joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff649543600
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x7ff649543622
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x7ff6495436a3
mov rdi, r14
mov rcx, rbx
call fcn.7ff649545b00
test rax, rax
jle 0x7ff649543674
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.7ff64957db70
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x7ff649543693
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [0x7ff6495a9610]
cmp eax, 0xffffffff
je 0x7ff64954369b
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x7ff649543636
sub r14, rdi
jmp 0x7ff649543798
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x7ff6495436ba
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x7ff6495436bc
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x7ff6495436f1
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.7ff64957db70
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x7ff649543795
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x7ff64954372c
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x7ff649543770
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.7ff6495851f4
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x7ff6495437ae
cmp rbp, rax
ja 0x7ff649543740
mov r8, rdi
test rdi, rdi
je 0x7ff649543795
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.7ff6495851f4
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x7ff649543798
Function at 0x7ff649543c10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x7ff649543c40
xor eax, eax
jmp 0x7ff649543d90
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x7ff649543c7a
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x7ff649543c7a
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x7ff649543d90
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x7ff649543d83
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x7ff649543cbd
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x7ff649543ccc
movsx ecx, dil
jmp 0x7ff649543d2a
lea r8, [rsp + 0x50]
mov byte [rsp + 0x60], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x61]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [0x7ff6495a9610]
test eax, eax
js 0x7ff649543d83
cmp eax, 1
jle 0x7ff649543d44
cmp eax, 3
jne 0x7ff649543d83
movsx ecx, byte [rsp + 0x60]
mov rdx, qword [rbx + 0x80]
call fcn.7ff649581850
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x7ff649543d88
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rsi, rax
je 0x7ff649543d71
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rsi
mov edx, 1
call fcn.7ff649584a40
cmp rsi, rax
jne 0x7ff649543d83
lea rax, [rsp + 0x60]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x58], rax
mov eax, edi
jne 0x7ff649543d88
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x7ff649545820
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff649545900
cmp byte [rcx + 0x71], 0
je 0x7ff649545900
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [0x7ff6495a9610]
cmp eax, 0xffffffff
je 0x7ff6495458fc
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x7ff6495a9610]
test eax, eax
je 0x7ff6495458c2
sub eax, 1
je 0x7ff6495458c6
cmp eax, 2
jne 0x7ff6495458fc
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff649578b50
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x7ff6495458f3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.7ff649584a40
cmp rdi, rax
jne 0x7ff6495458fc
cmp byte [rbx + 0x71], 0
sete al
jmp 0x7ff6495458aa
xor al, al
jmp 0x7ff6495458aa
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff649578b50
add rsp, 0x60
pop rbx
ret

Function at 0x7ff649549360
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov rdi, rdx
mov dword [rsp + 0x38], 4
mov rbx, rcx
test rcx, rcx
je 0x7ff6495493d2
test rdx, rdx
je 0x7ff6495493d2
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
je 0x7ff6495493ec
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.7ff6495431b0
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
je 0x7ff649549431
mov rdx, rbx
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.7ff6495431b0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
jmp 0x7ff6495493d2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov al, 1
jmp 0x7ff6495493d4
Function at 0x7ff649549440
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r8
mov dword [rsp + 0x38], 0x206
mov rsi, rdx
mov dword [rsp + 0x40], 3
mov rbp, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, str.sechost.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x7ff6495494ac
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.LoadLibraryEx_with_sechost.dll_failed._Error:__0x_x_
call fcn.7ff6495431b0
xor al, al
jmp 0x7ff6495495ca
lea rdx, str.GetServiceRegistryStateKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x7ff6495494fc
lea r9, [rsp + 0x30]
xor edx, edx
mov r8d, 0x20019
mov rcx, rbp
call qword [0x7ff6495a9610]
test eax, eax
je 0x7ff649549556
mov r8, rbp
lea rcx, str.GetServiceRegistryStateKey_failed__0x_x__handle__p
mov edx, eax
call fcn.7ff6495431b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x7ff6495495ca
lea rcx, str.GetProcAddress_with_GetServiceRegistryStateKey_failed__This_is_windows_RS3_or_lower.
