joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004e50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140004e78
mov eax, 0
jmp 0x140004ec6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140004ea1
mov eax, 0
jmp 0x140004ec6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140004ec1
mov eax, 0
jmp 0x140004ec6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140004ecc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140004f4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140004f41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140004f41
mov rax, qword [rbp - 8]
jmp 0x140004f5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140004f14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140013740
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400137df
cmp byte [rcx + 0x71], 0
je 0x1400137df
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400137a6
mov rcx, qword [rbx + 0x68]
lea rdx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
mov rax, qword [rcx]
cmp rax, rdx
jne 0x1400137f9
lea rdi, [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x30], rdi
test eax, eax
je 0x1400137aa
sub eax, 1
je 0x1400137ae
sub eax, 2
je 0x1400137df
xor al, al
jmp 0x1400137e1
mov byte [rbx + 0x71], 0
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400137d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1401e7b24
cmp rdi, rax
jne 0x1400137a6
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400137e1
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401d9c30
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x58]
call qword [rax + 0x40]
mov rdi, qword [rsp + 0x30]
jmp 0x140013798

Function at 0x1400147b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov edi, r8d
mov rsi, qword [rsp + 0xc0]
test rdx, rdx
je 0x1400148bf
test r8d, r8d
je 0x1400148bf
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014815
cmp dword [rsp + 0x68], edi
je 0x140014901
test rbx, rbx
je 0x1400148bb
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140019450
nop
cmp qword [rax + 0x18], 8
jb 0x140014836
mov rax, qword [rax]
mov rdx, qword [rbx]
mov r10, qword [rdx + 0x20]
mov qword [rsp + 0x38], rax
lea rax, str.Error_writting_to_file_:__s
mov qword [rsp + 0x30], rax
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xbb
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_filestreamutils_win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call r10
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400148bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400148b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001491b
call fcn.1401d94a8
xor al, al
jmp 0x140014903
test rbx, rbx
je 0x140014901
mov rax, qword [r9]
lea rcx, str.Skipping_writting_zero_byte_buffer__this_may_be_an_empty_file_
mov qword [rsp + 0x30], rcx
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xb3
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_filestreamutils_win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call qword [rax + 0x20]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401d9c30
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
call fcn.1401e4d9c
int3
Function at 0x140016a80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140016aad
xor eax, eax
jmp 0x140016bd1
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140016ae7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140016ae7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140016bd1
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140016bc4
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140016b2a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140016b39
movsx ecx, dil
jmp 0x140016b6b
movzx eax, dil
lea rdx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
mov byte [rsp + 0x50], al
mov r10, qword [rcx]
cmp r10, rdx
jne 0x140016bef
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
movsx ecx, al
mov rdx, qword [rbx + 0x80]
call fcn.1401e71f8
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140016bc9
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140016bb2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1401e7b24
cmp rsi, rax
jne 0x140016bc4
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140016bc9
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401d9c30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x38]
test eax, eax
js 0x140016bc4
cmp eax, 1
jle 0x140016b85
cmp eax, 3
jne 0x140016bc4
movzx eax, byte [rsp + 0x50]
jmp 0x140016b68
Function at 0x14001c460
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add rsp, 0x40
pop rbx
ret

Function at 0x14001c4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add rsp, 0x40
pop rbx
ret

Function at 0x14001c640
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x30
pop rbx
ret

Function at 0x14001c6c0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10d, r9d
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rbx
ret
Function at 0x140053640
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140052890
cmp qword [rax + 0x18], 8
jb 0x14005365d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x1400536a6
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400536a1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536ae
call fcn.1401d94a8
mov eax, ebx
add rsp, 0x40
pop rbx
ret
call fcn.1401e4d9c
int3
Function at 0x140054740
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov dword [rsp + 0x40], 7
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov dword [rsp + 0x30], edi
mov rax, rdx
mov qword [rdx + 0x10], rdi
jb 0x14005477b
mov rax, qword [rdx]
mov word [rax], di
lea rdx, str.SoftwareMicrosoftCryptography
lea rax, [rsp + 0x38]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140054847
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.MachineGuid
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005483c
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14005483c
mov ecx, eax
call fcn.1401da1a0
mov rdi, rax
test rax, rax
je 0x14005483c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.MachineGuid
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140054834
mov r8d, dword [rsp + 0x30]
mov rdx, rdi
shr r8, 1
mov rcx, rbx
dec r8
call fcn.14000c510
mov rcx, rdi
call fcn.1401d94a8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401d9c30
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400552e0
Capabilities:
Get mac address on windows

Disassembly:
mov r11, rsp
push rbp
push r14
sub rsp, 0xa8
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor eax, eax
mov qword [r11 - 0x18], rdi
lea rcx, [r11 - 0x60]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov rdi, rdx
mov qword [r11 - 0x38], rax
xor ebp, ebp
mov qword [r11 - 0x30], rax
mov dword [r11 - 0x28], eax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
call fcn.1400560b0
mov rdx, qword [rsp + 0x60]
movabs r14, 0x2e8ba2e8ba2e8ba3
mov rcx, qword [rsp + 0x58]
mov rax, r14
sub rdx, rcx
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x2c0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x14005545d
mov qword [rsp + 0xc0], rbx
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0xd0], rsi
lea esi, [rbp + 0x12]
cmp dword [rbx + 0x1a0], eax
jae 0x1400553fd
movzx ecx, byte [rbx + 0x19c]
movzx edx, byte [rbx + 0x19b]
movzx r8d, byte [rbx + 0x19a]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x199]
movzx r9d, byte [rbx + 0x198]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x30], edx
mov rdx, rsi
mov dword [rsp + 0x28], r8d
lea r8, str._02X:_02X:_02X:_02X:_02X:_02X
mov dword [rsp + 0x20], r10d
call fcn.140053810
mov eax, dword [rbx + 0x1a0]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140055398
mov rbx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x70]
sub rcx, rdi
nop word [rax + rax]
lea rax, [rsi + 0x7fffffec]
test rax, rax
je 0x140055442
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140055442
mov word [rdi], ax
add rdi, 2
sub rsi, 1
jne 0x140055420
test rsi, rsi
lea rax, [rdi - 2]
mov rsi, qword [rsp + 0xd0]
cmovne rax, rdi
mov word [rax], bp
mov ebp, 1
mov r8, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xa0]
test r8, r8
je 0x1400554bb
mov rcx, qword [rsp + 0x68]
mov rax, r14
sub rcx, r8
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x2c0
cmp rdx, 0x1000
jb 0x1400554b3
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400554d8
mov rcx, r8
call fcn.1401d94a8
mov eax, ebp
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401d9c30
add rsp, 0xa8
pop r14
pop rbp
ret
call fcn.1401e4d9c
int3
Function at 0x14005aab0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2070
call fcn.1401d9bc0
sub rsp, rax
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov r12, qword [rsp + 0x20d0]
lea rax, [rsp + 0x50]
mov r15, r9
mov qword [rsp + 0x20], rax
mov r14d, r8d
mov dword [rsp + 0x58], 0x1000
mov rbp, rdx
xor r13d, r13d
mov r9d, 0x20019
lea rdx, [0x1402d4824]
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov edi, r13d
mov ebx, 0xc000000d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x14005ab88
call fcn.1400159c0
mov dword [rsp + 0x40], esi
lea rcx, [0x1402d4824]
mov qword [rsp + 0x38], rcx
lea rsi, str.MbCommonSigVerify
lea rcx, str.Error_opening__ws__x
mov r9d, 0x55a
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x30], rcx
lea rdx, str.EnumerateStores
mov qword [rsp + 0x28], rsi
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14005acbe
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401dbcd0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005acb3
lea rsi, str.MbCommonSigVerify
mov r8, rbp
lea rcx, [rsp + 0x60]
mov edx, 0x1000
call fcn.1401f6220
mov ebx, eax
call fcn.1400159c0
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
lea rdx, str.EnumerateStores
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
lea rcx, [rsp + 0x60]
test ebx, ebx
jne 0x14005aceb
mov qword [rsp + 0x40], rcx
mov r9d, 0x569
lea rcx, [0x1402d4824]
mov qword [rsp + 0x38], rcx
lea rcx, str.Checking_store:__ws__ws
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call r10
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8d, r14d
call fcn.14005ad30
mov ebx, eax
test eax, eax
je 0x14005acb3
xor edx, edx
mov dword [rsp + 0x58], 0x1000
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
inc edi
call fcn.1401dbcd0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov edx, edi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14005abd3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1401d9c30
mov rbx, qword [rsp + 0x20b0]
add rsp, 0x2070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbp
mov r9d, 0x565
mov qword [rsp + 0x38], rcx
lea rcx, str.Registry_path_was_too_long____ws__ws
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call r10
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xc000000d
jmp 0x14005acc0
Function at 0x14005ad30
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x2070
call fcn.1401d9bc0
sub rsp, rax
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov r14, qword [rsp + 0x20d0]
mov r15, rcx
mov r10, rdx
mov dword [rsp + 0x58], 0x1000
lea rcx, [rsp + 0x50]
mov rdi, r9
mov qword [rsp + 0x20], rcx
mov ebp, r8d
xor r12d, r12d
mov rcx, r10
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov ebx, 0xc000000d
mov esi, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005aed9
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401dbcd0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005aece
mov qword [rsp + 0x20c0], r13
lea r13, str.____Checking_Sub_store:__ws__ws
nop dword [rax + rax]
call fcn.1400159c0
lea rcx, [rsp + 0x60]
mov r9d, 0x59d
mov qword [rsp + 0x40], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x38], r15
lea rcx, str.MbCommonSigVerify
mov r10, qword [rax]
lea rdx, str.EnumerateCerts
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
test rdi, rdi
je 0x14005ae72
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9d, ebp
mov qword [rsp + 0x20], r14
mov r8, rdi
call fcn.14005af00
mov ebx, eax
test eax, eax
je 0x14005aec6
jmp 0x14005ae77
mov ebx, 0xc000000d
xor edx, edx
mov dword [rsp + 0x58], 0x1000
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
inc esi
call fcn.1401dbcd0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov edx, esi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14005ae00
mov r13, qword [rsp + 0x20c0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1401d9c30
add rsp, 0x2070
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005b400
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, qword [rsp + 0x4d0]
lea rax, [rsp + 0x50]
mov r14, r8
mov dword [rsp + 0x58], 0x200
mov r15d, edx
mov qword [rsp + 0x20], rax
mov rdi, rcx
xor r13d, r13d
mov rdx, r14
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, 0xc000000d
mov ebp, r13d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x14005b4c7
call fcn.1400159c0
mov dword [rsp + 0x40], esi
lea rcx, str.Failed_to_open__ws__x
mov qword [rsp + 0x38], r14
lea rsi, str.MbCommonSigVerify
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov r10, qword [rax]
lea rdx, str.FindCert
mov qword [rsp + 0x28], rsi
mov r9d, 0x665
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14005b5e3
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401dbcd0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005b5d8
lea rsi, str.MbCommonSigVerify
call fcn.1400159c0
lea rcx, [rsp + 0x60]
mov r9d, 0x66f
mov qword [rsp + 0x40], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x38], r14
lea rcx, str.Checking__ws__ws
mov r10, qword [rax]
lea rdx, str.FindCert
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
test rdi, rdi
jne 0x14005b569
mov ebx, 0xc000000d
jmp 0x14005b589
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x20], r12
mov edx, r15d
call fcn.14005b610
mov ebx, eax
test eax, eax
jns 0x14005b5d8
xor edx, edx
mov dword [rsp + 0x58], 0x200
mov r8d, 0x200
lea rcx, [rsp + 0x60]
inc ebp
call fcn.1401dbcd0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov edx, ebp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14005b512
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1401d9c30
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140067700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp], rax
mov r14, qword [r8 + 0x18]
mov r10, r8
mov rbx, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
mov r9, r8
cmp r14, 8
jb 0x14006773c
mov r9, qword [r8]
xor edi, edi
lea r8, [rbx + rbx]
lea rcx, [r8 + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov rdx, r9
cmova r8, rdi
test r8, r8
je 0x140067788
movabs rdi, 0x100000001b3
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
xor rax, rcx
mov rcx, rdx
sub rcx, r9
imul rax, rdi
cmp rcx, r8
jne 0x140067770
mov r8, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x30]
mov rdi, qword [r11 + 8]
and rdx, rax
mov rcx, rdx
mov qword [rsp + 0x50], rsi
add rcx, rcx
lea rax, [rdx + rdx]
mov rbp, qword [r8 + rax*8]
lea r12, [r8 + rax*8]
mov rcx, qword [r8 + rcx*8]
cmp rbp, rdi
jne 0x1400677bc
mov rax, rdi
jmp 0x1400677c4
mov rax, qword [r12 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x140067869
mov rax, r10
cmp r14, 8
jb 0x1400677d9
mov rax, qword [r10]
mov rsi, qword [rcx + 0x28]
lea r9, [rcx + 0x10]
cmp rsi, 8
jb 0x1400677eb
mov r9, qword [rcx + 0x10]
mov r11, qword [rcx + 0x20]
cmp r11, rbx
jne 0x140067859
mov r8, r11
test r11, r11
je 0x140067814
sub r9, rax
nop
movzx edx, word [rax]
cmp word [rax + r9], dx
jne 0x140067859
add rax, 2
sub r8, 1
jne 0x140067800
lea rdx, [rcx + 0x10]
cmp rsi, 8
jb 0x140067821
mov rdx, qword [rdx]
cmp r14, 8
jb 0x14006782a
mov r10, qword [r10]
cmp rbx, r11
jne 0x140067861
test rbx, rbx
je 0x140067864
sub r10, rdx
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rdx + r10], ax
jne 0x140067861
add rdx, 2
sub rbx, 1
jne 0x140067840
mov qword [r15], rcx
jmp 0x14006786c
mov rcx, qword [rcx]
jmp 0x1400677b2
mov rcx, rdi
mov qword [r15], rcx
jmp 0x14006786c
mov qword [r15], rdi
mov rsi, qword [rsp + 0x50]
mov rax, r15
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.1401d9c30
mov rbx, qword [rsp + 0x58]
add rsp, 0x10
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret