joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b21a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x40
cmp qword [rcx + 0x10], 0
mov r14, r8
mov rbx, rdx
mov rbp, rcx
jne 0x1400b21d3
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov qword [rsp + 0x58], rdi
xor sil, sil
call fcn.1400b9ae0
cmp qword [rax + 0x18], 7
jbe 0x1400b21f7
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov edi, eax
call fcn.1400166f0
cmp edi, 0xffffffff
je 0x1400b225a
mov rcx, rbp
mov sil, 1
call fcn.1400b9e60
test al, al
je 0x1400b2228
mov dword [rbx], 2
jmp 0x1400b2279
bt edi, 0xa
jae 0x1400b224c
mov dword [rbx], 3
test r14, r14
je 0x1400b2279
test dil, 0x10
mov eax, 0
setne al
inc eax
mov dword [r14], eax
jmp 0x1400b2279
movzx eax, dil
shr eax, 4
and eax, 1
mov dword [rbx], eax
jmp 0x1400b2279
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400b2270
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1400b2279
mov sil, 1
mov dword [rbx], 4
mov rdi, qword [rsp + 0x58]
movzx eax, sil
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400b27b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rdx, [0x14042940c]
lea rcx, [rsp + 0x20]
call fcn.140030cb0
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14009d540
mov rdi, qword [rbx + 0x10]
cmp rdi, rax
cmovb rax, rdi
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400b2819
mov rcx, qword [rbx]
sub rdi, rax
lea rdx, [rcx + rax*2]
lea r8, [rdi*2 + 2]
call fcn.140305e90
mov qword [rbx + 0x10], rdi
lea rcx, [rsp + 0x20]
call fcn.1400166f0
lea rdx, [0x14041f038]
lea rcx, [rsp + 0x20]
call fcn.140030cb0
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14009d030
nop
lea rcx, [rsp + 0x20]
call fcn.1400166f0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140306610
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400b2884
mov rcx, qword [rbx]
mov r8d, 0x104
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1400b28a5
mov rcx, rbx
call fcn.1400166f0
xor al, al
jmp 0x1400b28d4
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400b28b1
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140030940
nop
mov rcx, rbx
call fcn.1400166f0
mov al, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1402b5c00
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400b3220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
sub rsp, 0x40
cmp qword [rcx + 0x10], 0
mov rsi, rcx
jne 0x1400b3238
xor al, al
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x58], rdi
mov rdx, rsi
xor dil, dil
call fcn.1400b9ae0
cmp qword [rax + 0x18], 7
jbe 0x1400b325c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.1400166f0
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x50]
je 0x1400b3295
mov rcx, rsi
mov dil, 1
call fcn.1400b9e60
movzx eax, dil
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400b32ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1400b32ae
mov dil, 1
movzx eax, dil
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret

Function at 0x1400b32c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1400b3351
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400b9ae0
cmp qword [rax + 0x18], 7
jbe 0x1400b32eb
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov edi, eax
call fcn.1400166f0
cmp edi, 0xffffffff
je 0x1400b3340
mov rcx, rbx
call fcn.1400b9e60
test al, al
je 0x1400b3318
mov eax, 2
jmp 0x1400b332f
bt edi, 0xa
jae 0x1400b3325
mov eax, 3
jmp 0x1400b332f
movzx eax, dil
shr eax, 4
and eax, 1
test eax, eax
jne 0x1400b3351
mov al, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400b3351
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x58]
xor al, al
add rsp, 0x40
pop rdi
ret

Function at 0x1400b3360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1400b33f0
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400b9ae0
cmp qword [rax + 0x18], 7
jbe 0x1400b338b
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov edi, eax
call fcn.1400166f0
cmp edi, 0xffffffff
je 0x1400b33df
mov rcx, rbx
call fcn.1400b9e60
test al, al
je 0x1400b33b8
mov eax, 2
jmp 0x1400b33cf
bt edi, 0xa
jae 0x1400b33c5
mov eax, 3
jmp 0x1400b33cf
movzx eax, dil
shr eax, 4
and eax, 1
cmp eax, 1
