joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e5600
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14039f8f8]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1400e575d
mov rdx, qword [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400e5650
mov rcx, rbx
call fcn.14003c410
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rax, 1
jb 0x1400e56aa
lea r9, [rcx + 1]
mov qword [rbx + 0x10], r9
mov rdx, rbx
cmp r8, 8
jb 0x1400e5696
mov rdx, qword [rbx]
movzx eax, word [0x1403cbdc0]
mov word [rdx + rcx*2], ax
xor edi, edi
mov word [rdx + r9*2], di
jmp 0x1400e56ce
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1403cbdc0]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.14003edb0
xor edi, edi
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1400e570f
lea rsi, [rcx + 0xf]
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x1400e56f3
mov rbx, qword [rbx]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1e
lea rdx, str.AMDToolsConfig
call fcn.140299130
mov word [rbx + rsi*2], di
jmp 0x1400e5731
lfence
mov qword [rsp + 0x20], 0xf
lea r9, str.AMDToolsConfig
xor r8d, r8d
lea edx, [r8 + 0xf]
mov rcx, rbx
call fcn.14003edb0
mov dword [rsp + 0x30], edi
jmp 0x1400e573b
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140296bc0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
lea rdx, str.Invalid_argument_while_calling_SHGetKnownFolderPath.
lea rcx, [rsp + 0x38]
call fcn.1400e2cd0
lea rdx, [0x14043b040]
lea rcx, [rsp + 0x38]
call fcn.140298f00
int3

Function at 0x1400e5910
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov qword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14039f908]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ebx, eax
test eax, eax
js 0x1400e599f
mov rdx, qword [rsp + 0x38]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400e5960
mov rcx, rdi
call fcn.14003c410
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
jmp 0x1400e5985
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140296bc0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
lea rdx, str.Invalid_argument_while_calling_SHGetKnownFolderPath.
lea rcx, [rsp + 0x20]
call fcn.1400e2cd0
lea rdx, [0x14043b040]
lea rcx, [rsp + 0x20]
call fcn.140298f00
int3
Function at 0x1400f61b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
mov dword [rsp + 0x30], 0x80004005
cmp byte [rcx + 0x10], 0
jne 0x1400f628c
lea r9, str.Creating_thread.
xor r8d, r8d
lea edx, [r8 + 0x2a]
lea rcx, str.D:JenkinsworkspaceCommoneeb7ab0aCommonCommonimpl_src_neutralThread.cpp
call fcn.1400e7220
mov ecx, 0x10
call fcn.140296bf0
mov rbx, rax
mov qword [rsp + 0x38], rax
mov ecx, 0x10
call fcn.140296bf0
mov qword [rax], rdi
lea rcx, [0x1400f63f0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x78], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400f64b0]
xor edx, edx
xor ecx, ecx
call fcn.1402af38c
mov qword [rbx], rax
test rax, rax
je 0x1400f62c3
mov qword [rdi + 8], rbx
mov dword [rsp + 0x30], 0
mov eax, dword [rsi]
mov dword [rsp + 0x20], eax
lea r9, str.Created_thread._ThreadID:_0x_llx
xor r8d, r8d
lea edx, [r8 + 0x2f]
lea rcx, str.D:JenkinsworkspaceCommoneeb7ab0aCommonCommonimpl_src_neutralThread.cpp
call fcn.1400e7220
jmp 0x1400f6294
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140296bc0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsi], 0
mov ecx, 6
call fcn.1402788dc
int3
Function at 0x1401276a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
lea r14, [0x1403c3108]
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x24], bpl
mov qword [rsp + 0x28], r14
jb 0x1401276d9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140127700
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140127580
mov ebp, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140127765
bt ebx, 0xa
jae 0x14012775c
mov rcx, rsi
call fcn.140127360
test al, al
je 0x140127724
test bl, 0x10
mov eax, 0xb
mov ebx, 4
cmovne ebx, eax
jmp 0x140127765
mov ebx, 9
test rdi, rdi
je 0x14012773c
mov dword [rdi], 0
mov byte [rdi + 4], 0
mov qword [rdi + 8], r14
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.140127790
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
jne 0x140127729
test ebp, ebp
je 0x140127729
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rsi
mov ecx, ebp
call fcn.140128010
xor al, al
jmp 0x140127749

Function at 0x140127790
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rcx
cmp edx, 1
jne 0x1401277ce
test rbx, rbx
je 0x1401277c1
lea rax, [0x1403c3108]
mov dword [r8], 0
mov qword [r8 + 8], rax
mov byte [r8 + 4], 0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x1401277ea
cmp qword [rcx + 0x18], 8
jb 0x1401277e2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1401277fa
cmp qword [rcx + 0x18], 8
jb 0x1401277f4
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140127855
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140127819
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140127855
cmp eax, 0x7b
je 0x140127855
cmp eax, 0x57
je 0x140127855
cmp eax, 0xa1
je 0x140127855
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140127855
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
mov ecx, eax
call fcn.140128010
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x14012786f
lea rax, [0x1403c3108]
mov byte [rbx + 4], 0
mov qword [rbx + 8], rax
mov dword [rbx], 0
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140127880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401278b4
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x1401278d5
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.140127580
jmp 0x140127a4e
mov edx, r14d
mov rcx, rsi
call fcn.140127450
mov r12d, eax
xor ebp, ebp
bt r14d, 0xa
jae 0x140127a0b
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401278fd
mov rdx, qword [rsi]
mov qword [rsp + 0x48], rbp
movdqa xmm0, xmmword [0x1403d0c20]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], bp
jne 0x140127920
lea rcx, [rsp + 0x48]
call fcn.14003c410
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1401279b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401279af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140127a6d
call fcn.140296be0
nop
movdqa xmm0, xmmword [0x1403d0c20]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
cmp rbx, 0xffffffffffffffff
jne 0x1401279df
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.140127580
nop
jmp 0x140127a4e
mov rcx, rsi
call fcn.140127360
test al, al
jne 0x140127a01
mov dword [rdi], 9
mov dword [rdi + 4], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140127a4e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r15, r15
je 0x140127a23
mov dword [r15], ebp
mov byte [r15 + 4], 0
lea rax, [0x1403c3108]
mov qword [r15 + 8], rax
and r14d, 0x10
je 0x140127a2f
mov eax, dword [rsp + 0x40]
jmp 0x140127a37
mov eax, r12d
mov r12d, dword [rsp + 0x40]
test r14d, r14d
setne bpl
add ebp, 2
mov dword [rdi], ebp
test r14d, r14d
cmove r12d, eax
mov dword [rdi + 4], r12d
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1402a5e20
nop
int3
Function at 0x140129290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140129320
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x14043d080]
cmp ecx, 0xffffffff
jne 0x14012933e
xor esi, esi
jmp 0x140129347
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x14012943d
mov rax, qword [rsi + 0x30]
nop dword [rax]
test rax, rax
jne 0x140129370
cmp qword [rsi + 0x18], 0
je 0x140129416
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1401293d8
nop dword [rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401293b7
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x140129380
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x140129365
nop dword [rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1401293fc
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1401293fc
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.140128420
cmp qword [rsi + 0x30], 0
jne 0x1401293e0
xor eax, eax
jmp 0x140129360
lea rdx, [0x140128b20]
lea rcx, [0x1404721b8]
call fcn.1401288f0
mov ecx, dword [0x14043d080]
cmp ecx, 0xffffffff
je 0x14012943d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x140129470
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140129470
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140129320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140129320
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x14043d080]
cmp ecx, 0xffffffff
jne 0x14012933e
xor esi, esi
jmp 0x140129347
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x14012943d
mov rax, qword [rsi + 0x30]
nop dword [rax]
test rax, rax
jne 0x140129370
cmp qword [rsi + 0x18], 0
je 0x140129416
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1401293d8
nop dword [rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401293b7
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x140129380
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x140129365
nop dword [rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1401293fc
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1401293fc
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.140128420
cmp qword [rsi + 0x30], 0
jne 0x1401293e0
xor eax, eax
jmp 0x140129360
lea rdx, [0x140128b20]
lea rcx, [0x1404721b8]
call fcn.1401288f0
mov ecx, dword [0x14043d080]
cmp ecx, 0xffffffff
