joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400192e0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
call fcn.140016000
xor edi, edi
test eax, eax
je 0x140019350
mov r9d, 0x93
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsInclude_vdi_plugin_installer_helper.cpp
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000e788
nop
lea rdx, str._InstallAutoUpdateVDIPlugin__not_support_arm64_machine
lea rcx, [0x1400ba0c0]
call fcn.140007bbc
nop
lea rcx, [rbp - 0x39]
call fcn.14000e9b4
xor al, al
jmp 0x1400194a5
lea r8, [0x14009a640]
mov rdx, rbx
lea rcx, [rbp + 0xf]
call fcn.14000d660
nop
lea r8, str.ZoomPluginAutoUpdateService64.dll
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.14000d6e0
nop
lea rcx, [rbp + 0xf]
call fcn.140008a38
lea r8, [0x14009a640]
mov rdx, rbx
lea rcx, [rbp + 0x2f]
call fcn.14000d660
nop
lea r8, str.ZoomPluginAutoUpdateService32.dll
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.14000d6e0
nop
lea rcx, [rbp + 0x2f]
call fcn.140008a38
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x140019415
mov r9d, 0x9b
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsInclude_vdi_plugin_installer_helper.cpp
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000e788
nop
lea rbx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rbx, qword [rbp - 0x11]
lea rdx, str._IsNeedInstallAutoUpdateVDIPlugin__file_not_exist:
lea rcx, [0x1400ba1e0]
call fcn.14000d388
mov rcx, rax
mov rdx, rbx
call fcn.14000d388
nop
jmp 0x140019473
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
jne 0x14001947e
mov r9d, 0x9b
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsInclude_vdi_plugin_installer_helper.cpp
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000e788
nop
lea rbx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rbx, qword [rbp - 0x31]
lea rdx, str._IsNeedInstallAutoUpdateVDIPlugin__file_not_exist:
lea rcx, [0x1400ba1e0]
call fcn.14000d388
mov rcx, rax
mov rdx, rbx
call fcn.14000d388
nop
lea rcx, [rbp - 0x39]
call fcn.14000e9b4
jmp 0x14001948f
call fcn.140002880
test eax, eax
je 0x14001948f
call fcn.1400089b0
mov dil, al
lea rcx, [rbp - 0x31]
call fcn.140008a38
nop
lea rcx, [rbp - 0x11]
call fcn.140008a38
mov al, dil
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400775a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140019cb4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x140019d4a
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140019d24
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019d43
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140019d43
mov rdx, qword [rdi]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call qword [case.0x14002de11.0]
jmp 0x140019d33
cmp dword [rdi + 8], 0
je 0x140019d43
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 1
jmp 0x140019d33
cmp byte [0x1400baad0], 0
jne 0x140019d95
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019d81
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x1400baac8], rax
jmp 0x140019d88
mov r10, qword [0x1400baac8]
mov eax, 1
mov byte [0x1400baad0], al
jmp 0x140019d9c
mov r10, qword [0x1400baac8]
mov rcx, qword [rbx]
mov rdx, rsi
test r10, r10
je 0x140019d2d
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rax, r10
call qword [case.0x14002de11.0]
jmp 0x140019d33
Function at 0x14001c0a8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
sub rsp, 0x70
mov bl, r8b
mov rdi, rcx
mov r9b, r8b
mov rdx, rcx
lea rcx, str.zoommtg
call fcn.14001b68c
mov r9b, bl
mov rdx, rdi
lea rcx, str.zoomus
call fcn.14001b68c
xor esi, esi
mov qword [rsp + 0x50], rsi
and dword [rsp + 0x58], esi
and qword [rsp + 0x60], rsi
and qword [rsp + 0xa8], rsi
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyAFDA28A5_1B5F_4635_9877_73DF0D710C9A
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebp, eax
test eax, eax
jne 0x14001c1fe
mov rsi, qword [rsp + 0xa8]
lea rbx, str.Zoom.exe
mov rcx, rbx
call fcn.140057e3c
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
lea ebx, [rbp + 1]
mov r9d, ebx
xor r8d, r8d
lea rdx, str.AppName
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rdi + 0x18], 8
jb 0x14001c193
mov rdi, qword [rdi]
test rdi, rdi
je 0x14001c1c6
mov rcx, rdi
call fcn.140057e3c