jne 0x1400b33f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400b33f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x58]
xor al, al
add rsp, 0x40
pop rdi
ret
Function at 0x1400b4290
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, r8
mov rbx, rdx
mov qword [rbp - 0x59], rdx
xor edi, edi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov rax, r8
cmp qword [r8 + 0x18], 7
jbe 0x1400b42d3
mov rax, qword [r8]
mov qword [r8 + 0x10], rdi
mov word [rax], di
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400b4450
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400b4332
xor edx, edx
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400b4450
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400b433f
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
add r8d, r8d
xor r9d, r9d
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400b4439
mov dword [rbp - 0x41], reloc.WS2_32.dll_sendto
mov dword [rsp + 0x20], edi
lea r9, [rbp - 0x41]
lea r8, [rbp + 0x27]
mov edx, 2
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400b4439
mov r9d, dword [rbp - 0x41]
cmp r9d, 0x14
ja 0x1400b4439
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov word [rbp + 0x17], ax
test r9d, r9d
je 0x1400b43f4
lea r10, [rbp + 0x27]
lea r11, str.0123456789abcdef
movzx r8d, byte [r10]
lea edx, [rdi + rdi]
mov eax, r8d
shr rax, 4
movzx eax, word [r11 + rax*2]
mov word [rbp + rdx*2 - 0x39], ax
and r8d, 0xf
lea ecx, [rdx + 1]
movzx eax, word [r11 + r8*2]
mov word [rbp + rcx*2 - 0x39], ax
inc edi
lea r10, [r10 + 1]
cmp edi, r9d
jb 0x1400b43c0
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rax, [rbp - 0x39]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400b4415
lea rdx, [rbp - 0x39]
mov rcx, rsi
call fcn.140030940
nop
mov rcx, rbx
call fcn.1400166f0
mov al, 1
jmp 0x1400b445a
xor edx, edx
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
nop
mov rcx, rbx
call fcn.1400166f0
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b48a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov dword [rsp + 0x40], 7
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov dword [rsp + 0x30], edi
mov rax, rdx
jbe 0x1400b48d7
mov rax, qword [rdx]
mov qword [rdx + 0x10], rdi
mov r9d, 0x101
mov word [rax], di
lea rdx, str.SoftwareMicrosoftCryptography
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b49a2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.MachineGuid
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b4997
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400b4997
mov ecx, eax
call fcn.1402b6274
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rdi, rax
lea rdx, str.MachineGuid
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b498f
mov r8d, dword [rsp + 0x30]
mov rdx, rdi
shr r8, 1
mov rcx, rbx
dec r8
call fcn.140030940
mov rcx, rdi
call fcn.1402b5c4c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b49c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov dword [rbp - 0x30], 7
xor esi, esi
mov dword [rbp - 0x40], esi
mov rax, rdx
cmp qword [rdx + 0x18], 7
jbe 0x1400b4a01
mov rax, qword [rdx]
mov qword [rdx + 0x10], rsi
mov word [rax], si
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.HardwareDescriptionSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b4b9a
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosVersion
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b4ab5
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400b4ab5
mov ecx, eax
call fcn.1402b6274
mov rdi, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosVersion
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b4aad
mov r8d, dword [rbp - 0x40]
shr r8, 1
mov rdx, rdi
mov rcx, rbx
call fcn.140030940
mov rcx, rdi
call fcn.1402b5c4c
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1400b4ac9
mov rcx, qword [rbx]
lea rax, [rcx + rax*2]
jmp 0x1400b4ad0
lea rax, [rbx + rax*2]
mov rcx, rbx
cmp rcx, rax
je 0x1400b4ae8
cmp word [rcx], si
jne 0x1400b4adf
mov word [rcx], 0x3a
add rcx, 2
cmp rcx, rax
jne 0x1400b4ad5
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b4b90
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400b4b90
mov ecx, eax
call fcn.1402b6274