call fcn.7ff6495431b0
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff6495bbc10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
je 0x7ff649549556
mov r8d, eax
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_serviceParameters
lea rcx, str.Registry_read_failure_for__s__RegOpenKeyEx_failed__0x_x__n
call fcn.7ff6495431b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x7ff6495495ca
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
je 0x7ff6495495a9
mov r8d, eax
lea rcx, str.Registry_read_failure_for__S._Error:__0x_x__n
mov rdx, rsi
call fcn.7ff6495431b0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
xor al, al
jmp 0x7ff6495495ca
mov eax, dword [rsp + 0x38]
shr rax, 1
cmp word [rdi + rax*2], 0
je 0x7ff6495495bd
xor ecx, ecx
mov word [rdi + rax*2], cx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff64954a0a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
movzx r9d, r8b
mov r8, rdx
lea rdx, [rbp + 0x17]
call fcn.7ff64954bcc0
nop
movzx r9d, bl
mov r8, rsi
lea rdx, [rbp - 0x29]
call fcn.7ff64954bfe0
nop
xor bl, 1
movzx r9d, bl
mov r8, rsi
lea rdx, [rbp - 9]
call fcn.7ff64954bfe0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rcx, qword [rbp - 0x29]
call fcn.7ff649585e64
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
call fcn.7ff649585e64
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call fcn.7ff649585e8c
mov ebx, eax
mov rdx, rsi
call fcn.7ff64954c300
test ebx, ebx
je 0x7ff64954a167
lea rcx, str.rename_file_failed_n
call fcn.7ff6495431b0
xor bl, bl
jmp 0x7ff64954a19b
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov r8, rsi
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.7ff64954de50
mov rcx, qword [rax]
mov dword [rcx + 0x40], 2
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov bl, 1
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x7ff64954a1db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64954a1d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64954a29d
call fcn.7ff649578b74
xor edi, edi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], 7
mov word [rbp - 9], di
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x7ff64954a229
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64954a224
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64954a2a3
call fcn.7ff649578b74
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], di
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x7ff64954a275
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64954a270
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64954a297
call fcn.7ff649578b74
movzx eax, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff649585708
nop
call fcn.7ff649585708
nop
call fcn.7ff649585708
int3
Function at 0x7ff64955c770
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x1b8], 0xffffffffffffffff
mov rbx, rcx
je 0x7ff64955c8ba
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rbx + 0x1b8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff64955c883
lea rdx, [0x7ff6495aa078]
mov ecx, 0x18
call fcn.7ff6495790e4
mov rdi, rax
test rax, rax
jne 0x7ff64955c81a
lea edx, [rax + 0x18]
lea rcx, str.JHI_memory_allocation_of_size__d_failed_.
call fcn.7ff649543170
lea rcx, str.CS_ClientThreadParams_memory_allocation_failed
call fcn.7ff6495431b0
mov rcx, qword [rbx + 0x10]
lea edx, [rdi + 1]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_ReleaseSemaphore]
jmp 0x7ff64955c873
mov qword [rax], rsi
lea r8, [0x7ff64955c8c0]
mov rax, qword [rbx + 0x18]
mov r9, rdi
mov qword [rdi + 8], rax
xor edx, edx
mov rax, qword [rbx + 0x10]
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov qword [rdi + 0x10], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.DLL_CreateThread]
test rax, rax
jne 0x7ff64955c86a
lea rcx, str.failed_creating_thread_for_client_request_n
call fcn.7ff6495431b0
mov edx, 0x18
mov rcx, rdi
call fcn.7ff649578b74
jmp 0x7ff64955c873
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp qword [rbx + 0x1b8], 0xffffffffffffffff
jne 0x7ff64955c7a0
jmp 0x7ff64955c8ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.accept_failed_with_error:__d_n
call fcn.7ff6495431b0
mov rcx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, qword [rcx]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.DLL_ReleaseSemaphore]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x7ff64955e360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
cmp byte [rcx + 0x10], 0
je 0x7ff64955e396
mov eax, 1
jmp 0x7ff64955e53f
call fcn.7ff64954cc30
mov ebx, dword [rax + 0x5c]
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bp
mov byte [rsp + 0x30], bpl
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.7ff64955dbf0
test al, al
jne 0x7ff64955e3d5
mov ebx, 0x1014
jmp 0x7ff64955e4f7
movzx esi, byte [rsp + 0x30]
cmp ebx, 2
jne 0x7ff64955e3f4
movzx r8d, sil
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.7ff64955e8b0
test eax, eax
je 0x7ff64955e46e
lea rcx, str.Installing_the_Spooler...
call fcn.7ff6495431b0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
movzx r9d, sil
xor r8d, r8d
lea rcx, str.BA8D164350B649CC861D2C01BED14BE8
call fcn.7ff649561830
mov ebx, eax
test eax, eax
je 0x7ff64955e43f
cmp eax, 0x108
je 0x7ff64955e43f
lea rcx, str.failed_downloading_Spooler_Applet_to_DAL_FW_n
call fcn.7ff649543170
jmp 0x7ff64955e44b
lea rcx, str.Spooler_is_installed.
call fcn.7ff6495431b0
test ebx, ebx
jne 0x7ff64955e4f9
movzx r8d, sil
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.7ff64955e8b0
mov ebx, eax
test eax, eax
jne 0x7ff64955e4f7
call fcn.7ff64954cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rsi, qword [rbx + 0x50]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rcx, str.Creating_the_event_listener_thread...
call fcn.7ff6495431b0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x7ff64955d750]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
jne 0x7ff64955e4e9
lea rcx, str.Failed_creating_event_handle_thread_n
call fcn.7ff6495431b0
mov ebx, 0x601
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
mov rax, qword [rax + 0x40]
call qword [0x7ff6495a9610]
jmp 0x7ff64955e4f7
lea rcx, str.Event_listener_thread_created_successfully
call fcn.7ff6495431b0
mov ebx, ebp
test ebx, ebx
sete al
mov byte [rdi + 0x10], al
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x7ff64955e53d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955e538
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e562
call fcn.7ff649578b74
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff649578b50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.7ff649585708
int3
Function at 0x7ff64955ee20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 8], 0
mov rdi, rdx
mov rsi, rcx
je 0x7ff64955ef82
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x30]
and eax, 0xffff02ff
mov qword [rsp + 0x20], 0
or eax, 0x2ff
mov r8d, 4
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x7ff64955ef62
lea rcx, str.Sent_FWU_GET_VERSION_to_HECI._n
call fcn.7ff6495431b0
xor bpl, bpl
mov dword [rsp + 0x30], 0
test rdi, rdi
je 0x7ff64955ef82
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x7ff64955ef82
call fcn.7ff6495489c0
mov rbx, rax
test rax, rax
je 0x7ff64955ef82
movsxd r8, dword [rsi + 0x18]
xor edx, edx
mov rcx, rax
call fcn.7ff64957d8e0
mov r8d, dword [rsi + 0x18]
lea r9, [rsp + 0x30]
mov rcx, qword [rsi + 0x10]
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x7ff64955ef3d
mov edx, dword [rsp + 0x30]
lea rcx, str.Number_bytes_read_from_HECI:__d_n
call fcn.7ff6495431b0
cmp byte [rbx + 3], bpl
je 0x7ff64955ef19
lea rcx, str.Got_error_status_from_HCI_GET_FW_VERSION._n
call fcn.7ff6495431b0
jmp 0x7ff64955ef51
movzx eax, word [rbx + 6]
mov bpl, 1
mov word [rdi], ax
movzx eax, word [rbx + 4]
mov word [rdi + 2], ax
movzx eax, word [rbx + 0xa]
mov word [rdi + 4], ax
movzx eax, word [rbx + 8]
mov word [rdi + 6], ax
jmp 0x7ff64955ef51
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.HeciRead_Error._LastError___d_n
call fcn.7ff6495431b0
mov rcx, rbx
call fcn.7ff6495489f0
test bpl, bpl
je 0x7ff64955ef82
mov al, 1
jmp 0x7ff64955ef84
lea rcx, str.Error:_sending_FWU_GET_VERSION_request_to_HECI_failed._n
call fcn.7ff6495431b0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.error:__d
call fcn.7ff6495431b0
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff649578b50
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff6495623e0
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
lea rcx, [0x7ff6495bed50]
call fcn.7ff649543170
call fcn.7ff64954cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [rbx + 8], 2
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rdx, [0x7ff6495aa078]
mov ecx, 0x10
call fcn.7ff6495790e4
mov rdi, rax
test rax, rax
je 0x7ff649562457
lea rax, vtable.intel_dal::CommandDispatcher.0
mov qword [rdi], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [rdi + 8], rax
jmp 0x7ff649562468
xor edi, edi
lea edx, [rdi + 0x10]
lea rcx, str.JHI_memory_allocation_of_size__d_failed_.
call fcn.7ff649543170
mov ecx, 0x1c0
call fcn.7ff649578e18
mov rsi, rax
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x1c0
mov rcx, rax
call fcn.7ff64957d8e0
lea rax, vtable.intel_dal::ICommandsServer.0
mov qword [rsi], rax
mov ecx, 8
call fcn.7ff649578e18
mov rbx, rax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rbx], rax
xor r9d, r9d
mov edx, 0xa
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov qword [rbx], rax
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rdi
mov byte [rsi + 8], 0xa
lea rax, vtable.intel_dal::CommandsServerSocketsWin32.0
mov qword [rsi], rax
mov qword [rsi + 0x1b8], 0xffffffffffffffff
mov ecx, 0x202
lea rdx, [rsi + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x7ff64956256f
cmp byte [rsi + 0x20], 2
jne 0x7ff6495625a0
cmp byte [rsi + 0x21], 2
jne 0x7ff6495625a0
mov qword [0x7ff6495d1a30], rsi
lea rcx, str.opening_command_server_n
call fcn.7ff6495431b0
mov rcx, qword [0x7ff6495d1a30]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x7ff6495a9610]
test al, al
jne 0x7ff649562551
lea rcx, str.Error:_command_server_has_failed_to_open_a_connection_n
call fcn.7ff649543170
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rcx, str.____jhi_start
call fcn.7ff649543170
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error:__d_n
call fcn.7ff649543170
lea rdx, str.WSAStartup_failed
lea rcx, [rsp + 0x20]
call fcn.7ff649541ff0
lea rdx, [0x7ff6495cbf10]
lea rcx, [rsp + 0x20]
call fcn.7ff64957da70
int3
lea rcx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
call fcn.7ff649543170
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll
lea rcx, [rsp + 0x38]
call fcn.7ff649541ff0
lea rdx, [0x7ff6495cbf10]
lea rcx, [rsp + 0x38]
call fcn.7ff64957da70
int3
Function at 0x7ff6495627b0
Capabilities:
Create mailslot

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0x28], 0
mov r14d, r8d
mov rdi, rdx
mov rbp, rcx
je 0x7ff6495627e5
mov eax, 7
jmp 0x7ff6495628e2
mov qword [rsp + 0xb0], rbx
test rdi, rdi
je 0x7ff649562921
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x7ff649562800
cmp rbx, 0x20
ja 0x7ff649562921
lea r8, str..mailslot_
mov qword [rsp + 0xb8], rsi
mov edx, 0x2e
lea rcx, [rsp + 0x40]
call fcn.7ff64958475c
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x2e
call fcn.7ff64958c68c
test r14d, r14d
jne 0x7ff64956288d
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1a8
call qword [sym.imp.KERNEL32.DLL_CreateMailslotA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff6495628cd
xor eax, eax
lea r8d, [r14 + 4]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea edx, [rax + 6]
call qword [sym.imp.ADVAPI32.DLL_SetSecurityInfo]
jmp 0x7ff6495628c7
cmp r14d, 1
jne 0x7ff64956291a
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rsi, rax
cmp rsi, 0xffffffffffffffff
jne 0x7ff6495628fb
mov eax, 1
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ff649578b50
add rsp, 0x80
pop r14
pop rdi
pop rbp
ret
mov r9, rbx
mov r8, rdi
mov edx, 0x22
mov rcx, rbp
call fcn.7ff64958c5b8
xor eax, eax
mov dword [rbp + 0x30], r14d
mov qword [rbp + 0x28], rsi
jmp 0x7ff6495628d2
mov eax, 0xa
jmp 0x7ff6495628d2
mov eax, 8
jmp 0x7ff6495628da