joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023c5d8
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x10]
test rax, rax
jne 0x14023c61d
call fcn.140298678
mov rax, qword [rdi + 0x10]
test rax, rax
jne 0x14023c61d
and qword [rbx], rax
and qword [rbx + 8], rax
and qword [rbx + 0x10], rax
jmp 0x14023c6bd
and dword [rsp + 0x78], 0
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14023c62f
mov rcx, qword [rdi]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x14023c6d2
mov edx, dword [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.140073a64
nop
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x14023c675
mov rdi, qword [rdi]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x48]
mov r9, rsi
mov r8d, 1
mov edx, eax
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x14023c711
mov qword [rbx], rsi
mov rax, qword [rsp + 0x50]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x10], rax
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140045e78
mov r9d, eax
mov rcx, qword [rsp + 0x68]
lea rax, str.CertificateUtils::ConvertBase64StringToByteArray_failed_to_calculate_needed_size_of_converted_message
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificateutils.cpp
mov edx, 0x2e
call fcn.14004a5c0
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140045e78
mov r9d, eax
mov rcx, qword [rsp + 0x68]
lea rax, str.CertificateUtils::ConvertBase64StringToByteArray_failed_conversion
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificateutils.cpp
mov edx, 0x3d
call fcn.14004a5c0
int3
Function at 0x14023d21c
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov r15d, r9d
mov rsi, r8
mov r14, rdx
mov r12, rcx
and qword [rbp + 0x40], 0
and qword [rbp + 0x50], 0
and qword [rbp + 0x48], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, DispGetParam
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptAcquireContextW]
test eax, eax
setne al
mov rcx, qword [rbp + 0x38]
lea rdx, str.Acquiring_cryptographic_provider_failed
mov qword [rsp + 0x20], rdx
movzx r9d, al
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificate.cpp
mov edx, 0xab
call fcn.14005f650
mov rdi, qword [rbp + 0x40]
test rdi, rdi
je 0x14023d2ba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptDestroyHash]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
and qword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptCreateHash]
test eax, eax
setne al
mov rcx, qword [rbp + 0x38]
lea rdx, str.Creating_hash_object_failed
mov qword [rsp + 0x20], rdx
movzx r9d, al
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificate.cpp
mov edx, 0xb6
call fcn.14005f650
mov r8, qword [r14 + 8]
sub r8, qword [r14]
xor r9d, r9d
mov rdx, qword [r14]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptHashData]
test eax, eax
setne al
mov rcx, qword [rbp + 0x38]
lea rdx, str.Computing_hash_object_failed
mov qword [rsp + 0x20], rdx
movzx r9d, al
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificate.cpp
mov edx, 0xbe
call fcn.14005f650
mov rax, qword [r12]
mov r8, qword [rax + 0x18]
add r8, 0x60
lea r9, [rbp + 0x50]
mov edx, 0x10001
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
setne al
mov rcx, qword [rbp + 0x38]
lea rdx, str.Importing_pubic_key_failed
mov qword [rsp + 0x20], rdx
movzx r9d, al
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificate.cpp
mov edx, 0xc7
call fcn.14005f650
mov r8, qword [rsi + 8]
sub r8, qword [rsi]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x50]
mov rdx, qword [rsi]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptVerifySignatureW]
cmp eax, 1
sete bl
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14023d3c8
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptDestroyHash]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14023d3d9
xor edx, edx
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptReleaseContext]
mov al, bl
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140249ed0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp - 8], rax
mov sil, dl
lea rcx, [rbp - 0x28]
lea rdx, str.Sense
call fcn.14004a9e4
and qword [rbp - 0x38], 0
lea rdx, [rbp - 0x28]
mov r8d, 3
lea rcx, [rbp - 0x38]
call fcn.1402a63f4
mov edi, eax
test eax, eax
jns 0x140249f75
cmp qword [rbp - 0x10], 8
lea rax, [rbp - 0x28]
mov rcx, qword [rbp + 8]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
cmovae rax, qword [rbp - 0x28]
mov r9d, edi
mov qword [rsp + 0x28], rax
mov edx, 0x1ea
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
call fcn.14016b7bc
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14024a03f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x14024a03f
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x40]
mov rcx, rbx
lea edx, [r9 - 1]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfig2W]
test eax, eax
jne 0x140249fd8
cmp qword [rbp - 0x10], 8
lea rax, [rbp - 0x28]
mov rcx, qword [rbp + 8]
lea r9, str.Failed_to_query_the_service__ws_delayed_auto_start_info.