mov rdi, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b4b88
mov r8d, dword [rbp - 0x40]
shr r8, 1
dec r8
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14002d9c0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rbx
call fcn.14002ac00
nop
lea rcx, [rbp - 0x28]
call fcn.1400166f0
mov rcx, rdi
call fcn.1402b5c4c
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402b5c00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400b5bd0
Capabilities:
Get mac address on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, rdx
mov qword [rsp + 0x58], rdx
xor ebp, ebp
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x40], eax
call fcn.1400b3e80
test al, al
jne 0x1400b5d9c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xc0], eax
mov qword [rsp + 0x68], rbp
mov ecx, 0x16027
call fcn.1402b5c5c
test rax, rax
je 0x1400b5e08
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x60], rcx
lea rbx, [rcx + 0x16000]
mov qword [rsp + 0x70], rbx
xor edx, edx
mov r8d, 0x16000
call fcn.140306610
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x60]
sub rbx, rcx
movabs rax, 0x2e8ba2e8ba2e8ba3
imul rbx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x2c0
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x58]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400b5d90
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
lea edi, [rbp + 0x12]
cmp dword [rbx + 0x1a0], eax
jae 0x1400b5d3b
movzx eax, byte [rbx + 0x19d]
movzx ecx, byte [rbx + 0x19c]
movzx edx, byte [rbx + 0x19b]
movzx r8d, byte [rbx + 0x19a]
movzx r10d, byte [rbx + 0x199]
movzx r9d, byte [rbx + 0x198]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
lea r8, str._02X:_02X:_02X:_02X:_02X:_02X
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1400aa1b0
mov eax, dword [rbx + 0x1a0]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400b5cd3
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0xa0]
lea rax, [rsp + 0x78]
sub rdx, rax
nop dword [rax + rax]
lea rax, [rdi + 0x7fffffec]
test rax, rax
je 0x1400b5d82
movzx eax, word [rdx + rcx]
test ax, ax
je 0x1400b5d82
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x1400b5d60
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], bp
lea rcx, [rsp + 0x60]
call fcn.1400b8db0
jmp 0x1400b5dcf
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
mov dword [rsp + 0x58], eax
cmp eax, 1
jbe 0x1400b5db8
cmp eax, 0x80010106
jne 0x1400b5dc3
lea rdx, [rsp + 0x78]
call fcn.1400b5e10
nop
cmp ebx, 1
ja 0x1400b5dcf
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140030cb0
mov rax, rsi
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1402b5c00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1402c5d0c
int3
Function at 0x1400b96d0
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdx], xmm0
mov rbx, rcx
movups xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x20], eax
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x1400b9779
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b982c
cmp qword [rbx + 0x40], 7
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
lea rax, [rbx + 0x28]
jbe 0x1400b9721
mov rax, qword [rax]
add rbx, 8
cmp qword [rbx + 0x18], 7
jbe 0x1400b972f
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rax
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWindowsService.cpp
lea rax, str.Invalid_service_handle_for__ls
mov r9d, 0xe4
mov qword [rsp + 0x30], rax
lea rdx, str.mb::common::system::WindowsService::QueryStatusEx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 2
call r10
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x50], eax
mov r8, rdx
lea rax, [rsp + 0x50]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400b9841
mov qword [rsp + 0x88], rdi
mov rdi, qword [rbx]
test rdi, rdi
je 0x1400b9824
mov rax, qword [rdi]
mov qword [rsp + 0x80], rsi
mov rsi, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x40], 7
lea rdx, [rbx + 0x28]
jbe 0x1400b97d3
mov rdx, qword [rdx]
add rbx, 8
cmp qword [rbx + 0x18], 7
jbe 0x1400b97e1
mov rbx, qword [rbx]
mov dword [rsp + 0x40], eax
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWindowsService.cpp
mov qword [rsp + 0x38], rdx
lea rax, str.QueryServiceStatusEx_failed_on__1s.__Error__u.