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9d, ebx
xor r8d, r8d
lea rdx, str.AppPath
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x98], 3
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Policy
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14001c26b
mov r9d, 0x2e3
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
mov edx, 2
lea rcx, [rsp + 0x98]
call fcn.14000e788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str._RegZoomAppProtocol__failed_to_set_ElevationPolicy:
lea rcx, [0x1400ba0c0]
call fcn.140007bbc
mov rcx, rax
mov edx, ebp
call fcn.1400218c8
mov rcx, rax
lea rdx, [0x14009ca88]
call fcn.140007bbc
mov rcx, rax
mov edx, ebx
call fcn.140005910
nop
lea rcx, [rsp + 0x98]
call fcn.14000e9b4
nop
test rsi, rsi
je 0x14001c279
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d3d4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, edx
xor r15d, r15d
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x40], r15d
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov dword [rsp + 0x20], edx
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings5.0User_AgentPost_Platform
lea r8, [rbp - 0x30]
mov dl, byte [rcx]
lea rcx, [rbp - 0x48]
call fcn.140019f14
mov esi, eax
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001d47b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d476
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d587
call fcn.14002a8f0
test esi, esi
jne 0x14001d4d6
lea rbx, [0x14009b60c]
mov rcx, rbx
call fcn.140057e3c
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, str.Zoom_3.6.0
mov rdi, qword [rbp - 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test rdi, rdi
je 0x14001d4d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x40], r15d
jmp 0x14001d4da
mov rdi, qword [rbp - 0x48]
mov r9d, 0x3d9
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.14000e788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str._UnregMIMEZoommtg__Add_user_agent_postfix_ret:
lea rcx, [0x1400ba0c0]
call fcn.140007bbc
mov rcx, rax
mov edx, esi
call fcn.1400218c8
mov rcx, rax
lea rdx, str._flag:
call fcn.140007bbc
mov rcx, rax
mov edx, r14d
call fcn.140005910
mov rcx, rax
lea rdx, [0x14009ca88]
call fcn.140007bbc
mov rcx, rax
mov edx, ebx
call fcn.140005910
nop
lea rcx, [rbp - 0x50]
call fcn.14000e9b4
nop
test rdi, rdi
je 0x14001d564
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400775a0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140058698
nop
int3
Function at 0x14001d90c
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x50
mov ebp, edx
and qword [rax - 0x28], 0
and dword [rax - 0x20], 0
and qword [rax - 0x18], 0
lea r8, [rcx + 8]
mov dword [rax - 0x38], edx
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings5.0User_AgentPost_Platform
mov dl, byte [rcx]
lea rcx, [rax - 0x28]
call fcn.140019f14
mov esi, eax
mov rdi, qword [rsp + 0x30]
test eax, eax
jne 0x14001d980
lea rdx, str.Zoom_3.6.0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test rdi, rdi
je 0x14001d97b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov qword [rsp + 0x30], rdi
and dword [rsp + 0x38], 0
mov r9d, 0x414
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14000e788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str._UnregMIMEZoommtg__Remove_user_agent_postfix_ret:
lea rcx, [0x1400ba0c0]
call fcn.140007bbc
mov rcx, rax
mov edx, esi
call fcn.1400218c8
mov rcx, rax
lea rdx, str._flag:
call fcn.140007bbc
mov rcx, rax
mov edx, ebp
call fcn.140005910
mov rcx, rax
lea rdx, [0x14009ca88]
call fcn.140007bbc
mov rcx, rax
mov edx, ebx
call fcn.140005910
nop
lea rcx, [rsp + 0x60]
call fcn.14000e9b4
nop
test rdi, rdi
je 0x14001da0b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001de98
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x14009dd60]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001e0ae
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14000c6dc
nop
lea rcx, [0x14009a640]
call fcn.140057e3c
mov r8, rax
lea rdx, [0x14009a640]
lea rcx, [rsp + 0x70]
call fcn.140008a9c
lea rcx, str.Zoom.exe
call fcn.140057e3c
mov r8, rax
lea rdx, str.Zoom.exe
lea rcx, [rsp + 0x70]
call fcn.140008a9c
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x70]
call fcn.14007c100
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
lea r15d, [r14 + 7]
mov qword [rsp + 0x68], r15
mov word [rsp + 0x50], r14w
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x70]
lea rdx, str.Zoom
lea rcx, [rsp + 0x38]
call fcn.140008f5c
test eax, eax
jne 0x14001dfd6
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400089b4
cmp qword [rsp + 0x60], r14
je 0x14001e00f
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140021b64
cmp rax, 0xffffffffffffffff
jne 0x14001e00f
lea rdx, str.__backgroundtrue
lea rcx, [rsp + 0x50]
call fcn.140021aa4
mov bl, 1
cmp rax, 0xffffffffffffffff
je 0x14001e012
mov byte [rsi], bl
jmp 0x14001e012
mov bl, r14b
mov esi, 0x1000
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14001e055
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x14001e050
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e0ed
call fcn.14002a8f0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14001e09e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, rsi
jb 0x14001e099
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e0e7
call fcn.14002a8f0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r15
mov word [rsp + 0x70], r14w
jmp 0x14001e0b1
mov bl, r14b
test rdi, rdi
je 0x14001e0bf
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400775a0
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140058698
nop
call fcn.140058698
int3
Function at 0x140021180
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x37], rsi
mov qword [rbp + 0x3f], 7
mov word [rbp + 0x27], si
lea rdx, str.Software_
lea rcx, [rbp + 0x27]
call fcn.1400089b4
nop
lea rcx, str.ZoomUMX
call fcn.140057e3c
mov r8, rax
lea rdx, str.ZoomUMX
lea rcx, [rbp + 0x27]
call fcn.140008a9c
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rdx, qword [rbp + 0x27]
mov qword [rbp - 1], rsi
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov edi, 0x2001f
mov r9d, edi
xor r8d, r8d
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002122f
mov rbx, qword [rbp - 1]
jmp 0x14002127b
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rdx, qword [rbp + 0x27]
mov qword [rbp + 7], rsi
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140021334
mov rbx, qword [rbp + 7]
mov qword [rbp + 0xf], rsi
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.PerInstall
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400212a8
mov rdi, qword [rbp + 0xf]
jmp 0x1400212e9
mov qword [rbp + 0x17], rsi
lea rax, [rbp + 0x23]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PerInstall
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140021325
mov rdi, qword [rbp + 0x17]
mov dword [rbp - 9], 1
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.InstalledShortcut
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140021325
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140021334
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x140021370
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002136b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021395
call fcn.14002a8f0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400775a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140058698
int3
Function at 0x140022358
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rcx, rdx
call fcn.14002be50
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
test eax, eax
jne 0x1400223dc
mov r9d, 0xb0
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsNoMSIInstaller7zPackageHepler.cpp
lea edx, [rbx + 2]
lea rcx, [rsp + 0x30]
call fcn.14000e788
nop
mov rcx, rdi
call fcn.14002be50
mov rbx, rax
lea rdx, str.C7zWrap::CreateDir____create_directory_failed__directory_is:
lea rcx, [0x1400ba1e0]
call fcn.14000d388
mov rcx, rax
mov rdx, rbx
call fcn.14000d388
nop
lea rcx, [rsp + 0x30]
call fcn.14000e9b4
mov ebx, 0x2778
mov rcx, rdi
call fcn.14002bdc0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140022510
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.14002be50
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140026220
test eax, eax
je 0x14002259e
mov r9d, 0xcf
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsNoMSIInstaller7zPackageHepler.cpp
mov edx, 2
lea rcx, [rbp + 0x38]
call fcn.14000e788
nop
mov rcx, rdi
call fcn.14002be50
mov rbx, rax
lea rdx, str.C7zWrap::OutFile____open_dest_file_failed__filename_is:
lea rcx, [0x1400ba1e0]
call fcn.14000d388
mov rcx, rax
mov rdx, rbx
call fcn.14000d388
nop
lea rcx, [rbp + 0x38]
call fcn.14000e9b4
mov ebx, 0x2779
jmp 0x14002263e
mov rax, qword [rbx + 0x398]
mov qword [rbp + 0x38], rax
mov rdx, qword [rbx + 0x3a0]
add rdx, qword [rbx + 0x380]
lea r8, [rbp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.1400262ec
test eax, eax
jne 0x1400226ad
mov rax, qword [rbx + 0x398]
cmp qword [rbp + 0x38], rax
jne 0x1400226ad
lea rcx, [rbp - 0x10]
call fcn.14002622c
test eax, eax
je 0x14002264d
mov r9d, 0xda
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsNoMSIInstaller7zPackageHepler.cpp
mov edx, 2
lea rcx, [rbp + 0x38]
call fcn.14000e788
nop
mov rcx, rdi
call fcn.14002be50
mov rbx, rax
lea rdx, str.C7zWrap::OutFile____close_dest_file_failed__filename_is:
lea rcx, [0x1400ba1e0]
call fcn.14000d388
mov rcx, rax
mov rdx, rbx
call fcn.14000d388
nop
lea rcx, [rbp + 0x38]
call fcn.14000e9b4
mov ebx, 0x277b
mov rcx, rdi
call fcn.14002bdc0
mov eax, ebx
jmp 0x14002270a
mov r8, qword [rbx + 0x310]
test r8, r8
je 0x1400226a1
mov cl, sil
and cl, 7
mov edx, 0x80
sar edx, cl
mov rax, rsi
shr rax, 3
test byte [rax + r8], dl
je 0x1400226a1
mov rax, qword [rbx + 0x318]
mov ecx, dword [rax + rsi*4]
mov eax, ecx
mov edx, ecx
and edx, 0x7fff
and eax, 0xf0000000
cmove edx, ecx
mov rcx, rdi
call fcn.14002be50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
mov rcx, rdi
call fcn.14002bdc0
xor eax, eax
jmp 0x14002270a
mov r9d, 0xd5
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsNoMSIInstaller7zPackageHepler.cpp
mov edx, 2
lea rcx, [rbp + 0x38]
call fcn.14000e788
nop
mov rcx, rdi
call fcn.14002be50
mov rbx, rax
lea rdx, str.C7zWrap::OutFile____write_dest_file_failed__filename_is:
lea rcx, [0x1400ba1e0]
call fcn.14000d388
mov rcx, rax
mov rdx, rbx
call fcn.14000d388
nop
lea rcx, [rbp + 0x38]
call fcn.14000e9b4
nop
mov rcx, rdi
call fcn.14002bdc0
mov eax, 0x277a
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025358
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
lea r11, [0x1400bbac0]
xor edx, edx
mov r8, r11
mov r9d, edx
mov r10d, 8
mov ecx, r9d
mov eax, r9d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r9d, ecx
xor r9d, eax
sub r10, 1
jne 0x140025371
mov dword [r8], r9d
inc edx
add r8, 4
cmp edx, 0x100
jb 0x140025368
lea r8, [0x1400bbec0]
mov r9d, 0x700
mov edx, dword [r8 - 0x400]
movzx ecx, dl
shr edx, 8
xor edx, dword [r11 + rcx*4]
mov dword [r8], edx
lea r8, [r8 + 4]
sub r9, 1
jne 0x1400253ae
lea rax, [0x140025400]
mov qword [0x1400bbab0], rax
call fcn.140026e24
mov rcx, qword [0x1400bbab0]
lea rdx, [0x1400254d0]
test eax, eax
cmove rcx, rdx
mov qword [0x1400bbab0], rcx
add rsp, 0x28
ret

Function at 0x1400262ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, qword [r8]
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test rbx, rbx
je 0x14002635a
and qword [r8], 0
mov r15d, 0x400000
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
mov r8d, ebx
cmp rbx, r15
mov rdx, rsi
cmova r8d, r15d
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rsp + 0x60]
add qword [rdi], rdx
add rsi, rdx
sub rbx, rdx
test eax, eax
je 0x140026370
test edx, edx
je 0x14002635a
test rbx, rbx
jne 0x14002631a
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002635c

Function at 0x1400269c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
and rdx, 0xfffffffffffffffe
mov r9, rcx
mov r8, rcx
lea r11, [rdx - 4]
mov rdx, rcx
add r11, rcx
cmp rdx, r11
ja 0x140026a52
movzx r10d, byte [r8 + 1]
movzx eax, byte [r8 + 3]
xor r10d, 8
lea r8, [rdx + 2]
and eax, r10d
mov rbx, r8
mov rdx, r8
cmp eax, 0xf8
jb 0x1400269d9
movzx ecx, byte [r8 - 2]
movzx eax, byte [r8 + 1]
and eax, 7
shl r10d, 8
add ecx, r10d
lea edx, [rax + rcx*8]
movzx eax, byte [r8]
shl edx, 8
add r8, 2
add edx, eax
mov eax, r8d
sub eax, r9d
shr eax, 1
sub edx, eax
mov eax, edx
mov byte [rbx], dl
shr eax, 0xb
mov byte [rbx - 2], al
mov eax, edx
shr eax, 0x13
and al, 7
shr edx, 8
or al, 0xf0
or dl, 0xf8
mov byte [rbx - 1], al
mov byte [rbx + 1], dl
mov rdx, r8
jmp 0x1400269d9
mov rbx, qword [rsp + 8]
sub rdx, r9
mov rax, rdx
ret