joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003a130
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov edi, r9d
mov r14, r8
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003a1ad
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rbx
and edi, 0x300
mov dword [rsp + 0x58], edi
movsxd rsi, eax
test eax, eax
je 0x18003a347
call fcn.18007a540
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x18003a378
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x78]
call fcn.18000fec0
nop
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x58]
call fcn.18000fec0
nop
call fcn.18007a540
mov rdi, rax
mov r9, rsi
lea r8, str.CRegKey_Open_err:_d
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.18007a0d0
nop
mov r9d, 0xbf
lea r8, [rbp + 0x78]
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.180014970
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rdx, [0x1800f4e38]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180013fb0
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rsp + 0x70]
call fcn.180014d70
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18003a2ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x18003a2f5
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003a2f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003a3ad
call fcn.180050b00
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x18003a340
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003a33b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003a3a7
call fcn.180050b00
mov rbx, qword [rsp + 0x50]
jmp 0x18003a378
mov dword [rsp + 0x30], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
test rbx, rbx
je 0x18003a386
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.180050f90
add rsp, 0x1a0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18009e87c
nop
call fcn.18009e87c
int3
Function at 0x18003f9c0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbx + 0x74], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1800419d0
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rbp + 8], rax
mov rbx, r9
mov r13, r8
mov r15, rdx
mov rdi, rcx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], r8
mov qword [rbp], rbx
mov r14d, dword [rbp + 0x80]
xor r12d, r12d
mov dword [rsp + 0x38], r12d
cmp qword [rcx + 0x20128], r12
jne 0x180041a53
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, rcx
lea r8, [0x180044880]
xor edx, edx
xor ecx, ecx
call fcn.1800a309c
mov qword [rdi + 0x20128], rax
mov ecx, 0x28
call fcn.180050ac4
mov rsi, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x180041a89
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.18000ed40
mov r9d, r14d
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.180041e30
mov r12, rax
mov ecx, 0x18
call fcn.180050ac4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180041aaa
mov rcx, rax
call fcn.180043490
mov r14, rax
jmp 0x180041aad
xor r14d, r14d
mov rdx, r15
mov rcx, r14
call fcn.180050330
mov dword [rsp + 0x38], 1
lea rsi, [r13 + 8]
lea rax, [0x180041640]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rbp - 0x70], r14
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x180041b02
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdi
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rbp - 8], r14
lea rcx, [rsp + 0x40]
call fcn.1800421a0
mov qword [rbp - 8], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180041b48
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp - 0x70], r14
lea rcx, [rdi + 0x200e0]
lea rdx, [rbp - 0x40]
call fcn.180050500
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x180041b73
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x180041b8c
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r14
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180041bc2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180041bbd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180041bf4
mov rcx, r8
call fcn.180050b00
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, r15
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.180050f90
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18009e87c
int3
Function at 0x180077ac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov qword [r11 - 0x58], rdx
mov qword [r11 - 0x50], r9
mov rbp, qword [rsp + 0xc0]
xor r15d, r15d
mov dword [r11 - 0x68], r15d
mov qword [r11 - 0x40], r15
xor eax, eax
mov qword [rdx], rax
call fcn.1800121e0
mov rcx, rax
test rax, rax
je 0x180077c90
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdi, [r15 - 1]
test eax, eax
jne 0x180077c51
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180077c40
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x180077c51
add eax, 0x10
mov dword [rsp + 0x50], eax
mov ecx, eax
lea rdx, [0x1800fcab0]
call fcn.18005133c
mov rbx, rax
test rax, rax
je 0x180077c51
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call fcn.18009b770
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180077c02
mov rcx, rbx
call fcn.180050b00
jmp 0x180077c51
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x180077c05
test rax, rax
je 0x180077c38
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x180077c20
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.180013c30
mov rcx, rbx
call fcn.180050b00
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180077c51
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180077c6c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180050f90
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180010a30
int3
Function at 0x180077ca0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x90]
mov rbx, 0xffffffffffffffff
mov rax, rbx
mov qword [rsp + 0x30], r8
mov r15, r9
mov r14, r8
mov r10, rdx
nop
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x180077ce0
mov rdx, qword [r14]
lea ebp, [rax*2 + 2]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
sete sil
test eax, eax
jne 0x180077d5d
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
xor esi, esi
test eax, eax
sete sil
test rcx, rcx
je 0x180077d5d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x180077d78
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180050f90
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180078c00
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r13d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
lea rax, vtable.LogUtils::LogAppender.0
mov qword [rcx], rax
xor edi, edi
mov qword [rcx + 8], rdi
mov dword [rcx + 0x10], edi
mov byte [rcx + 0x14], 1
mov dword [rcx + 0x18], edi
call fcn.1800121e0
mov rcx, rax
test rax, rax
je 0x180078dd5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x20], rax
call fcn.1800121e0
mov rcx, rax
test rax, rax
je 0x180078de0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x28], rax
call fcn.1800121e0
mov rcx, rax
test rax, rax
je 0x180078dca
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x30], rax
mov r14, 0xffffffffffffffff
mov dword [rbx + 0x38], r14d
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov qword [rbx + 0x78], rdi
mov dword [rbx + 0x18], r13d
test rsi, rsi
jne 0x180078cdc
mov eax, edi
jmp 0x180078cea
mov rax, r14
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x180078ce0
mov r8d, eax
mov rdx, rsi
lea rcx, [rbx + 0x20]
call fcn.180013c30
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x28]
call fcn.18002a9b0
test rbp, rbp
je 0x180078d1d
mov rax, r14
nop
inc rax
cmp word [rbp + rax*2], 0
jne 0x180078d10
mov edi, eax
mov r8d, edi
mov rdx, rbp
lea rcx, [rbx + 0x30]
call fcn.180013c30
lea r8, [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180079c70
nop
mov rdx, rax
lea rcx, [rbx + 0x28]
call fcn.18002a9b0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180078d69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rbx + 0x28]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
test rax, rax
je 0x180078daa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180078daa
cmp dword [rbx + 0x18], 0
je 0x180078d9f
mov rcx, qword [rbx + 0x20]
call fcn.1800b6fbc
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.180010a30
nop
mov ecx, 0x80004005
call fcn.180010a30
nop
mov ecx, 0x80004005
call fcn.180010a30
int3
Function at 0x18007b110
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x20], 0x180
lea r9d, [rbp + 0x40]
mov r8d, 0x8109
call fcn.1800b7b9c
mov esi, eax
test eax, eax
je 0x18007b2cf
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x60]
call fcn.18009b770
lea edx, [rbp + 2]
lea r8d, [rbp + 1]
lea rcx, [rsp + 0x60]
call fcn.180014680
nop
lea rdx, str.open
lea rcx, [rsp + 0x60]
call fcn.180013fb0
mov rcx, rax
mov rdx, rdi
call fcn.180013fb0
mov rcx, rax
lea rdx, str._error.__
call fcn.180013fb0
mov rcx, rax
mov edx, esi
call fcn.180078e50
mov rcx, rax
lea rdx, [0x180103a90]
call fcn.180013fb0
nop
movdqa xmm0, xmmword [0x180118160]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], bp
mov dword [rsp + 0x30], 2
mov rcx, qword [rsp + 0xd8]
test cl, 2
jne 0x18007b22d
mov rax, qword [rsp + 0xa8]
mov r8, qword [rax]
test r8, r8
je 0x18007b22d
mov rax, qword [rsp + 0x88]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xd0]
cmovb r8, qword [rsp + 0xd0]
sub r8, rdx
jmp 0x18007b261
test cl, 4
jne 0x18007b26f
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
test rcx, rcx
je 0x18007b26f
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xb8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x38]
call fcn.18000f600
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x18007b2c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007b2bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007b30b
call fcn.180050b00
nop
lea rcx, [rsp + 0x60]
call fcn.180014d70
mov ecx, dword [rbx]
cmp ecx, 0xffffffff
je 0x18007b2e3
xor edx, edx
lea r8d, [rdx + 2]
call fcn.1800b8148
jmp 0x18007b2e8
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180050f90
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
call fcn.18009e87c
nop
int3
Function at 0x18007c4b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x1c0], rbx
mov r14, rdx
mov rsi, rcx
lea rbp, [rcx + 0x28]
xor edx, edx
mov r8d, 0x20000
mov rcx, rbp
call fcn.18009b770
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0x20028]
mov r8d, 0x20000
mov rdx, rbp
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18007c68e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
call fcn.18007a540
mov r8, qword [rax]
lea edx, [r13 + 1]
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x18007c673
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], r13b
lea r8d, [r13 + 0x61]
lea rdx, str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
lea rcx, [rsp + 0x58]
call fcn.18000fec0
nop
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], r13b
lea r8d, [r13 + 3]
lea rdx, [0x1800f4ed4]
lea rcx, [rsp + 0x38]
call fcn.18000fec0
nop
call fcn.18007a540
mov rdi, rax
lea r9d, [r13 + 0x58]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.180014970
mov rbx, rax
lea rdx, str.RecvData_failed__error_code_:
mov rcx, rax
call fcn.180014c00
mov edx, r15d
mov rcx, rbx
call fcn.18007bc40
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rsp + 0x80]
call fcn.180014d70
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x18007c627
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007c622
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007c6e1
call fcn.180050b00
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x18007c673
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007c66e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007c6db
call fcn.180050b00
mov dword [rsi + 0x18], 6
cmp r15d, 0xe8
jne 0x18007c68e
mov dword [rsi + 0x18], 7
mov qword [rsi + 0x20], r13
lea rcx, [r14 + 8]
mov rax, qword [rcx]
mov qword [rcx + 8], rax
mov dword [r14 + 0x20], r13d
movsxd r9, dword [rsi + 0x20028]
add r9, rbp
mov rdx, qword [rcx + 8]
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
mov r8, rbp
call fcn.180042f80
mov dword [r14 + 0x20], r13d
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18009e87c
nop
call fcn.18009e87c
nop
int3
Function at 0x18007c6f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 0x20], 0
jne 0x18007c73b
mov dword [rcx + 0x18], 8
jmp 0x18007c942
mov rax, qword [rdx + 0x10]
sub rax, qword [rdx + 8]
movsxd rdi, eax
lea rcx, [rdi + 1]
call fcn.180050fb4
mov r14, rax
xor r15d, r15d
test rax, rax
je 0x18007c76d
lea r8, [rdi + 1]
xor edx, edx
mov rcx, rax
call fcn.18009b770
mov byte [r14], r15b
jmp 0x18007c770
mov r14, r15
mov dword [rsp + 0x160], r15d
mov rdx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
sub rax, rdx
movsxd r8, eax
mov rcx, r14
call fcn.18009b300
mov r8, qword [rbx + 0x10]
sub r8, qword [rbx + 8]
inc r8d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x160]
mov rdx, r14
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18007c931
mov dword [rsi + 0x18], 5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.18007a540
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x18007c91c
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], r15b
mov r8d, 0x61
lea rdx, str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
lea rcx, [rsp + 0x50]
call fcn.18000fec0
nop
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rsp + 0x30]
call fcn.18000fec0
nop
call fcn.18007a540
mov rdi, rax
mov r9d, 0x48
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.180014970
mov rbx, rax
lea rdx, str.send_failed__error_code_:
mov rcx, rax
call fcn.180014c00
mov edx, ebp
mov rcx, rbx
call fcn.18007bc40
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rsp + 0x78]
call fcn.180014d70
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18007c8d0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007c8cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007c96f
call fcn.180050b00
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18007c91c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007c917
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007c969
call fcn.180050b00
cmp ebp, 0xe8
jne 0x18007c935
mov dword [rsi + 0x18], 7
mov qword [rsi + 0x20], r15
jmp 0x18007c935
mov dword [rsi + 0x18], r15d
mov edx, 1
mov rcx, r14
call fcn.180050b00
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.180050f90
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.18009e87c
nop
call fcn.18009e87c
nop
int3
Function at 0x18007e040
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov r9, rcx
test edx, edx
je 0x18007e124
mov r10d, edx
movzx edx, byte [r9]
lea r9, [r9 + 1]
xor dl, al
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
and r8b, 1
movzx eax, al
cmove eax, ecx
sub r10, 1
jne 0x18007e050
ret
Function at 0x18007fa60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov r15, rcx
xor esi, esi
mov dword [rdx], esi
mov qword [rbp - 0x71], rsi
mov dword [rbp - 0x69], esi
mov qword [rbp - 0x61], rsi
mov r9d, 0x201
mov r8, qword [0x180143250]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x71]
call fcn.18001a100
test eax, eax
jne 0x18007fc22
xor edx, edx
lea r8d, [rsi + 0x64]
lea rcx, [rbp - 0x49]
call fcn.18009b770
mov dword [rsp + 0x30], 0x64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [0x180104884]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18007fc22
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x18007fc22
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x18007fb48
test cl, 1
jne 0x18007fc22
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x4b], si
je 0x18007fb4c
jmp 0x18007fc22
mov word [rbp - 0x49], si
shr ecx, 1
cmp ecx, 0x2d
jne 0x18007fc22
call fcn.1800121e0
mov rcx, rax
test rax, rax
je 0x18007fc56
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x79]
call fcn.18007dc10
mov dword [rsp + 0x34], esi
lea r8, [rsp + 0x34]
lea rdx, [0x18010488c]
lea rcx, [rbp + 0xb]
call fcn.180050970
mov edx, 0x2a
mov rbx, qword [rbp - 0x79]
mov rcx, rbx
call fcn.18007e040
movzx ecx, al
cmp dword [rsp + 0x34], ecx
jne 0x18007fc03
lea rcx, [rbp - 0x49]
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18007fbc4
mov r8d, eax
lea rdx, [rbp - 0x49]
mov rcx, r15
call fcn.180013c30
mov r8d, dword [reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [str.ffffffff]
lea rcx, [rbp - 0x49]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov esi, 1
test eax, eax
jne 0x18007fc01
mov dword [r14], esi
jmp 0x18007fc0a
mov rdi, 0xffffffffffffffff
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18007fc22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x18007fc31
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180050f90
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180010a30
int3