cmovae rax, qword [rbp - 0x28]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x1ef
mov qword [rsp + 0x20], rax
call fcn.1401ea930
mov edi, eax
test rbx, rbx
je 0x14024a03f
mov rcx, rbx
jmp 0x140249f6a
movzx edi, sil
cmp dword [rbp - 0x40], edi
je 0x14024a02f
lea r8, [rbp - 0x40]
mov dword [rbp - 0x40], edi
mov edx, 3
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14024a02f
cmp qword [rbp - 0x10], 8
lea rax, [rbp - 0x28]
mov rcx, qword [rbp + 8]
lea r9, str.Failed_to_change_the_service__ws_start_type_to_delayed_auto_start__d.
cmovae rax, qword [rbp - 0x28]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov dword [rsp + 0x28], edi
mov edx, 0x1f6
mov qword [rsp + 0x20], rax
call fcn.1401ea930
jmp 0x140249fcc
test rbx, rbx
je 0x14024a03d
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
xor edi, edi
lea rcx, [rbp - 0x28]
call fcn.14004b500
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14024a070
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 9], 0
lea rsi, str.Sense
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.14004a9e4
mov r8d, 4
lea rdx, [rbp + 7]
lea rcx, [rbp - 9]
call fcn.1402a63f4
mov edi, eax
lea rcx, [rbp + 7]
call fcn.14004b500
test edi, edi
jns 0x14024a11d
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rsi
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.amcorewcd_sourceonboardingonboardingmanager_senseservicesettings.cpp
mov edx, 0x43
call fcn.14016b7bc
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14024a1a3
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x14024a1a3
lea rdx, [rbp + 0x27]
mov rbx, qword [rbp - 9]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x14024a15d
lea r9, str.Cannot_query_service_status_for_service__ws
lea edx, [rax + 0x49]
lea r8, str.amcorewcd_sourceonboardingonboardingmanager_senseservicesettings.cpp
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x5f]
call fcn.1401ea930
mov edi, eax
test rbx, rbx
je 0x14024a1a3
mov rcx, rbx
jmp 0x14024a112
or dword [rbp + 0x2f], 1
mov rcx, qword [0x14044f4c8]
test rcx, rcx
jne 0x14024a179
call fcn.140298678
mov rcx, qword [0x14044f4c8]
lea rdx, [rbp + 0x27]
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x14024a193
lea r9, str.Cannot_set_service_status_for_service__ws
lea edx, [rax + 0x51]
jmp 0x14024a13c
test rbx, rbx
je 0x14024a1a1
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
xor edi, edi
test edi, edi
jns 0x14024a1ab
mov eax, edi
jmp 0x14024a1cd
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.14004a9e4
lea rcx, [rbp + 7]
call fcn.1402a6768
mov ebx, eax
lea rcx, [rbp + 7]
call fcn.14004b500
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14024a200
Capabilities:
Modify service

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 8], rdi
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rdx, [0x14030cae0]
lea rcx, [rbp + 0x27]
call fcn.14004a9e4
nop
lea rdx, str.Sense
lea rcx, [rbp - 0x19]
call fcn.14004a9e4
and qword [rbp - 0x29], 0
mov r8d, 2
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.1402a63f4
mov edi, eax
test eax, eax
jns 0x14024a2b7
lea rax, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rax, qword [rbp - 0x19]
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x1cf
call fcn.14016b7bc
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14024a38e
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x14024a38e
xor r8d, r8d
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.14007b96c
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r9d, edx
mov r8d, edx
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14024a372
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, str.Cannot_add_the_dependency_on__ws_to_service__ws
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x1e0
call fcn.1401ea930
mov edi, eax
lea rcx, [rbp + 7]
call fcn.14004b500
cmp qword [rbp - 0x29], 0
je 0x14024a38e
mov rcx, qword [rbp - 0x29]
jmp 0x14024a2ac
lea rcx, [rbp + 7]
call fcn.14004b500
cmp qword [rbp - 0x29], 0
je 0x14024a38c
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
xor edi, edi
lea rcx, [rbp - 0x19]
call fcn.14004b500
nop
lea rcx, [rbp + 0x27]
call fcn.14004b500
mov eax, edi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402ae860
mov rdi, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret
Function at 0x1402522a8
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140252372
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x140252369
and dword [rsp + 0x6c], 0
lea rax, [rsp + 0x30]
and dword [rsp + 0x7c], 0
mov edx, 4
mov qword [rsp + 0x60], rax
lea rax, str.DataCollection_adapter_failed_to_read_Windows_Directory
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x78], WSACleanup
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x1403a1173]
call fcn.140001158
lea rdx, [0x14030cae0]
jmp 0x140252376
lea rdx, [rbp - 0x80]
lea rcx, [0x1404666f8]
call fcn.14004a9e4
lea rax, [0x1404666f8]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0x2a0
pop rbp
ret

Function at 0x1402523a4
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
jne 0x140252476
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x34], ecx