je 0x14012943d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x140129470
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140129470
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140163690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1401636b0
test ecx, ecx
jns 0x1401636c5
mov eax, 0x2d
neg ecx
mov word [rdx], ax
mov eax, 2
jmp 0x1401636c7
xor eax, eax
add rdx, rax
jmp 0x1401636d0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x170
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rsi, qword [rsp + 0x1a0]
mov ebx, r9d
mov r11, rdx
mov r10d, ecx
test r8, r8
je 0x140163828
mov qword [rsp + 0x180], rdi
test ecx, ecx
jne 0x140163725
mov dword [rdx], 0x30
jmp 0x1401637fb
xor edi, edi
mov ecx, edi
cmp ebx, 2
jne 0x14016374f
nop
movzx eax, r10w
lea rdx, [rcx + 1]
and ax, 1
or ax, 0x30
shr r10d, 1
mov word [rsp + rcx*2 + 0x60], ax
mov rcx, rdx
jne 0x140163730
jmp 0x1401637bc
cmp ebx, 0x10
jne 0x14016377e
lea r9, [0x1403304b8]
nop dword [rax + rax]
mov eax, r10d
shr r10d, 4
and eax, 0xf
movzx eax, word [r9 + rax*2]
mov word [rsp + rcx*2 + 0x60], ax
inc rcx
test r10d, r10d
jne 0x140163760
jmp 0x1401637bc
lea eax, [r9 - 8]
test eax, 0xfffffffd
jne 0x14016385c
lea r9, [0x1403304b8]
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov eax, r10d
div ebx
mov r10d, eax
movzx eax, word [r9 + rdx*2]
mov word [rsp + rcx*2 + 0x60], ax
inc rcx
test r10d, r10d
jne 0x1401637a0
cmp rcx, r8
ja 0x140163890
mov rdx, rdi
test rcx, rcx
je 0x1401637f6
lea r8, [rsp + rcx*2 + 0x5e]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8]
lea r8, [r8 - 2]
mov word [r11 + rdx*2], ax
inc rdx
sub rcx, 1
jne 0x1401637e0
mov word [r11 + rdx*2], di
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140296bc0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
mov r9d, 0x47
mov qword [rsp + 0x20], rsi
mov r8d, 0x38a
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilXMLString.cpp
lea rcx, [rsp + 0x30]
call fcn.140163200
lea rdx, [0x1404392f8]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3
mov r9d, 0x48
mov qword [rsp + 0x20], rsi
mov r8d, 0x3c5
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilXMLString.cpp
lea rcx, [rsp + 0x30]
call fcn.140163300
lea rdx, [0x140439360]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3
mov r9d, 0x49
mov qword [rsp + 0x20], rsi
mov r8d, 0x3cb
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilXMLString.cpp
lea rcx, [rsp + 0x30]
call fcn.140163200
lea rdx, [0x1404392f8]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3
Function at 0x14017d0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x48
movzx r12d, r8b
mov r15, r9
mov r13, rcx
test rdx, rdx
je 0x14017d2f0
cmp word [rdx], 0x2f
mov rdi, rdx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x40], r14
jne 0x14017d15e
mov r10, rdx
nop dword [rax]
movzx eax, word [r10]
add r10, 2
test ax, ax
jne 0x14017d100
sub r10, rdx
sar r10, 1
lea rax, [r10 - 1]
cmp rax, 3
jbe 0x14017d15e
movzx r8d, word [rdx + 4]
cmp r8w, 0x3a
jne 0x14017d144
movzx ecx, word [rdx + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
jbe 0x14017d140
sub cx, 0x61
cmp cx, 0x19
ja 0x14017d144
lea rdi, [rdx + 2]
movzx eax, word [rdx + 2]
cmp ax, r8w
jne 0x14017d15e
cmp ax, 0x2f
je 0x14017d15a
cmp ax, 0x5c
jne 0x14017d15e
lea rdi, [rdx + 2]
movzx eax, word [rdi]
xor r14d, r14d
mov qword [rsp + 0x70], rbx
mov rdx, rdi
mov esi, 0xa5
mov ebp, 0x20a9
test ax, ax
je 0x14017d215
movzx ecx, ax
cmp cx, si
je 0x14017d1a4
movzx eax, cx
cmp cx, bp
je 0x14017d19f
movzx eax, word [rdx + 2]
add rdx, 2
movzx ecx, ax
test ax, ax
jne 0x14017d182
test ax, ax
je 0x14017d215
mov rbx, rdi
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
test ax, ax
jne 0x14017d1b0
mov rax, qword [r9]
sub rbx, rdi
sar rbx, 1
mov rcx, r15
lea rbx, [rbx*2]
mov rdx, rbx
call qword [rax + 0x10]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov r14, rax
call fcn.140299130
movzx eax, word [r14]
mov rcx, r14
test ax, ax
je 0x14017d212
mov edx, 0x2f
cmp ax, si
je 0x14017d202
cmp ax, bp
jne 0x14017d205
mov word [rcx], dx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14017d1f8
mov rdi, r14
mov eax, r12d
xor eax, 1
lea esi, [rax + 1]
shl esi, 0x1e
lea ebp, [rax + 2]
cmp byte [r13 + 8], 0
je 0x14017d263
mov ecx, 0x80
mov qword [rsp + 0x30], 0
test r12b, r12b
mov eax, 0x8000000
mov edx, esi
cmovne eax, ecx
xor r9d, r9d
lea r8d, [rcx - 0x7f]
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
jmp 0x14017d2b3
mov rdx, r15
mov rcx, rdi
call fcn.140165b80
mov rbx, rax
mov qword [rsp + 0x30], 0
mov ecx, 0x80
mov eax, 0x8000000
test r12b, r12b
mov edx, esi
cmovne eax, ecx
xor r9d, r9d
lea r8d, [rcx - 0x7f]
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdx, rbx
mov rcx, r15
mov rdi, rax
mov rax, qword [r15]
call qword [rax + 0x18]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test r14, r14
je 0x14017d2d6
mov rax, qword [r15]
mov rdx, r14
mov rcx, r15
call qword [rax + 0x18]
mov r14, qword [rsp + 0x40]
cmp rdi, 0xffffffffffffffff
je 0x14017d2f0
mov rax, rdi
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
xor eax, eax
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x14017d300
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x68
mov rax, r9
mov r10, rdx
test rdx, rdx
je 0x14017d348
test rax, rax
je 0x14017d348
xor ecx, ecx
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], ecx
mov rdx, rax
mov qword [rsp + 0x20], rcx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14017d33f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14017d384
mov eax, dword [rsp + 0x78]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x90]
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilFileManagersWindowsFileMgr.cpp
mov r9d, 0xe
mov qword [rsp + 0x20], rax
mov r8d, 0x11c
lea rcx, [rsp + 0x30]
call fcn.140165d80
lea rdx, [0x140439498]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3
mov rax, qword [rsp + 0x90]
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilFileManagersWindowsFileMgr.cpp
mov r9d, 0x22
mov qword [rsp + 0x20], rax
mov r8d, 0x126
lea rcx, [rsp + 0x30]
call fcn.140165d80
lea rdx, [0x140439498]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3

Function at 0x14017d460
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x60
mov rdi, r8
mov rax, rdx
test rdx, rdx
je 0x14017d4b3
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x70], rbx
mov rcx, rax
mov dword [rsp + 0x78], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14017d49d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14017d4e7
mov eax, dword [rsp + 0x78]
shl rax, 0x20
or rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov r9d, 0xe
mov qword [rsp + 0x20], rdi
mov r8d, 0x10c
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilFileManagersWindowsFileMgr.cpp
lea rcx, [rsp + 0x30]
call fcn.140165d80
lea rdx, [0x140439498]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3
mov r9d, 0x1d
mov qword [rsp + 0x20], rdi
mov r8d, 0x112
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilFileManagersWindowsFileMgr.cpp
lea rcx, [rsp + 0x30]
call fcn.140165d80
lea rdx, [0x140439498]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3
Function at 0x14017d520
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rbx, r9
mov rdi, r8
mov rsi, rdx
test rdx, rdx
je 0x14017d594
test rbx, rbx
je 0x14017d594
test r8, r8
je 0x14017d582
mov qword [rsp + 0x70], rbp
xor ebp, ebp
nop
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], ebp
mov r8d, edi
mov qword [rsp + 0x20], rbp
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14017d5d0
mov eax, dword [rsp + 0x78]
add rbx, rax
sub rdi, rax
jne 0x14017d550
mov rbp, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rsp + 0x90]
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilFileManagersWindowsFileMgr.cpp
mov r9d, 0xe
mov qword [rsp + 0x20], rax
mov r8d, 0x130
lea rcx, [rsp + 0x30]
call fcn.140165d80
lea rdx, [0x140439498]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3
mov rax, qword [rsp + 0x90]
lea rdx, str.C:Jenkinsworkspacexerces_cAx64CReleaseLVS2019OwindowsRT_runtime_staticT_staticxerces_c_srcxercescutilFileManagersWindowsFileMgr.cpp
mov r9d, 0x23
mov qword [rsp + 0x20], rax
mov r8d, 0x138
lea rcx, [rsp + 0x30]
call fcn.140165d80
lea rdx, [0x140439498]
lea rcx, [rsp + 0x30]
call fcn.140298f00
int3

Function at 0x14017d610
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x830], rax
cmp byte [rcx + 8], 0
mov rbx, rdx
je 0x14017d6ab
lea rdx, [rsp + 0x20]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14017d6bf
mov qword [rsp + 0x850], rdi
lea rax, [rsp + 0x20]
nop word [rax + rax]
movzx ecx, word [rax]
add rax, 2
test cx, cx
jne 0x14017d660
lea rcx, [rsp + 0x20]
sub rax, rcx
mov rcx, rbx
sar rax, 1
lea rdi, [rax*2]
mov rax, qword [rbx]
mov rdx, rdi
call qword [rax + 0x10]
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call fcn.140299130
mov rdi, qword [rsp + 0x850]
mov rax, rbx
jmp 0x14017d6d0
lea rdx, [rsp + 0x20]
mov ecx, 0x1ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x14017d6c3
xor eax, eax
jmp 0x14017d6d0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140165ba0
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x840
pop rbx
ret
Function at 0x14017f010
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rdx, str.AliasForCharset
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete al
add rsp, 0x38
ret