rcx, qword [rsi + 8]
call fcn.140002400
test eax, eax
lea rcx, [rsi + 0x10]
setne bl
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test bl, bl
je 0x14003be4a
cmp byte [rsi + 0x71], bpl
jne 0x14003be00
mov word [rsi + 0x71], 1
cmp byte [rsi + 0x73], bpl
jne 0x14003bd83
mov dword [rsi + 0x180], ebp
mov byte [rsi + 0x70], 1
lea rcx, [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor r9d, r9d
mov qword [rsi + 0x40], rbp
xor edx, edx
mov dword [rsi + 0x48], ebp
xor ecx, ecx
mov r8d, 0x7fffffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov ecx, 0x10
mov dword [rsi + 0x50], ebp
mov qword [rsi + 0x58], rax
mov byte [rsi + 0x4c], bpl
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x14003be00
lea rax, [0x14003afc0]
mov qword [rsp + 0x28], rbp
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x14003eab0]
mov qword [rbx + 8], rsi
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x30], rax
test rax, rax
jne 0x14003be00
mov rcx, rbx
call fcn.1400bb754
cmp dword [0x140213620], 3
jl 0x14003be46
test dword [0x140213684], 0x200000
je 0x14003be46
lea rcx, str.Participant_logging_started
mov edx, 3
mov qword [rsp + 0x28], rcx
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
mov ecx, 0x200000
mov dword [rsp + 0x20], 0x481
lea r8, str.EsifLogMgr_StartLoggingIfRequired
call fcn.140079050
mov eax, ebp
jmp 0x14003be95
cmp dword [0x140213620], 1
jl 0x14003be90
test dword [0x140213654], 0x200000
je 0x14003be90
lea rax, str.Error_:_No_Data_to_Log
mov edx, 1
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourcesesif_uf_loggingmgr.c
lea r8, str.EsifLogMgr_StartLoggingIfRequired
mov dword [rsp + 0x20], 0x47c
mov ecx, 0x200000
call fcn.140079050
mov eax, 0x3ea
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003eae0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x140209c50]
xor edi, edi
cmp ecx, 0x1f4
cmovge eax, ecx
xor bl, bl
mov dword [0x140209c50], eax
nop dword [rax + rax]
lea rcx, [0x14021e538]
call fcn.140041ca0
movzx ecx, bl
call fcn.14003ffc0
mov rsi, rax
nop word [rax + rax]
mov eax, 1
xchg qword [0x14021e540], rax
cmp rax, 1
je 0x14003eb30
add dword [0x14021e548], 0xffffffff
mov rax, rdi
xchg qword [0x14021e540], rax
jne 0x14003eb62
lea rcx, [0x14021e538]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
test rsi, rsi
je 0x14003eb77
mov rcx, rsi
call fcn.140072fd0
mov rcx, rsi
call fcn.140072950
inc bl
cmp bl, 0x20
jb 0x14003eb10
mov rax, rdi
lock xadd qword [0x140209c48], rax
test al, al
je 0x14003ebfb
mov ecx, 0x10
call fcn.1400bb768
mov rbx, rax
test rax, rax
jne 0x14003ebb7
mov edi, 0x708
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rax, [0x14003ed30]
mov qword [rsp + 0x28], rdi
mov r9, rbx
mov qword [rbx], rax
lea r8, [0x1400427d0]
mov qword [rbx + 8], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14021e550], rax
test rax, rax
jne 0x14003ebfb
mov rcx, rbx
call fcn.1400bb754
mov edi, 0x3eb
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140064630
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ae310
lea rbp, [0x1401277ec]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277f0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.140064d60
mov ecx, pe_nt_image_headers64
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x1400646bb
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400ae310
test rbx, rbx
je 0x140064810
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400647e7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277f0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140064d60
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140064792
bt eax, 0xa
jae 0x140064792
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140064780
bt eax, 0xa
jae 0x140064780
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140064773
test al, 0x10
je 0x140064773
lea rcx, [rsp + 0x170]
call fcn.1400d95ec
jmp 0x140064780
lea rcx, [rsp + 0x170]
call fcn.1400bd14c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ae310
cmp byte [rsp + 0x5c], 0
jne 0x1400647b6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400646f0
cmp byte [rsp + 0x5c], 0
je 0x1400647ee
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400bb838
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400bb838
cmp byte [rsp + 0x5c], 0
jne 0x140064810
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140064804
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bb754
xor eax, eax
jmp 0x140064813
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140064840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, r8
mov rbx, rcx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400ae310
test rbx, rbx
je 0x14006497f
xor edx, edx
lea rcx, [rsp + 0x170]
mov r8d, 0x104
call fcn.1400ae310
lea rsi, [0x1401277ec]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x1400649a7
lea rax, [rsp + 0x5c]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rbx + 8]
lea r8, [0x1401277f0]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x170]
call fcn.140064d60
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006495b
bt eax, 0xa
jae 0x14006495b
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140064949
bt eax, 0xa
jae 0x140064949
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006493c
test al, 0x10
je 0x14006493c
lea rcx, [rsp + 0x170]
call fcn.1400d95ec
jmp 0x140064949
lea rcx, [rsp + 0x170]
call fcn.1400bd14c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ae310
cmp byte [rsp + 0x5c], 0
je 0x1400648a1
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rdi
call fcn.1400bb838
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ac830
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test eax, eax
jne 0x140064966
xor eax, eax
jmp 0x140064982

Function at 0x1400649b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140064a08
bt eax, 0xa
jae 0x140064a08
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400649f5
test al, 0x10
je 0x1400649f5
mov rcx, rbx
call fcn.1400d95ec
jmp 0x1400649fd
mov rcx, rbx
call fcn.1400bd14c
test eax, eax
je 0x140064a08
mov ecx, 0x1f
jmp 0x140064a17
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d90a4
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x60
pop rbx
ret
Function at 0x140064a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140064ab6
bt eax, 0xa
jae 0x140064ab6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140064a98
test al, 0x10
je 0x140064a98
mov rcx, rdi
call fcn.1400d95ec
jmp 0x140064aa0
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
je 0x140064ab6
test rbx, rbx
je 0x140064aaf
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x140064b5e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400bb838
lea rdx, [0x140128068]
mov rcx, rsi
call fcn.1400da990
test rax, rax
je 0x140064b37
mov edx, 0x63
mov rcx, rsi
call fcn.1400ae4b0
test rax, rax
jne 0x140064b37
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400d5db8
cmp rax, 0x20
jne 0x140064b1b
mov byte [rsp + 0x47], bpl
jmp 0x140064b37
mov r9, 0xffffffffffffffff
lea r8, [0x14012806c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400ecb38
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ecf08
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x140064b5b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ae40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.1400ae310
lea rax, [0x140127970]
mov edx, 0x104
lea rdi, [0x1401287e8]
mov qword [rsp + 0x20], rax
lea r9, str.override
mov r8d, 2
lea rcx, [rsp + 0xa0]
mov rsi, rdi
call fcn.140013c70
lea rcx, str.gddv
call fcn.140003d40
mov rbx, rax
test rax, rax
je 0x14006af0f
mov rcx, rax
call fcn.140064c40
cmp byte [rbx + 0x49], 0
lea rcx, [rbx + 0x49]
cmovne rsi, rcx
nop
mov eax, 1
xchg qword [rbx + 8], rax
cmp rax, 1
je 0x14006aee0
add dword [rbx + 0x10], 0xffffffff
mov eax, 0
xchg qword [rbx + 8], rax
jne 0x14006af07
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov rcx, rbx
call fcn.140008890
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
lea r8, [0x140129dec]
mov r9b, 0xff
mov qword [rsp + 0x20], 0
mov edx, 0x221
mov qword [rsp + 0x54], 0
mov ecx, 1
mov dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x60], 0
call fcn.140042800
mov ebx, eax
test eax, eax
jne 0x14006af74
mov rax, qword [rsp + 0x54]
test rax, rax
je 0x14006af74
cmp dword [rsp + 0x60], ebx
cmovne rdi, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006afcb
bt eax, 0xa
jae 0x14006afcb
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006afb3
test al, 0x10
je 0x14006afb3
lea rcx, [rsp + 0xa0]
call fcn.1400d95ec
jmp 0x14006afc0
lea rcx, [rsp + 0xa0]
call fcn.1400bd14c
test eax, eax
je 0x14006afcb
mov eax, 0x1f
jmp 0x14006afdd
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.1400d90a4
test eax, eax
mov qword [rsp + 0x40], rsi
mov rax, qword [0x14020bbc8]
lea r8, str.false
mov qword [rsp + 0x38], rdi
lea rdx, str.true
cmovne rdx, r8
lea r9, [0x14020bbd0]
mov qword [rsp + 0x30], rdx
lea r8, [0x14012ee08]
mov qword [rsp + 0x28], rax
lea rdx, str._about__n___ufVersion__s__ufVersion__n___lfVersion__s__lfVersion__n___osType__s__osType__n___shellVersion__s__shellVersion__n___overrideDvExistsOnDisk__s__overrideDvExistsOnDisk__n___currentGddvDescription__s__currentGddvDescription__n___currentCacheDescription__s__currentCacheDescription__n__about__n_n
lea rax, [0x140227e60]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140069e80
test eax, eax
mov ecx, 0xbba
cmovle ebx, ecx
mov rcx, qword [rsp + 0x54]
test rcx, rcx
je 0x14006b04e
call fcn.1400bb754
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400ac830
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140086340
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [0x140213620], 4
mov rbx, rcx
jl 0x14008638f
test dword [0x14021369c], 0x40000
je 0x14008638f
lea rax, str.Starting_thread__n
mov edx, 4
mov qword [rsp + 0x28], rax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
lea r8, str.CStateChangeDetection::StartThread
mov dword [rsp + 0x20], 0x5e
mov ecx, 0x40000
call fcn.140079050
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x140023ef7.0]
xor r9d, r9d
mov dword [rbx + 0x14], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400863ca
mov eax, 0x80004005
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x28], 0
lea r8, [0x1400865b0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x1400863bf
cmp dword [0x140213620], 4
jl 0x14008644b
test dword [0x14021369c], 0x40000
je 0x14008644b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov dword [rsp + 0x30], eax
lea r10, str.Thread_ID___d_n
mov qword [rsp + 0x28], r10
mov edx, 4
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswincem_cstatechangedetection.cpp
mov dword [rsp + 0x20], 0x75
lea r8, str.CStateChangeDetection::StartThread
mov ecx, 0x40000
call fcn.140079050
xor eax, eax
add rsp, 0x40
pop rbx
ret