joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140229bf0
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 9], 0
lea rsi, str.Sense
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.140048750
mov r8d, 4
lea rdx, [rbp + 7]
lea rcx, [rbp - 9]
call fcn.1402714a0
mov edi, eax
lea rcx, [rbp + 7]
call fcn.1400492c0
test edi, edi
jns 0x140229c96
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rsi
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.amcorewcd_sourceonboardingonboardingmanager_senseservicesettings.cpp
mov edx, 0x42
call fcn.14006982c
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140229d0b
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x140229d0b
lea rdx, [rbp + 0x27]
mov rbx, qword [rbp - 9]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x140229cd6
lea r9, str.Cannot_query_service_status_for_service__ws
lea edx, [rax + 0x48]
lea r8, str.amcorewcd_sourceonboardingonboardingmanager_senseservicesettings.cpp
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x5f]
call fcn.1401d35cc
mov edi, eax
test rbx, rbx
je 0x140229d0b
mov rcx, rbx
jmp 0x140229c8e
or dword [rbp + 0x2f], 1
lea rdx, [rbp + 0x27]
mov rcx, qword [0x1403f10b8]
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x140229cfb
lea r9, str.Cannot_set_service_status_for_service__ws
lea edx, [rax + 0x50]
jmp 0x140229cb5
test rbx, rbx
je 0x140229d09
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
xor edi, edi
test edi, edi
jns 0x140229d13
mov eax, edi
jmp 0x140229d35
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.140048750
lea rcx, [rbp + 7]
call fcn.140271778
mov ebx, eax
lea rcx, [rbp + 7]
call fcn.1400492c0
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14027a710
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140229d60
Capabilities:
Modify service

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 8], rdi
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rdx, [0x1402cb810]
lea rcx, [rbp + 0x27]
call fcn.140048750
nop
lea rdx, str.Sense
lea rcx, [rbp - 0x19]
call fcn.140048750
and qword [rbp - 0x29], 0
mov r8d, 2
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.1402714a0
mov edi, eax
test eax, eax
jns 0x140229e17
lea rax, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rax, qword [rbp - 0x19]
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0xe2
call fcn.14006982c
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140229eee
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x140229eee
xor r8d, r8d
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.14007ed54
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r9d, edx
mov r8d, edx
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140229ed2
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, str.Cannot_add_the_dependency_on__ws_to_service__ws
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0xf3
call fcn.1401d35cc
mov edi, eax
lea rcx, [rbp + 7]
call fcn.1400492c0
cmp qword [rbp - 0x29], 0
je 0x140229eee
mov rcx, qword [rbp - 0x29]
jmp 0x140229e0c
lea rcx, [rbp + 7]
call fcn.1400492c0
cmp qword [rbp - 0x29], 0
je 0x140229eec
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
xor edi, edi
lea rcx, [rbp - 0x19]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x27]
call fcn.1400492c0
mov eax, edi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14027a710
mov rdi, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret
Function at 0x140230784
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.api_ms_win_crt_private_l1_1_0.dll__o_memset
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14023084e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x140230845
and dword [rsp + 0x6c], 0
lea rax, [rsp + 0x30]
and dword [rsp + 0x7c], 0
mov edx, 4
mov qword [rsp + 0x60], rax
lea rax, str.DataCollection_adapter_failed_to_read_Windows_Directory
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x78], WSACleanup
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x140351e4c]
call fcn.140001078
lea rdx, [0x1402cb810]
jmp 0x140230852
lea rdx, [rbp - 0x80]
lea rcx, [0x140407b48]
call fcn.140048750
lea rax, [0x140407b48]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14027a710
add rsp, 0x2a0
pop rbp
ret

Function at 0x140230880
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.api_ms_win_crt_private_l1_1_0.dll__o_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
jne 0x140230952
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x34], ecx
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x140230949
and dword [rsp + 0x6c], 0
lea rax, [rsp + 0x34]
and dword [rsp + 0x7c], 0
mov edx, 4
mov qword [rsp + 0x60], rax
lea rax, str.DataCollection_adapter_failed_to_read_Profiles_Directory
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x78], WSACleanup
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x140351e4c]
call fcn.140001078
lea rdx, [0x1402cb810]
jmp 0x140230956
lea rdx, [rbp - 0x80]
lea rcx, [0x140407b68]
call fcn.140048750