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x14025246d
and dword [rsp + 0x6c], 0
lea rax, [rsp + 0x34]
and dword [rsp + 0x7c], 0
mov edx, 4
mov qword [rsp + 0x60], rax
lea rax, str.DataCollection_adapter_failed_to_read_Profiles_Directory
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x78], WSACleanup
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x1403a1173]
call fcn.140001158
lea rdx, [0x14030cae0]
jmp 0x14025247a
lea rdx, [rbp - 0x80]
lea rcx, [0x140466718]
call fcn.14004a9e4
lea rax, [0x140466718]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0x2a0
pop rbp
ret
Function at 0x140258fac
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov esi, r9d
mov rbx, r8
mov rdi, rdx
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x14025901e
and dword [rbp + 3], 0
lea rax, str.Waiting_for_Incident_response_process_to_become_ready
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x6c
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a1992]
xor r8d, r8d
mov dword [rsp + 0x20], 3
call fcn.140001158
and dword [rbp - 0x79], 0
mov rax, qword [rbx]
test rax, rax
je 0x14025902f
mov rcx, qword [rax]
jmp 0x140259031
xor ecx, ecx
imul edx, esi, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
jne 0x1402590d4
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x14025908c
and dword [rbp + 0x33], 0
lea rax, str.Incident_response_process_is_ready
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x2f], 0x46
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a1992]
xor r8d, r8d
mov dword [rsp + 0x20], 3
call fcn.140001158
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x1402590cd
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x1402590cd
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.PM_]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x1402590cd
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [str.PM_]
xor eax, eax
jmp 0x1402591b1
mov rax, qword [rdi]
mov rdx, qword [rax]
test rdx, rdx
je 0x140259111
mov rcx, qword [rdx + 0x70]
test rcx, rcx
je 0x1402590f9
mov edx, 0x8007042b
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov rax, qword [rdi]
mov rdx, qword [rax]
test rdx, rdx
je 0x140259111
mov rcx, qword [rdx + 0x70]
test rcx, rcx
je 0x140259111
lea rdx, [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x14025916b
and dword [rbp - 0x3d], 0
lea rax, [rbp - 0x79]
and dword [rbp - 0x2d], 0
mov qword [rbp - 0x49], rax
lea rax, str.Incident_response_process_is_not_ready
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x41], 4
mov dword [rbp - 0x31], 0x4e
lea rax, [rbp - 0x69]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a19b8]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001158
mov rbx, qword [rbx + 8]
mov esi, dword [rbp - 0x79]
test rbx, rbx
je 0x1402591af
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x1402591af
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.PM_]
mov edx, edi
lock xadd dword [rbx + 0xc], edx
add edx, edi
jne 0x1402591af
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 8]
call qword [str.PM_]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402ae860
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14025e170
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov dil, dl
cmp qword [rcx + 0x18], 8
jb 0x14025e189
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x14025e1b7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp dil, 1
jne 0x14025e1a9
cmp eax, 0xb7
je 0x14025e1b7
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140261c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x140261c73
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x140261ca2
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x140261c84
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140261cda
cmp qword [rcx + rdx*8], rdi
jne 0x140261ccf
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140261cd3
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140261ce7
cmp qword [rcx + rdx*8], rdi
jne 0x140261ce7
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140061e04
mov rcx, rsi
call fcn.14004b500
mov rcx, rdi
call fcn.1402aed28
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140268384
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rbx, [rcx + 0x20]
mov dword [rsp + 0x58], edx
xor ecx, ecx
mov r9d, edx
movabs r8, 0xcbf29ce484222325
movzx eax, byte [rsp + rcx + 0x58]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x1402683aa
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r10*8], rdx
jne 0x1402683f1
mov rcx, rdx
jmp 0x1402683f9
mov rcx, qword [r8 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14026840e
cmp dword [rax + 0x10], r9d
je 0x140268409
mov rax, qword [rax]
jmp 0x1402683e6
mov rcx, rax
jmp 0x140268414
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x140268492
mov rdi, qword [rdx]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov rdx, rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.1402686a0
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140268467
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1402684a8
mov rax, qword [rsp + 0x30]
inc dword [rax + 0x14]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret