joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003eec0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x14029fa58]
xor rax, rsp
mov qword [rsp], rax
mov r14, qword [r8 + 0x18]
mov r10, r8
mov rbx, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
mov r9, r8
cmp r14, 8
jb 0x14003eefc
mov r9, qword [r8]
xor edi, edi
lea r8, [rbx + rbx]
lea rcx, [r8 + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov rdx, r9
cmova r8, rdi
test r8, r8
je 0x14003ef48
movabs rdi, 0x100000001b3
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
xor rax, rcx
mov rcx, rdx
sub rcx, r9
imul rax, rdi
cmp rcx, r8
jne 0x14003ef30
mov r8, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x30]
mov rdi, qword [r11 + 8]
and rdx, rax
mov rcx, rdx
mov qword [rsp + 0x50], rsi
add rcx, rcx
lea rax, [rdx + rdx]
mov rbp, qword [r8 + rax*8]
lea r12, [r8 + rax*8]
mov rcx, qword [r8 + rcx*8]
cmp rbp, rdi
jne 0x14003ef7c
mov rax, rdi
jmp 0x14003ef84
mov rax, qword [r12 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14003f029
mov rax, r10
cmp r14, 8
jb 0x14003ef99
mov rax, qword [r10]
mov rsi, qword [rcx + 0x28]
lea r9, [rcx + 0x10]
cmp rsi, 8
jb 0x14003efab
mov r9, qword [rcx + 0x10]
mov r11, qword [rcx + 0x20]
cmp r11, rbx
jne 0x14003f019
mov r8, r11
test r11, r11
je 0x14003efd4
sub r9, rax
nop
movzx edx, word [rax]
cmp word [rax + r9], dx
jne 0x14003f019
add rax, 2
sub r8, 1
jne 0x14003efc0
lea rdx, [rcx + 0x10]
cmp rsi, 8
jb 0x14003efe1
mov rdx, qword [rdx]
cmp r14, 8
jb 0x14003efea
mov r10, qword [r10]
cmp rbx, r11
jne 0x14003f021
test rbx, rbx
je 0x14003f024
sub r10, rdx
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rdx + r10], ax
jne 0x14003f021
add rdx, 2
sub rbx, 1
jne 0x14003f000
mov qword [r15], rcx
jmp 0x14003f02c
mov rcx, qword [rcx]
jmp 0x14003ef72
mov rcx, rdi
mov qword [r15], rcx
jmp 0x14003f02c
mov qword [r15], rdi
mov rsi, qword [rsp + 0x50]
mov rax, r15
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.14017fdc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x10
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14003f830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14029fa58]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r10, r8
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov r11, qword [r8 + 0x10]
mov rbx, qword [r8 + 0x18]
cmp rbx, 8
jb 0x14003f875
mov r8, qword [r8]
movabs rax, 0xcbf29ce484222325
mov rdx, r8
lea r9, [r11 + r11]
lea rcx, [r8 + r9]
xor edi, edi
cmp r8, rcx
cmova r9, rdi
test r9, r9
je 0x14003f8c8
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
xor rax, rcx
imul rax, rdi
inc rdx
mov rcx, rdx
sub rcx, r8
cmp rcx, r9
jne 0x14003f8b0
mov r12, qword [r15 + 0x30]
and r12, rax
mov rsi, qword [r15 + 8]
mov rcx, r12
add rcx, rcx
mov rax, qword [r15 + 0x18]
mov r9, qword [rax + rcx*8]
cmp r9, rsi
jne 0x14003f8eb
mov rdi, rsi
jmp 0x14003f8f3
mov rdi, qword [rax + rcx*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r9
je 0x14003f954
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
cmp qword [rdi + 0x28], 8
jb 0x14003f90b
mov rax, qword [rdi + 0x10]
mov r8, r10
cmp rbx, 8
jb 0x14003f917
mov r8, qword [r10]
cmp r11, qword [rdi + 0x20]
jne 0x14003f8f3
mov rdx, r11
test r11, r11
je 0x14003f944
sub r8, rax
nop dword [rax + rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x14003f8f3
add rax, 2
sub rdx, 1
jne 0x14003f930
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14003fa3b
mov rbx, qword [rsi]
mov rsi, qword [rbx + 8]
mov r9, r10
mov r8, rsi
mov rdx, rbx
call fcn.140040090
mov rdx, rax
mov rax, qword [r15 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jb 0x14003fa56
inc rax
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rsi], rdx
mov rcx, qword [r15 + 8]
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14003f9da
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r15 + 8]
shl r12, 4
mov r8, qword [r15 + 0x18]
add r8, r12
mov rax, qword [r8]
cmp rax, rcx
jne 0x14003f9fb
mov qword [r8], rbx
mov rax, qword [r15 + 0x18]
mov qword [r12 + rax + 8], rbx
jmp 0x14003fa27
cmp rax, rdi
jne 0x14003fa05
mov qword [r8], rbx
jmp 0x14003fa27
mov rax, qword [r8 + 8]
mov rdx, qword [rax]
mov qword [r8 + 8], rdx
cmp rdx, rbx
je 0x14003fa27
mov r8, qword [r15 + 0x18]
mov rax, qword [r8 + r12 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r12 + 8], rdx
mov rcx, r15
call fcn.14003fb10
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14017fdc0
add rsp, 0x58
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.14017e370
int3
Function at 0x14003fbd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14029fa58]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp qword [r8 + 0x28], 8