mov qword [rsp + 0x30], rax
lea rdx, str.mb::common::system::WindowsService::QueryStatusEx
mov qword [rsp + 0x28], rbx
mov r9d, 0xec
mov rcx, rdi
mov dword [rsp + 0x20], 2
call rsi
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0x60
pop rbx
ret
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0x60
pop rbx
ret

Function at 0x1400ba130
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.140306610
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400ba196
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
jmp 0x1400ba1a6
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002d9c0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1400c2f20
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, r9d
mov r14d, r8d
mov r15, rdx
mov ebp, ecx
mov rsi, qword [rsp + 0xc0]
xor r9d, r9d
lea rcx, str.SeDebugPrivilege
call fcn.1400c3070
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov r8d, ebp
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rax, vtable.mb::common::system::ScopedAny_void____ptr64__int____cdecl___void____ptr64___int___cdecl_CloseHandle_void____ptr64___2__0__0_.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
lea rcx, [rdi + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400c2ff1
test rsi, rsi
je 0x1400c2fed
mov rdx, qword [rsi]
mov rbx, qword [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ebp
lea rax, str.Unable_to_open_process_PID:__u_Error:__u
mov qword [rsp + 0x30], rax
lea rax, str.DebugUtils
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 0x1b7
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonDebugUtils.cpp
lea rdx, str.mb::common::debug::DebugUtils::DumpTargetProcess
mov rcx, rsi
call rbx
xor bl, bl
jmp 0x1400c300d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], ebx
mov r9d, r14d
mov r8, r15
mov edx, ebp
mov rcx, rdi
call fcn.1400c2470
movzx ebx, al
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400c3020
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cb6f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r9
mov edi, r8d
mov rsi, qword [rsp + 0xe0]
xor eax, eax
test rdx, rdx
je 0x1400cb7f6
test r8d, r8d
je 0x1400cb7f6
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400cb74e
cmp dword [rsp + 0x60], edi
je 0x1400cb838
test rbx, rbx
je 0x1400cb7f2
mov rax, qword [rbx]
mov rbp, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rsi, rsi
je 0x1400cb76d
mov dword [rsi], edi
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.1400e9a70
nop
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400a0630
nop
lea rcx, [rsp + 0x68]
call fcn.1400166f0
nop
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, str.Error_writting_to_file_:__s
mov qword [rsp + 0x30], rax
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xbb
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonFileStreamUtils_Win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call rbp
nop
lea rcx, [rsp + 0x40]
call fcn.1400166f0
xor al, al
jmp 0x1400cb83a
test rbx, rbx
je 0x1400cb838
mov rax, qword [r9]
lea rcx, str.Skipping_writting_zero_byte_buffer__this_may_be_an_empty_file_
mov qword [rsp + 0x30], rcx
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, VariantTimeToSystemTime
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonFileStreamUtils_Win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call qword [rax + 0x20]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400e2e80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x28], rdx
movzx ecx, r8w
mov rbx, rdx
xor esi, esi
call fcn.1402d2a24
movzx r8d, ax
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx edx, r8b
xor rdx, rax
mov eax, r8d
imul rdx, rcx
shr rax, 8
xor rdx, rax
mov rax, qword [rdi + 0x1c8]
imul rdx, rcx
mov rcx, qword [rdi + 0x1e0]
and rcx, rdx
shl rcx, 4
add rax, rcx
mov rcx, qword [rdi + 0x1b8]
mov rdx, qword [rax + 8]
cmp rdx, rcx
je 0x1400e2f1a
mov rax, qword [rax]
cmp r8w, word [rdx + 0x10]
je 0x1400e2f1d
cmp rdx, rax
je 0x1400e2f1a
mov rdx, qword [rdx + 8]
cmp r8w, word [rdx + 0x10]
jne 0x1400e2f08
jmp 0x1400e2f1d
mov rdx, rsi
test rdx, rdx
cmove rdx, rcx
cmp rdx, rcx
je 0x1400e2f48
add rdx, 0x18
mov rcx, rbx
call fcn.140030a90
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret