joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140260250
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x14038ac40]
lea rcx, [rbp - 0x28]
mov sil, dl
xor r14d, r14d
lea rdx, str.Sense
mov word [rbp - 0x28], r14w
movdqu xmmword [rbp - 0x18], xmm0
call fcn.14004d5c4
lea r8d, [r14 + 3]
mov qword [rbp - 0x38], r14
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x38]
call fcn.14024f3dc
mov edi, eax
test eax, eax
jns 0x140260305
cmp qword [rbp - 0x10], 8
lea rax, [rbp - 0x28]
mov rcx, qword [rbp + 0x18]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
cmovae rax, qword [rbp - 0x28]
mov r9d, edi
mov qword [rsp + 0x28], rax
mov edx, 0x1fe
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
call fcn.140177750
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1402603d0
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x1402603d0
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x40]
mov rcx, rbx
lea edx, [r9 - 1]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfig2W]
test eax, eax
jne 0x140260368
cmp qword [rbp - 0x10], 8
lea rax, [rbp - 0x28]
mov rcx, qword [rbp + 0x18]
lea r9, str.Failed_to_query_the_service__ws_delayed_auto_start_info.
cmovae rax, qword [rbp - 0x28]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x203
mov qword [rsp + 0x20], rax
call fcn.1401ff8d0
mov edi, eax
test rbx, rbx
je 0x1402603d0
mov rcx, rbx
jmp 0x1402602fa
movzx edi, sil
cmp dword [rbp - 0x40], edi
je 0x1402603bf
lea r8, [rbp - 0x40]
mov dword [rbp - 0x40], edi
mov edx, 3
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1402603bf
cmp qword [rbp - 0x10], 8
lea rax, [rbp - 0x28]
mov rcx, qword [rbp + 0x18]
lea r9, str.Failed_to_change_the_service__ws_start_type_to_delayed_auto_start__d.
cmovae rax, qword [rbp - 0x28]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov dword [rsp + 0x28], edi
mov edx, 0x20a
mov qword [rsp + 0x20], rax
call fcn.1401ff8d0
jmp 0x14026035c
test rbx, rbx
je 0x1402603cd
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov edi, r14d
lea rcx, [rbp - 0x28]
call fcn.14004e0f0
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140260400
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
mov qword [rbp - 9], rsi
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
lea r14, str.Sense
mov rdx, r14
lea rcx, [rbp + 7]
call fcn.14004d5c4
lea r8d, [rsi + 4]
lea rdx, [rbp + 7]
lea rcx, [rbp - 9]
call fcn.14024f3dc
mov edi, eax
lea rcx, [rbp + 7]
call fcn.14004e0f0
test edi, edi
jns 0x1402604bf
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], r14
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.amcorewcd_sourceonboardingonboardingmanager_senseservicesettings.cpp
lea edx, [rsi + 0x43]
call fcn.140177750
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140260545
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x140260545
lea rdx, [rbp + 0x27]
mov rbx, qword [rbp - 9]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x1402604ff
lea r9, str.Cannot_query_service_status_for_service__ws
lea edx, [rax + 0x49]
lea r8, str.amcorewcd_sourceonboardingonboardingmanager_senseservicesettings.cpp
mov qword [rsp + 0x20], r14
mov rcx, qword [rbp + 0x5f]
call fcn.1401ff8d0
mov edi, eax
test rbx, rbx
je 0x140260545
mov rcx, rbx
jmp 0x1402604b4
or dword [rbp + 0x2f], 1
mov rcx, qword [0x1404a3b08]
test rcx, rcx
jne 0x14026051b
call fcn.1402b9bb8
mov rcx, qword [0x1404a3b08]
lea rdx, [rbp + 0x27]
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x140260535
lea r9, str.Cannot_set_service_status_for_service__ws
lea edx, [rax + 0x51]
jmp 0x1402604de
test rbx, rbx
je 0x140260543
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov edi, esi
test edi, edi
jns 0x14026054d
mov eax, edi
jmp 0x140260580
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
mov rdx, r14
lea rcx, [rbp + 7]
call fcn.14004d5c4
lea rcx, [rbp + 7]
call fcn.14024f744
mov ebx, eax
lea rcx, [rbp + 7]
call fcn.14004e0f0
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402605b0
Capabilities:
Modify service

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp + 0x17], xmm0
xor esi, esi
mov word [rbp + 7], si
lea rdx, [0x140344690]
lea rcx, [rbp + 7]
call fcn.14004d5c4
nop
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], si
lea rdx, str.Sense
lea rcx, [rbp - 0x19]
call fcn.14004d5c4
mov qword [rbp - 0x29], rsi
lea r8d, [rsi + 2]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.14024f3dc
mov edi, eax
test eax, eax
jns 0x14026068c
lea rax, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rax, qword [rbp - 0x19]
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x1e3
call fcn.140177750
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14026075b
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x14026075b
xor r8d, r8d
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x27]
call fcn.14007f1bc
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
or edx, 0xffffffff
mov r9d, edx
mov r8d, edx
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140260740