mov rdi, rdx
mov r11, qword [r8 + 0x20]
lea rdx, [r8 + 0x10]
mov r10, rcx
jb 0x14003fc01
mov rdx, qword [rdx]
add r11, r11
xor ebx, ebx
movabs rax, 0xcbf29ce484222325
mov r9, rdx
lea rcx, [r11 + rdx]
cmp rdx, rcx
cmova r11, rbx
test r11, r11
je 0x14003fc49
movabs rbx, 0x100000001b3
nop dword [rax]
movzx ecx, byte [r9]
inc r9
xor rax, rcx
mov rcx, r9
sub rcx, rdx
imul rax, rbx
cmp rcx, r11
jne 0x14003fc30
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14003fc89
cmp rax, r8
jne 0x14003fc7f
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rcx + rdx + 8], rax
jmp 0x14003fc94
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14003fc94
cmp rax, r8
jne 0x14003fc94
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rcx], rbx
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov rdx, r8
dec qword [r10 + 0x10]
call fcn.14003f310
mov rax, rdi
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14017fdc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003fe30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x14029fa58]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov r11, qword [r8 + 0x10]
mov r9, r8
mov r12, qword [r8 + 0x18]
cmp r12, 8
jb 0x14003fe86
mov r9, qword [r8]
movabs rax, 0xcbf29ce484222325
mov rdx, r9
lea r8, [r11 + r11]
lea rcx, [r9 + r8]
xor ebx, ebx
cmp r9, rcx
cmova r8, rbx
test r8, r8
je 0x14003fed8
movabs rbx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
xor rax, rcx
imul rax, rbx
inc rdx
mov rcx, rdx
sub rcx, r9
cmp rcx, r8
jne 0x14003fec0
mov r9, qword [rsi + 0x30]
and r9, rax
mov rbx, qword [rsi + 8]
mov rcx, r9
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov r15, qword [rax + rcx*8]
cmp rbx, r15
je 0x14003ff85
mov rbx, qword [rax + rcx*8 + 8]
mov rbx, qword [rbx]
cmp rbx, r15
je 0x14003ff85
mov rbx, qword [rbx + 8]
lea rax, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x14003ff1a
mov rax, qword [rbx + 0x10]
mov r8, r10
cmp r12, 8
jb 0x14003ff26
mov r8, qword [r10]
cmp r11, qword [rbx + 0x20]
jne 0x14003ff02
mov rdx, r11
test r11, r11
je 0x14003ff54
sub r8, rax
nop word [rax + rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x14003ff02
add rax, 2
sub rdx, 1
jne 0x14003ff40
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rdx], rcx
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rdx + 8], rcx
dec qword [rsi + 0x10]
mov rdx, rdi
call fcn.14003f310
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14004001c
mov rax, qword [rdi]
cmp rbx, rax
je 0x14003ffba
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r9, 4
mov rcx, qword [rsi + 0x18]
add rcx, r9
mov rax, qword [rcx]
cmp rax, qword [rsi + 8]
jne 0x14003ffdc
mov qword [rcx], rdi
mov rax, qword [rsi + 0x18]
mov qword [r9 + rax + 8], rdi
jmp 0x140040008
cmp rax, rbx
jne 0x14003ffe6
mov qword [rcx], rdi
jmp 0x140040008
mov rax, qword [rcx + 8]
mov rdx, qword [rax]
mov qword [rcx + 8], rdx
cmp rdx, rdi
je 0x140040008
mov r8, qword [rsi + 0x18]
mov rax, qword [r8 + r9 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r9 + 8], rdx
mov rcx, rsi
call fcn.14003fb10
nop
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14017fdc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140044390
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2070
call fcn.140180a60
sub rsp, rax
mov rax, qword [0x14029fa58]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov r12, qword [rsp + 0x20d0]
lea rax, [rsp + 0x50]
mov r15, r9
mov qword [rsp + 0x20], rax
mov r14d, r8d
mov dword [rsp + 0x58], 0x1000
mov rbp, rdx
xor r13d, r13d
mov r9d, 0x20019
lea rdx, [0x140267738]
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov edi, r13d
mov ebx, 0xc000000d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x140044468
call fcn.14000b5d0
mov dword [rsp + 0x40], esi
lea rcx, [0x140267738]
mov qword [rsp + 0x38], rcx
lea rsi, str.MbCommonSigVerify
lea rcx, str.Error_opening__ws__x
mov r9d, 0x55a
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x30], rcx
lea rdx, str.EnumerateStores
mov qword [rsp + 0x28], rsi
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14004459e
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140182920
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140044593
lea rsi, str.MbCommonSigVerify
mov r8, rbp
lea rcx, [rsp + 0x60]
mov edx, 0x1000
call fcn.14019c8d0
mov ebx, eax
call fcn.14000b5d0
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
lea rdx, str.EnumerateStores
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
lea rcx, [rsp + 0x60]
test ebx, ebx
jne 0x1400445cb
mov qword [rsp + 0x40], rcx
mov r9d, 0x569
lea rcx, [0x140267738]
mov qword [rsp + 0x38], rcx
lea rcx, str.Checking_store:__ws__ws
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call r10
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8d, r14d
call fcn.140044610
mov ebx, eax
test eax, eax
je 0x140044593
xor edx, edx
mov dword [rsp + 0x58], 0x1000
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
inc edi
call fcn.140182920
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov edx, edi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400444b3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14017fdc0
mov rbx, qword [rsp + 0x20b0]
add rsp, 0x2070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbp
mov r9d, 0x565
mov qword [rsp + 0x38], rcx
lea rcx, str.Registry_path_was_too_long____ws__ws
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call r10
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xc000000d
jmp 0x1400445a0
Function at 0x140044610
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x2070
call fcn.140180a60
sub rsp, rax
mov rax, qword [0x14029fa58]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov r15, qword [rsp + 0x20d0]
mov rsi, rcx
mov rax, rdx
mov dword [rsp + 0x58], 0x1000
lea rcx, [rsp + 0x50]
mov r14, r9
mov qword [rsp + 0x20], rcx
mov ebp, r8d
xor r12d, r12d
mov rcx, rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov edi, 0xc000000d
mov ebx, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400447ad
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140182920
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400447a2
mov qword [rsp + 0x20c0], r13
lea r13, str.____Checking_Sub_store:__ws__ws
nop dword [rax + rax]
call fcn.14000b5d0
lea rcx, [rsp + 0x60]
mov r9d, 0x59d
mov qword [rsp + 0x40], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x38], rsi
lea rcx, str.MbCommonSigVerify
mov r10, qword [rax]
lea rdx, str.EnumerateCerts
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9d, ebp
mov qword [rsp + 0x20], r15
mov r8, r14
call fcn.1400447e0
mov edi, eax
test eax, eax
je 0x14004479a
xor edx, edx
mov dword [rsp + 0x58], 0x1000
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
inc ebx
call fcn.140182920
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov edx, ebx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400446e0
mov r13, qword [rsp + 0x20c0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14017fdc0
add rsp, 0x2070
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140044df0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x14029fa58]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, qword [rsp + 0x4d0]
lea rax, [rsp + 0x50]
mov rbp, r8
mov dword [rsp + 0x58], 0x200
mov r14d, edx
mov qword [rsp + 0x20], rax
mov r15, rcx
xor r13d, r13d
mov rdx, rbp
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov edi, 0xc000000d
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x140044eb7
call fcn.14000b5d0
mov dword [rsp + 0x40], esi
lea rcx, str.Failed_to_open__ws__x
mov qword [rsp + 0x38], rbp
lea rsi, str.MbCommonSigVerify
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov r10, qword [rax]
lea rdx, str.FindCert
mov qword [rsp + 0x28], rsi
mov r9d, 0x665
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x140044fc7
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140182920
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140044fbc
lea rsi, str.MbCommonSigVerify
call fcn.14000b5d0
lea rcx, [rsp + 0x60]
mov r9d, 0x66f
mov qword [rsp + 0x40], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x38], rbp
lea rcx, str.Checking__ws__ws
mov r10, qword [rax]
lea rdx, str.FindCert
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9, r15
mov qword [rsp + 0x20], r12
mov edx, r14d
call fcn.140045000
mov edi, eax
test eax, eax
jns 0x140044fbc
xor edx, edx
mov dword [rsp + 0x58], 0x200
mov r8d, 0x200
lea rcx, [rsp + 0x60]
inc ebx
call fcn.140182920
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov edx, ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140044f02
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14017fdc0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004c1d0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x238
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov ecx, 0x202
lea rdx, [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14004c1ff
add rsp, 0x238
ret
lea rdx, str.Failed_to_initialize_network_subsystem
lea rcx, [rsp + 0x28]
call fcn.140008fe0
nop
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.14004c280
lea rdx, [0x140296830]
lea rcx, [rsp + 0x48]
call fcn.140182260
int3

Function at 0x140051ab0
Capabilities:
Copy file

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
cmp qword [rcx + 0x18], 0
jne 0x140051afa
xor r9d, r9d
mov r8d, 0x128
lea rdx, str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
lea rcx, str.__path.empty__
call fcn.14004ddc0
movdqa xmm0, xmmword [0x140273a90]
movdqu xmmword [rsp + 0x38], xmm0
xor eax, eax
mov word [rsp + 0x28], ax
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.1400516d0
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsi + 0x28]
cmp qword [rcx + 0x18], 8
jb 0x140051b3b
mov rcx, qword [rcx]
and edi, 1
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140051ba4
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140051b89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051b84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051b9e
call fcn.14017fde4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.14018b33c
nop
lea rcx, [rsi + 8]
call fcn.140051dd0
int3

Function at 0x140051c60
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x140051c8c
xor r9d, r9d
lea rdx, str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
mov r8d, 0x183
lea rcx, str.__path.empty__
call fcn.14004ddc0
mov rcx, rbx
call fcn.140051d40
test al, al
je 0x140051cac
mov rcx, rbx
call fcn.1400521d0
test al, al
je 0x140051cac
xor al, al
add rsp, 0x20
pop rbx
ret
cmp qword [rbx + 0x40], 8
lea rcx, [rbx + 0x28]
jb 0x140051cba
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140051cce
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140051dd0
int3
Function at 0x140051d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x140051d6a
xor r9d, r9d
lea rdx, str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
lea rcx, str.__path.empty__
lea r8d, [r9 + 0x5e]
call fcn.14004ddc0
cmp qword [rbx + 0x40], 8
lea rcx, [rbx + 0x28]
jb 0x140051d78
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140051da0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
ja 0x140051da8
mov ecx, 0x20800c
bt ecx, eax
jae 0x140051da8
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140051dd0
int3

Function at 0x1400521d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1400521fc
xor r9d, r9d
lea rdx, str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
mov r8d, 0x9f
lea rcx, str.__path.empty__
call fcn.14004ddc0
cmp qword [rbx + 0x40], 8
lea rcx, [rbx + 0x28]
jb 0x14005220a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140052220
shr eax, 4
and al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140051dd0
int3

Function at 0x140052230
Capabilities:
Check if file exists

Disassembly:
jmp 0x140052240
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14005226c
xor r9d, r9d
lea rdx, str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.14004ddc0
cmp qword [rbx + 0x40], 8
lea rcx, [rbx + 0x28]
jb 0x14005227a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140052298
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140051dd0
int3

Function at 0x140052240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140052240
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14005226c
xor r9d, r9d
lea rdx, str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.14004ddc0
cmp qword [rbx + 0x40], 8
lea rcx, [rbx + 0x28]
jb 0x14005227a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140052298
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140051dd0
int3
Function at 0x140052550
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rdi, rcx
jne 0x140052580
xor r9d, r9d
lea rdx, str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
mov r8d, 0x160
lea rcx, str.__path.empty__
call fcn.14004ddc0
mov rcx, rdi
lea rbx, [rdi + 0x28]
call fcn.1400521d0
test al, al
je 0x1400525a5
cmp qword [rbx + 0x18], 8
jb 0x14005259a
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400525b8
cmp qword [rbx + 0x18], 8
jb 0x1400525af
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400525c7
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rdi + 8]
call fcn.140051dd0
int3
Function at 0x1400abff0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140180a60
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400bdea0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140180a60
sub rsp, rax
lea rcx, [0x1402a71a8]
add rsp, 0x28
jmp fcn.1400abe50

Function at 0x1400cabb0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1400cabd7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1400cabc0
movzx eax, r9b
ret