lea rax, [0x140407b68]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14027a710
add rsp, 0x2a0
pop rbp
ret
Function at 0x14023c244
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
movzx eax, word [rsp + 0x30]
cmp ax, 9
je 0x14023c2ee
test ax, ax
je 0x14023c2ee
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x14023c2e7
lea rax, str.unsupported_architecture_on_machine
mov qword [rsp + 0x88], VarR8FromUI1
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 2
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403524d6]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001078
mov eax, 0x80004001
jmp 0x14023c2f4
mov word [rbx + 0x28], ax
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14027a710
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret

Function at 0x14023c970
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov dil, dl
cmp qword [rcx + 0x18], 8
jb 0x14023c989
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
cmp eax, 1
je 0x14023c9b7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp dil, 1
jne 0x14023c9a9
cmp eax, 0xb7
je 0x14023c9b7
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14023ea5c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x14023ea8f
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x14023eabe
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x14023eaa0
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14023eaf6
cmp qword [rcx + rdx*8], rdi
jne 0x14023eaeb
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14023eaef
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14023eb03
cmp qword [rcx + rdx*8], rdi
jne 0x14023eb03
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1401d938c
mov rcx, rsi
call fcn.1400492c0
mov rcx, rdi
call fcn.14027abd8
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140243b94
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
lea rbx, [rcx + 0x20]
mov dword [rsp + 0x58], edx
xor ecx, ecx
mov r9d, edx
movabs r8, 0xcbf29ce484222325
movzx eax, byte [rsp + rcx + 0x58]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x140243bb5
mov rcx, qword [rbx + 0x30]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rcx, qword [rbx + 8]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r10*8], rcx
jne 0x140243bfc
mov rdx, rcx
jmp 0x140243c04
mov rdx, qword [r8 + r10*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x140243c14
cmp dword [rax + 0x10], r9d
je 0x140243c17
mov rax, qword [rax]
jmp 0x140243bf1
mov rax, rcx
cmp rax, rcx
jne 0x140243c96
mov rdi, qword [rcx]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov rdx, rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, qword [rdi + 8]
call fcn.140243f50
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140243c67
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140243ca4
mov rax, qword [rsp + 0x30]
inc dword [rax + 0x14]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140243ca4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x140243cda
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x140243d65
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x140243d65
mov ecx, dword [r10]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x140243d33
cmp rdi, qword [rax + r8*8]
jne 0x140243d22
jmp 0x140243d65
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.14027abd8
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x140243e93
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x140243d9f
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140243dbc
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140243deb
cmp rax, rdi
jne 0x140243dc7
mov qword [rdx + r8*8], rbx
jmp 0x140243deb
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140243deb
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140307944]
test rax, rax
jns 0x140243e0c
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140243e1d
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140243e88
cmp rdx, 0x200
jae 0x140243e35
shl rdx, 3
jmp 0x140243e47
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140243e47
add rdx, rdx
mov rcx, rsi
call fcn.1400515d0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140243e83
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140243ca4
cmp rdi, qword [rsp + 0x20]
jne 0x140243e61
mov r9, qword [rsp + 0x78]
mov qword [r9], rbx
mov byte [r9 + 8], 1
mov rax, r9
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140243e9c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r8 + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x140243eb9
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140243f11
cmp qword [rcx + rdx*8], r8
jne 0x140243f06
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140243f0a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140243f1e
cmp qword [rcx + rdx*8], r8
jne 0x140243f1e
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.14027abd8
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14024aec4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rbx + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x14024aef7
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x14024af26
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x14024af08
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x14024af5e
cmp qword [rcx + rdx*8], rbx
jne 0x14024af53
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14024af57
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14024af6b
cmp qword [rcx + rdx*8], rbx
jne 0x14024af6b
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r8 + 0x10]
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14024af9e
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [str.__v__]
mov rcx, rsi
call fcn.1400492c0
mov rcx, rbx
call fcn.14027abd8
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14024da84
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov r15, rcx
mov qword [rbp - 0x51], rdx
xor r12d, r12d
mov dword [rbp - 0x41], r12d
lea ecx, [r12 + 0x48]
call fcn.14027abe8
mov r14, rax
mov qword [rbp - 0x49], rax
lea eax, [r12 + 1]
mov dword [r14 + 8], eax
mov dword [r14 + 0xc], eax
lea rax, vtable.std::_Ref_count_obj_class_sense::machineStateCollection::CodeIntegrityState_.0
mov qword [r14], rax
lea rsi, [r14 + 0x10]
mov qword [rbp - 0x29], rsi
test rsi, rsi
je 0x14024db3b
mov dword [rsi], r12d
lea rcx, [rsi + 8]
call fcn.14015fedc
nop
lea rbx, [rsi + 0x10]
mov qword [rbp - 0x39], rbx
mov dword [rbx], r12d
lea rcx, [rbx + 8]
call fcn.14015fedc
mov qword [rsi + 0x20], r12
mov qword [rsi + 0x28], r12
mov qword [rsi + 0x30], r12
or eax, 0xffffffff
mov dword [rsi], eax
mov dword [rbx], eax
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x30], eax
mov qword [rdi + 8], r14
mov qword [rdi], rsi
mov dword [rbp - 0x41], 3
mov rdx, rdi
mov rcx, r15
call fcn.14024d554
lea rdx, [r15 + 8]
lea rcx, [0x1404084a8]
call fcn.1402525e8
test al, al
je 0x14024dbfb
mov qword [rbp - 0x51], 8
mov r8d, 8
xor r9d, r9d
lea rdx, [rbp - 0x51]
lea ecx, [r8 + 0x5f]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp - 0x49], eax
test eax, eax
jns 0x14024dbee
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x14024dbe3
lea rax, str.Code_integrity_state_collection___failed_to_get_code_integrity_information
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x96
lea rax, [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov edx, 4
mov qword [rbp + 0x1f], rdx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140353552]
call fcn.140001078
mov rcx, qword [rdi]
mov eax, dword [rbp - 0x49]
mov dword [rcx + 0x28], eax
jmp 0x14024dbfb
mov ecx, dword [rbp - 0x4d]
mov rax, qword [rdi]
mov dword [rax + 0x28], r12d
mov dword [rax + 0x2c], ecx
lea rdx, [r15 + 8]
lea rcx, [0x1404084c8]
call fcn.1402525e8
test al, al
je 0x14024dc45
lea r9, [rbp - 0x59]
lea r8, [0x140408408]
or edx, 0xffffffff
lea rcx, [0x140408428]
call fcn.1401b585c
cmp byte [rbp - 0x59], r12b
je 0x14024dc3b
mov rax, qword [rdi]
mov dword [rax + 0x30], 0x80004005
jmp 0x14024dc45
mov rcx, qword [rdi]
mov dword [rcx + 0x30], r12d
mov dword [rcx + 0x34], eax
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14027a710
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1402508d0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov r14, rcx
mov qword [rbp - 0x31], rdx
and dword [rbp - 0x39], 0
mov ecx, 0x28
call fcn.14027abe8
mov rsi, rax
mov qword [rbp - 0x41], rax
mov eax, 1
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], eax
lea rax, vtable.std::_Ref_count_obj_class_sense::machineStateCollection::MachinePropertiesState_.0
mov qword [rsi], rax
lea rbx, [rsi + 0x10]
mov qword [rbp - 0x21], rbx
test rbx, rbx
je 0x140250959
and dword [rbx], 0
lea rcx, [rbx + 8]
call fcn.14015fedc
mov byte [rbx + 0x14], 0
or eax, 0xffffffff
mov dword [rbx], eax
mov dword [rbx + 0x10], eax
mov qword [rdi + 8], rsi
mov qword [rdi], rbx
mov dword [rbp - 0x39], 3
mov rdx, rdi
mov rcx, r14
call fcn.140250694
lea rdx, [r14 + 8]
lea rcx, [0x1404087e8]
call fcn.1402525e8
test al, al
je 0x140250a1e
lea r9, [rbp - 0x31]
mov r8d, 2
lea rdx, [rbp - 0x49]
mov ecx, 0x91
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp - 0x41], eax
test eax, eax
jns 0x140250a0c
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x140250a01
lea rax, str.Machine_properties_state_collector___failed_to_get_SystemSecureBootInformation
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x9e
and dword [rbp + 0x23], 0
lea rax, [rbp - 0x41]
mov qword [rbp + 0x27], rax
mov edx, 4
mov dword [rbp + 0x2f], edx
and dword [rbp + 0x33], 0
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140353552]
call fcn.140001078
mov rcx, qword [rdi]
mov eax, dword [rbp - 0x41]
mov dword [rcx + 0x10], eax
jmp 0x140250a1e
mov cl, byte [rbp - 0x49]
mov rdx, qword [rdi]
and dword [rdx + 0x10], 0
test cl, cl
setne cl
mov byte [rdx + 0x14], cl
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14027a710
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret