joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bb3e0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, r8
mov rbx, rdx
mov qword [rbp - 0x59], rdx
xor edi, edi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov rax, r8
cmp qword [r8 + 0x18], 7
jbe 0x1400bb423
mov rax, qword [r8]
mov qword [r8 + 0x10], rdi
mov word [rax], di
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400bb5a0
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400bb482
xor edx, edx
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400bb5a0
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400bb48f
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
add r8d, r8d
xor r9d, r9d
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400bb589
mov dword [rbp - 0x41], reloc.WS2_32.dll_sendto
mov dword [rsp + 0x20], edi
lea r9, [rbp - 0x41]
lea r8, [rbp + 0x27]
mov edx, 2
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400bb589
mov r9d, dword [rbp - 0x41]
cmp r9d, 0x14
ja 0x1400bb589
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov word [rbp + 0x17], ax
test r9d, r9d
je 0x1400bb544
lea r10, [rbp + 0x27]
lea r11, str.0123456789abcdef
movzx r8d, byte [r10]
lea edx, [rdi + rdi]
mov eax, r8d
shr rax, 4
movzx eax, word [r11 + rax*2]
mov word [rbp + rdx*2 - 0x39], ax
and r8d, 0xf
lea ecx, [rdx + 1]
movzx eax, word [r11 + r8*2]
mov word [rbp + rcx*2 - 0x39], ax
inc edi
lea r10, [r10 + 1]
cmp edi, r9d
jb 0x1400bb510
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rax, [rbp - 0x39]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400bb565
lea rdx, [rbp - 0x39]
mov rcx, rsi
call fcn.140031b60
nop
mov rcx, rbx
call fcn.1400166f0
mov al, 1
jmp 0x1400bb5aa
xor edx, edx
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
nop
mov rcx, rbx
call fcn.1400166f0
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bb9f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov dword [rsp + 0x40], 7
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov dword [rsp + 0x30], edi
mov rax, rdx
jbe 0x1400bba27
mov rax, qword [rdx]
mov qword [rdx + 0x10], rdi
mov r9d, 0x101
mov word [rax], di
lea rdx, str.SoftwareMicrosoftCryptography
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400bbaf2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.MachineGuid
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400bbae7
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400bbae7
mov ecx, eax
call fcn.1402bb024
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rdi, rax
lea rdx, str.MachineGuid
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400bbadf
mov r8d, dword [rsp + 0x30]
mov rdx, rdi
shr r8, 1
mov rcx, rbx
dec r8
call fcn.140031b60
mov rcx, rdi
call fcn.1402ba9fc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400bbb10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov dword [rbp - 0x30], 7
xor esi, esi
mov dword [rbp - 0x40], esi
mov rax, rdx
cmp qword [rdx + 0x18], 7
jbe 0x1400bbb51
mov rax, qword [rdx]
mov qword [rdx + 0x10], rsi
mov word [rax], si
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.HardwareDescriptionSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400bbcea
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosVersion
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400bbc05
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400bbc05
mov ecx, eax
call fcn.1402bb024
mov rdi, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosVersion
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400bbbfd
mov r8d, dword [rbp - 0x40]
shr r8, 1
mov rdx, rdi
mov rcx, rbx
call fcn.140031b60
mov rcx, rdi
call fcn.1402ba9fc
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1400bbc19
mov rcx, qword [rbx]
lea rax, [rcx + rax*2]
jmp 0x1400bbc20
lea rax, [rbx + rax*2]
mov rcx, rbx
cmp rcx, rax
je 0x1400bbc38
cmp word [rcx], si
jne 0x1400bbc2f
mov word [rcx], 0x3a
add rcx, 2
cmp rcx, rax
jne 0x1400bbc25
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400bbce0
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400bbce0
mov ecx, eax
call fcn.1402bb024
mov rdi, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400bbcd8
mov r8d, dword [rbp - 0x40]
shr r8, 1
dec r8
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14002ebe0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rbx
call fcn.14002be20
nop
lea rcx, [rbp - 0x28]
call fcn.1400166f0
mov rcx, rdi
call fcn.1402ba9fc
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402ba9b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400bcd20
Capabilities:
Get mac address on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, rdx
mov qword [rsp + 0x58], rdx
xor ebp, ebp
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x40], eax
call fcn.14009ec20
test al, al
jne 0x1400bceec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xc0], eax
mov qword [rsp + 0x68], rbp
mov ecx, 0x16027
call fcn.1402baa0c
test rax, rax
je 0x1400bcf58
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x60], rcx
lea rbx, [rcx + 0x16000]
mov qword [rsp + 0x70], rbx
xor edx, edx
mov r8d, 0x16000
call fcn.14030b3a0
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x60]
sub rbx, rcx
movabs rax, 0x2e8ba2e8ba2e8ba3
imul rbx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x2c0
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x58]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400bcee0
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
lea edi, [rbp + 0x12]
cmp dword [rbx + 0x1a0], eax
jae 0x1400bce8b
movzx eax, byte [rbx + 0x19d]
movzx ecx, byte [rbx + 0x19c]
movzx edx, byte [rbx + 0x19b]
movzx r8d, byte [rbx + 0x19a]
movzx r10d, byte [rbx + 0x199]
movzx r9d, byte [rbx + 0x198]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
lea r8, str._02X:_02X:_02X:_02X:_02X:_02X
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1400b13b0
mov eax, dword [rbx + 0x1a0]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400bce23
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0xa0]
lea rax, [rsp + 0x78]
sub rdx, rax
nop dword [rax + rax]
lea rax, [rdi + 0x7fffffec]
test rax, rax
je 0x1400bced2
movzx eax, word [rdx + rcx]
test ax, ax
je 0x1400bced2
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x1400bceb0
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], bp
lea rcx, [rsp + 0x60]
call fcn.1400bff00
jmp 0x1400bcf1f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
mov dword [rsp + 0x58], eax
cmp eax, 1
jbe 0x1400bcf08
cmp eax, 0x80010106
jne 0x1400bcf13
lea rdx, [rsp + 0x78]
call fcn.1400bcf60
nop
cmp ebx, 1
ja 0x1400bcf1f
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140031ed0
mov rax, rsi
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1402ba9b0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1402caabc
int3
Function at 0x1400c0820
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdx], xmm0
mov rbx, rcx
movups xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x20], eax
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x1400c08c9
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400c097c
cmp qword [rbx + 0x40], 7
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
lea rax, [rbx + 0x28]
jbe 0x1400c0871
mov rax, qword [rax]
add rbx, 8
cmp qword [rbx + 0x18], 7
jbe 0x1400c087f
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rax
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWindowsService.cpp
lea rax, str.Invalid_service_handle_for__ls
mov r9d, 0xe4
mov qword [rsp + 0x30], rax
lea rdx, str.mb::common::system::WindowsService::QueryStatusEx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 2
call r10
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x50], eax
mov r8, rdx
lea rax, [rsp + 0x50]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400c0991
mov qword [rsp + 0x88], rdi
mov rdi, qword [rbx]
test rdi, rdi
je 0x1400c0974
mov rax, qword [rdi]
mov qword [rsp + 0x80], rsi
mov rsi, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x40], 7
lea rdx, [rbx + 0x28]
jbe 0x1400c0923
mov rdx, qword [rdx]
add rbx, 8
cmp qword [rbx + 0x18], 7
jbe 0x1400c0931
mov rbx, qword [rbx]
mov dword [rsp + 0x40], eax
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWindowsService.cpp
mov qword [rsp + 0x38], rdx
lea rax, str.QueryServiceStatusEx_failed_on__1s.__Error__u.
mov qword [rsp + 0x30], rax
lea rdx, str.mb::common::system::WindowsService::QueryStatusEx
mov qword [rsp + 0x28], rbx
mov r9d, 0xec
mov rcx, rdi
mov dword [rsp + 0x20], 2
call rsi
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x60
pop rbx
ret
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x60
pop rbx
ret

Function at 0x1400c1280
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.14030b3a0
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400c12e6
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
jmp 0x1400c12f6
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002ebe0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1400ca020
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, r9d
mov r14d, r8d
mov r15, rdx
mov ebp, ecx
mov rsi, qword [rsp + 0xc0]
xor r9d, r9d
lea rcx, str.SeDebugPrivilege
call fcn.1400ca170
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov r8d, ebp
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rax, vtable.mb::common::system::ScopedAny_void____ptr64__int____cdecl___void____ptr64___int___cdecl_CloseHandle_void____ptr64___2__0__0_.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
lea rcx, [rdi + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400ca0f1
test rsi, rsi
je 0x1400ca0ed
mov rdx, qword [rsi]
mov rbx, qword [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ebp
lea rax, str.Unable_to_open_process_PID:__u_Error:__u
mov qword [rsp + 0x30], rax
lea rax, str.DebugUtils
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 0x1c3
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonDebugUtils.cpp
lea rdx, str.mb::common::debug::DebugUtils::DumpTargetProcess
mov rcx, rsi
call rbx
xor bl, bl
jmp 0x1400ca10d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], ebx
mov r9d, r14d
mov r8, r15
mov edx, ebp
mov rcx, rdi
call fcn.1400c9570
movzx ebx, al
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400ca120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d2b60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r9
mov edi, r8d
mov rsi, qword [rsp + 0xe0]
xor eax, eax
test rdx, rdx
je 0x1400d2c66
test r8d, r8d
je 0x1400d2c66
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400d2bbe
cmp dword [rsp + 0x60], edi
je 0x1400d2ca8
test rbx, rbx
je 0x1400d2c62
mov rax, qword [rbx]
mov rbp, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rsi, rsi
je 0x1400d2bdd
mov dword [rsi], edi
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.1400f0ee0
nop
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400a7e10
nop
lea rcx, [rsp + 0x68]
call fcn.1400166f0
nop
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, str.Error_writting_to_file_:__s
mov qword [rsp + 0x30], rax
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xbb
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonFileStreamUtils_Win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call rbp
nop
lea rcx, [rsp + 0x40]
call fcn.1400166f0
xor al, al
jmp 0x1400d2caa
test rbx, rbx
je 0x1400d2ca8
mov rax, qword [r9]
lea rcx, str.Skipping_writting_zero_byte_buffer__this_may_be_an_empty_file_
mov qword [rsp + 0x30], rcx
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, VariantTimeToSystemTime
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonFileStreamUtils_Win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call qword [rax + 0x20]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400ea2f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x28], rdx
movzx ecx, r8w
mov rbx, rdx
xor esi, esi
call fcn.1402da054
movzx r8d, ax
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx edx, r8b
xor rdx, rax
mov eax, r8d
imul rdx, rcx
shr rax, 8
xor rdx, rax
mov rax, qword [rdi + 0x1c8]
imul rdx, rcx
mov rcx, qword [rdi + 0x1e0]
and rcx, rdx
shl rcx, 4
add rax, rcx
mov rcx, qword [rdi + 0x1b8]
mov rdx, qword [rax + 8]
cmp rdx, rcx
je 0x1400ea38a
mov rax, qword [rax]
cmp r8w, word [rdx + 0x10]
je 0x1400ea38d
cmp rdx, rax
je 0x1400ea38a
mov rdx, qword [rdx + 8]
cmp r8w, word [rdx + 0x10]
jne 0x1400ea378
jmp 0x1400ea38d
mov rdx, rsi
test rdx, rdx
cmove rdx, rcx
cmp rdx, rcx
je 0x1400ea3b8
add rdx, 0x18
mov rcx, rbx
call fcn.140031cb0
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400efe30
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400effcc
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400b68d0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400eff95
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx r9d, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r9, rbp
mov r11, qword [rsi + 0x30]
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1400eff0a
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400eff84
mov rdx, qword [r11 + 8]
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x1400eff49
mov r10, qword [rdx]
cmp r10, rax
je 0x1400eff43
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400eff84
cmp r8, rdx
je 0x1400eff60
nop
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x1400effa6
cmp r8, rdx
jne 0x1400eff50
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400efed0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400eff84
lea rcx, str.invalid_hash_bucket_count
call fcn.1402b9430
int3
Function at 0x1400f3ff0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rdx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400f4037
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400f4037
xor al, al
jmp 0x1400f4047
mov ecx, dword [rsp + 0x20]
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f4360
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r9
mov eax, r8d
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov r8d, 0x400000
cmp eax, r8d
cmovbe r8d, eax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
test rdi, rdi
je 0x1400f43b2
mov ecx, dword [rsp + 0x30]
mov dword [rdi], ecx
test eax, eax
je 0x1400f43ba
xor eax, eax
jmp 0x1400f43f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400f43de
mov r8, qword [rcx]
mov r9, qword [r8]
mov r8d, eax
mov rdx, qword [rbx + 0x80]
call r9
jmp 0x1400f43f3
test eax, eax
jne 0x1400f43e9
mov eax, 0x80004005
jmp 0x1400f43f3
jle 0x1400f43f3
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x1400f4920
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r9
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
xor r15d, r15d
mov esi, r15d
mov r12d, 0x400000
nop word [rax + rax]
mov r8d, ebx
cmp ebx, r12d
cmova r8d, r12d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
mov rdx, rdi
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov ecx, dword [rsp + 0x30]
add esi, ecx
test eax, eax
je 0x1400f49a0
test ecx, ecx
je 0x1400f499c
add rdi, rcx
sub ebx, ecx
jne 0x1400f4960
mov al, 1
jmp 0x1400f49a2
xor al, al
mov ecx, esi
add qword [rbp + 0x20], rcx
test r14, r14
je 0x1400f49b0
mov dword [r14], esi
test al, al
je 0x1400f49b9
mov eax, r15d
jmp 0x1400f49d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400f49ca
mov eax, 0x80004005
jmp 0x1400f49d4
jle 0x1400f49d4
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f5e50
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400c0c30
cmp qword [rax + 0x18], 7
jbe 0x1400f5e6d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.1400166f0
mov eax, ebx
add rsp, 0x40
pop rbx
ret