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, str.Cannot_add_the_dependency_on__ws_to_service__ws
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x1f4
call fcn.1401ff8d0
mov edi, eax
lea rcx, [rbp + 0x27]
call fcn.14004e0f0
cmp qword [rbp - 0x29], rsi
je 0x14026075b
mov rcx, qword [rbp - 0x29]
jmp 0x140260681
lea rcx, [rbp + 0x27]
call fcn.14004e0f0
cmp qword [rbp - 0x29], rsi
je 0x140260759
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov edi, esi
lea rcx, [rbp - 0x19]
call fcn.14004e0f0
nop
lea rcx, [rbp + 7]
call fcn.14004e0f0
mov eax, edi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0xe0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1402684d4
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ebx, ebx
test eax, eax
jne 0x140268596
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x14026858d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], WSAStartup
mov qword [rsp + 0x60], rax
lea edx, [rbx + 4]
lea rax, str.DataCollection_adapter_failed_to_read_Windows_Directory
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x1403e40f6]
call fcn.140001158
lea rdx, [0x140344690]
jmp 0x14026859a
lea rdx, [rbp - 0x80]
movdqa xmm0, xmmword [0x14038ac40]
lea rcx, [0x1404b9828]
movdqu xmmword [0x1404b9838], xmm0
mov word [0x1404b9828], bx
call fcn.14004d5c4
lea rax, [0x1404b9828]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rbp
ret

Function at 0x1402685e4
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
xor ebx, ebx
test eax, eax
jne 0x1402686ae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x34], ecx
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1402686a5
lea rax, [rsp + 0x34]
mov qword [rsp + 0x78], WSAStartup
mov qword [rsp + 0x60], rax
lea edx, [rbx + 4]
lea rax, str.DataCollection_adapter_failed_to_read_Profiles_Directory
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x1403e40f6]
call fcn.140001158
lea rdx, [0x140344690]
jmp 0x1402686b2
lea rdx, [rbp - 0x80]
movdqa xmm0, xmmword [0x14038ac40]
lea rcx, [0x1404b9848]
movdqu xmmword [0x1404b9858], xmm0
mov word [0x1404b9848], bx
call fcn.14004d5c4
lea rax, [0x1404b9848]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rbp
ret
Function at 0x140274e38
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov dil, dl
cmp qword [rcx + 0x18], 8
jb 0x140274e51
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x140274e7f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp dil, 1
jne 0x140274e71
cmp eax, 0xb7
je 0x140274e7f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140278a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x140278a83
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x140278ab2
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x140278a94
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140278aea
cmp qword [rcx + rdx*8], rdi
jne 0x140278adf
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140278ae3
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140278af7
cmp qword [rcx + rdx*8], rdi
jne 0x140278af7
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140064fe4
mov rcx, rsi
call fcn.14004e0f0
mov rcx, rdi
call fcn.1402e0278
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x14027f2a4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rbx, [rcx + 0x20]
mov dword [rsp + 0x58], edx
xor ecx, ecx
mov r9d, edx
movabs r8, 0xcbf29ce484222325
movzx eax, byte [rsp + rcx + 0x58]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14027f2ca
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r10*8], rdx
jne 0x14027f311
mov rcx, rdx
jmp 0x14027f319
mov rcx, qword [r8 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14027f32e
cmp dword [rax + 0x10], r9d
je 0x14027f329
mov rax, qword [rax]
jmp 0x14027f306
mov rcx, rax
jmp 0x14027f334
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x14027f3b2
mov rdi, qword [rdx]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov rdx, rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.14027f5c0
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14027f387
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14027f3c8
mov rax, qword [rsp + 0x30]
inc dword [rax + 0x14]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14027f3c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14027f3fe
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14027f489
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14027f489
mov ecx, dword [r10]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x14027f457
cmp rdi, qword [rax + r8*8]
jne 0x14027f446
jmp 0x14027f489
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.1402e0278
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x14027f5b7
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14027f4c3
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14027f4e0
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14027f50f
cmp rax, rdi
jne 0x14027f4eb
mov qword [rdx + r8*8], rbx
jmp 0x14027f50f
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14027f50f
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14038ac0c]
test rax, rax
jns 0x14027f530
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14027f541
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14027f5ac
cmp rdx, 0x200
jae 0x14027f559
shl rdx, 3
jmp 0x14027f56b
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14027f56b
add rdx, rdx
mov rcx, rsi
call fcn.1400591e0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14027f5a7
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14027f3c8
cmp rdi, qword [rsp + 0x20]
jne 0x14027f585
mov r9, qword [rsp + 0x78]
mov qword [r9], rbx
mov byte [r9 + 8], 1
mov rax, r9
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14027f5f4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14027f611
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14027f669
cmp qword [rcx + rdx*8], r8
jne 0x14027f65e
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14027f662
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14027f676
cmp qword [rcx + rdx*8], r8
jne 0x14027f676
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.1402e0278
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1402877b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov r9, r8
mov r11, qword [r8 + 0x10]
mov rsi, rdx
mov r15, rcx
mov r10, r8
jb 0x1402877e6
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x140287819
movzx eax, byte [rcx + r10]
movabs rbx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rbx
cmp rcx, rdx
jb 0x1402877fb
mov rcx, qword [r15 + 0x30]
mov r12, qword [r15 + 0x18]
and rcx, r8
mov rbx, qword [r15 + 8]
mov rax, rcx
add rax, rax
lea r13, [rcx + rcx]
mov rax, qword [r12 + rax*8]
cmp qword [r12 + r13*8], rbx
jne 0x140287841
mov rcx, rbx
jmp 0x140287849
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14028790b
cmp qword [r9 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r9
jb 0x140287863
mov rdx, qword [r9]
mov r14, qword [rcx + 0x18]
mov r8, rcx
cmp r14, 8
jb 0x140287873
mov r8, qword [rcx]
mov rbp, qword [rcx + 0x10]
cmp rbp, r11
jne 0x1402878a6
mov rdi, rbp
test rbp, rbp
je 0x1402878a0
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jne 0x1402878ab
add rdx, 2
sub rdi, 1
jne 0x140287887
xor ecx, ecx
test ecx, ecx
je 0x1402878b4
mov rax, qword [rax]
jmp 0x140287836
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1402878a2
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1402878c1
mov rcx, qword [rcx]
cmp qword [r9 + 0x18], 8
mov rdx, r9
jb 0x1402878ce
mov rdx, qword [r9]
cmp r11, rbp
jne 0x1402878fa
test r11, r11
je 0x1402878f4
sub rdx, rcx
movzx r8d, word [rdx + rcx]
movzx r10d, word [rcx]
cmp r8w, r10w
jne 0x140287902
add rcx, 2
sub r11, 1
jne 0x1402878db
xor ecx, ecx
test ecx, ecx
je 0x1402878fd
mov rax, rbx
mov rcx, rax
jmp 0x140287911
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1402878f6
mov rax, rbx
mov rcx, rbx
cmp rcx, rbx
jne 0x140287985
mov rbx, qword [rbx]
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.14027f244
mov rdx, rax
movabs rcx, 0x3fffffffffffffe
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14028795f
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14027efc8
jmp 0x14028798c
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14028f12c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x31], rdx
and dword [rbp - 0x39], 0
mov ecx, 0x28
call fcn.1402e0358
mov rdi, rax
mov qword [rbp - 0x41], rax
mov eax, 1
mov dword [rdi + 8], eax
mov dword [rdi + 0xc], eax
lea rax, vtable.std::_Ref_count_obj_class_sense::machineStateCollection::MachinePropertiesState_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov qword [rbp - 0x21], rbx
and dword [rbx], 0
lea rcx, [rbx + 8]
call fcn.140178f68
mov byte [rbx + 0x14], 0
or eax, 0xffffffff
mov dword [rbx], eax
mov dword [rbx + 0x10], eax
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov dword [rbp - 0x39], 3
mov rdx, r14
mov rcx, rsi
call fcn.14028eecc
lea rdx, [rsi + 8]
lea rcx, [0x1404a11e0]
call fcn.14029610c
test al, al
je 0x14028f275
lea r9, [rbp - 0x31]
mov r8d, 2
lea rdx, [rbp - 0x49]
mov ecx, SysAllocStringByteLen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp - 0x41], eax
test eax, eax
jns 0x14028f263
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x14028f258
lea rax, str.Machine_properties_state_collector___failed_to_get_SystemSecureBootInformation
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x9e
and dword [rbp + 0x23], 0
lea rax, [rbp - 0x41]
mov qword [rbp + 0x27], rax
mov edx, 4
mov dword [rbp + 0x2f], edx
and dword [rbp + 0x33], 0
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403e55f9]
call fcn.140001158
mov rcx, qword [r14]
mov eax, dword [rbp - 0x41]
mov dword [rcx + 0x10], eax
jmp 0x14028f275
mov cl, byte [rbp - 0x49]
mov rdx, qword [r14]
and dword [rdx + 0x10], 0
test cl, cl
setne cl
mov byte [rdx + 0x14], cl
mov rax, r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret