joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082d34
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [0x1400c9b30], 0
jne 0x140082fbb
cmp dword [0x1400c5ea8], 0
mov dword [0x1400c9b30], 1
mov dword [0x1400c9af0], ecx
je 0x140082d98
and dword [0x1400c5ea8], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
nop dword [rax + rax]
xor ecx, ecx
cmp eax, 0x80000000
setb cl
mov dword [0x1400c9b08], ecx
jmp 0x140082d9e
mov ecx, dword [0x1400c9b08]
lea rax, [method.CSetupDiagnostics.virtual_40]
mov qword [0x1400c9ae0], rax
test ecx, ecx
je 0x140082e56
lea rax, [0x140082aa0]
mov qword [0x1400c9ab8], rax
lea rcx, str.kernel32
lea rax, [0x140082b50]
mov qword [0x1400c9b38], rax
lea rax, [0x140082c20]
mov qword [0x1400c9af8], rax
lea rax, [0x1400827d0]
mov qword [0x1400c9ae8], rax
lea rax, [0x140082ce0]
mov qword [0x1400c9ac8], rax
lea rax, [0x140082d00]
mov qword [0x1400c9ab0], rax
lea rax, [0x140082d20]
mov qword [0x1400c9ad8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
test rax, rax
je 0x140082eb8
lea rdx, [0x1400b6308]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140082eb8
mov qword [0x1400c9ae0], rax
jmp 0x140082eb8
lea rax, [0x140082400]
mov qword [0x1400c9ab8], rax
lea rax, [0x140082530]
mov qword [0x1400c9b38], rax
lea rax, [0x140082690]
mov qword [0x1400c9af8], rax
lea rax, [0x1400827d0]
mov qword [0x1400c9ae8], rax
lea rax, [0x1400827f0]
mov qword [0x1400c9ac8], rax
lea rax, [0x1400828d0]
mov qword [0x1400c9ab0], rax
lea rax, [0x1400829e0]
mov qword [0x1400c9ad8], rax
lea rax, [0x140082290]
xor edx, edx
mov qword [0x1400c9aa8], rax
lea rcx, [rsp + 0x20]
lea rax, [0x1400822c0]
mov r8d, 0x208
mov qword [0x1400c9b18], rax
lea rax, [0x1400822e0]
mov qword [0x1400c9ac0], rax
lea rax, [0x140082310]
mov qword [0x1400c9b20], rax
lea rax, [0x140082340]
mov qword [0x1400c9b40], rax
lea rax, [0x140082360]
mov qword [0x1400c9b10], rax
lea rax, [0x1400823b0]
mov qword [0x1400c9b28], rax
lea rax, [0x1400823d0]
mov qword [0x1400c9b00], rax
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str._windir__system32dbghelp.dll
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x140082fad
xor r8d, r8d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
test rax, rax
jne 0x140082f95
lea rax, [method.CSetupDiagnostics.virtual_40]
xor ecx, ecx
mov qword [0x1400c9ad0], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
jmp 0x140082fbb
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
jmp 0x140082fb4
lea rax, [method.CSetupDiagnostics.virtual_40]
mov qword [0x1400c9ad0], rax
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140094220
add rsp, 0x248
ret
Function at 0x14008b588
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r8, qword [rdx + 0x10]
xor ebp, ebp
mov rdi, rdx
mov rsi, rcx
mov ebx, ebp
test r8, r8
je 0x14008b65e
mov rax, rbp
cmp rbx, r8
jae 0x14008b5d4
mov rax, rbx
mul qword [rdi + 8]
test rdx, rdx
jne 0x14008b5d1
add rax, qword [rdi + 0x28]
cmp rax, qword [rdi + 0x28]
jae 0x14008b5d4
mov rax, rbp
mov r10, qword [rax]
mov rax, rbp
cmp rbx, r8
jae 0x14008b5f8
mov rax, rbx
mul qword [rdi + 8]
test rdx, rdx
jne 0x14008b5f5
add rax, qword [rdi + 0x28]
cmp rax, qword [rdi + 0x28]
jae 0x14008b5f8
mov rax, rbp
mov rcx, qword [rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x14008b5ff
inc rax
lea r8, [rcx + rax*2]
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], bp
jne 0x14008b613
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov rdx, r10
mov qword [rsp + 0x20], r8
mov rcx, rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jne 0x14008b676
mov r8, qword [rdi + 0x10]
inc rbx
cmp rbx, r8
jb 0x14008b5b3
mov eax, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14008b660
Function at 0x14008ca70
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x180], rax
and qword [rsp + 0x50], 0
lea r8, str._ls_ls_ls
xor eax, eax
mov dword [rsp + 0x44], 8
mov rdi, rcx
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], al
mov edx, 0x104
lea rax, [rcx + 0x230]
mov dword [rsp + 0x48], 4
add rcx, 0x28
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rdi + 0x438]
lea rcx, [rsp + 0x70]
xor bl, bl
call fcn.14002ba4c
test eax, eax
js 0x14008cc18
lea rax, [rsp + 0x44]
mov rbx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
lea r8, str.RefreshAfter
lea rax, [rsp + 0x58]
mov r9d, 0x48
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x70]
and qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14008cc16
lea rax, [rsp + 0x48]
mov r9d, 0x18
mov qword [rsp + 0x30], rax
lea rsi, [rdi + 0x18]
mov qword [rsp + 0x28], rsi
lea r8, str.RefreshInterval
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
xor bl, bl
test eax, eax
jne 0x14008cc18
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14008cc4c
test eax, eax
js 0x14008cc18
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
mov eax, dword [rsi]
mov rbx, qword [rsp + 0x60]
imul rdx, rax, 0x23c34600
mov rax, qword [rsp + 0x58]
cmp rax, rdx
mov rcx, rax
cmovb rdx, rax
sub rcx, rdx
mov qword [rdi + 0x640], rcx
cmp rbx, rcx
jae 0x14008cc06
mov rcx, rdi
call fcn.14008d1dc
mov eax, dword [rsi]
imul rax, rax, 0x23c34600
mov qword [rdi + 0x640], rbx
add rax, rbx
cmp byte [rsp + 0x40], 0
jne 0x14008cc16
cmp rbx, rax
jae 0x14008cc16
mov bl, 1
jmp 0x14008cc18
xor bl, bl
mov al, bl
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14008d014
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x170], rax
and dword [rsp + 0x40], 0
lea r8, [rcx + 0x28]
lea rax, [rcx + 0x230]
mov rsi, rdx
mov qword [rsp + 0x28], rax
lea r9, [rcx + 0x438]
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x60]
xor edi, edi
lea r8, str._ls_ls_ls
and qword [rsp + 0x48], rdi
mov edx, 0x104
call fcn.14002ba4c
mov ebx, eax
test eax, eax
js 0x14008d1ad
lea rax, [rsp + 0x40]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 2]
and qword [rsp + 0x28], rdi
lea r8, str.ETag
and qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14008d0d5
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008d182
mov ebx, dword [rsp + 0x40]
add ebx, 0x1e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14008d111
mov ebx, 0x8007000e
jmp 0x14008d1ad
lea rax, [rsp + 0x50]
mov rdx, rbx
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.14008a824
mov ebx, eax
test eax, eax
js 0x14008d186
mov eax, dword [rsp + 0x50]
lea r8, str.ETag
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x30], rax
mov rcx, 0xffffffff80000002
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14008d0c2
xor ebx, ebx
test ebx, ebx
jns 0x14008d1ad
test rdi, rdi
je 0x14008d1ad
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor edi, edi
mov qword [rsi], rdi
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140094220
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d1dc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x38], 0
xor eax, eax
and qword [rsp + 0x40], rax
mov rbx, rcx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [rsp + 0x3c]
lea r9, [rbx + 0x438]
mov ecx, dword [rbx + 0x18]
lea r8, str._ls_ls_ls
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x38]
imul rdx, rcx, 0x23c34600
mov dword [rsp + 0x30], eax
lea rcx, [rbx + 0x28]
mov rax, qword [rsp + 0x30]
add rdx, rax
mov qword [rbx + 0x640], rax
lea rax, [rbx + 0x230]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov edx, 0x104
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
call fcn.14002ba4c
mov ebx, eax
test eax, eax
js 0x14008d305
lea rax, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14008d2cc
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008d305
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 8
lea rdx, str.RefreshAfter
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008d2bc
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008d31b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140094220
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rbp
ret

Function at 0x14008d5b0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [rcx + 0x230]
mov rbx, rdx
add rcx, 0x28
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, str.GlobalOneSettingQueryMutex
lea rcx, [rsp + 0x30]
mov edx, 0x104
lea r8, str._s_s_s
call fcn.14002ba4c
test eax, eax
js 0x14008d672
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
je 0x14008d657
mov edx, 0xea60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14008d653
cmp eax, 0x102
je 0x14008d64c
cmp eax, 0xffffffff
je 0x14008d657
mov eax, 0x80004005
jmp 0x14008d672
mov eax, 0x800700aa
jmp 0x14008d672
xor eax, eax
jmp 0x14008d672
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140094220
add rsp, 0x250
pop rbx
ret
Function at 0x14008e7bc
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov r11, rdx
mov dword [rsp + 0x40], 4
mov rax, r9
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
mov r10, r8
mov qword [rsp + 0x28], rcx
mov r9d, 0x10010
and qword [rsp + 0x20], 0
mov rcx, r11
mov r8, rax
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
add rsp, 0x58
ret
Function at 0x1400916ec
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r8, str.GlobalMicrosoft.Windows.Setup.Cleanup
xor ecx, ecx
xor edx, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
cmp eax, 0xb7
jne 0x140091784
mov eax, dword [rdi + 8]
neg eax
sbb edx, edx
xor ecx, ecx
and edx, 2
call qword [sym.imp.ole32.dll_CoInitializeEx]
nop dword [rax + rax]
test eax, eax
jns 0x140091760
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edi, ebx
call fcn.1400917a0
mov esi, eax
test eax, eax
jns 0x140091774
inc edi
cmp edi, 3
jl 0x140091762
call qword [sym.imp.ole32.dll_CoUninitialize]
nop dword [rax + rax]
mov ebx, esi
jmp 0x14009174d
test edx, edx
je 0x14009174d
movzx eax, dx
or eax, 0x80070000
test edx, edx
cmovle eax, edx
jmp 0x14009174f
Function at 0x140091dc4
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
and qword [rbp - 0x48], 0
test rcx, rcx
jne 0x140091e0b
mov edi, 0x80070057
mov ecx, edi
call fcn.140025d30
jmp 0x140091f22
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop dword [rax + rax]
movzx ecx, word [rbp - 0x38]
test ecx, ecx
je 0x140091ed1
sub ecx, 5
je 0x140091eb2
sub ecx, 1
je 0x140091e93
sub ecx, 3
je 0x140091e74
cmp ecx, 3
je 0x140091e51
mov edi, 0x80070032
jmp 0x140091dff
lea rdx, [rbp - 0x50]
lea rcx, str.arm64
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140091f00
lea rcx, str.arm64
jmp 0x140091eee
lea rdx, [rbp - 0x50]
lea rcx, str.amd64
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140091f00
lea rcx, str.amd64
jmp 0x140091eee
lea rdx, [rbp - 0x50]
lea rcx, str.ia64
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140091f00
lea rcx, str.ia64
jmp 0x140091eee
lea rdx, [rbp - 0x50]
lea rcx, [0x1400a1a08]
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140091f00
lea rcx, [0x1400a1a08]
jmp 0x140091eee
lea rdx, [rbp - 0x50]
lea rcx, [0x1400a1a00]
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140091f00
lea rcx, [0x1400a1a00]
lea r8, [rbp - 0x48]
mov edx, dword [rbp - 0x50]
call fcn.140028308
mov edi, eax
test eax, eax
jns 0x140091f07
mov ecx, eax
call fcn.140025d30
mov ecx, edi
call fcn.140025d50
test edi, edi
js 0x140091dff
mov rax, qword [rbp - 0x48]
and qword [rbp - 0x48], 0
mov qword [rbx], rax
mov ecx, edi
call fcn.140025d50
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140091f5f
lea rbx, [rcx - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140092c88
Capabilities:
Check os version
Identify system language via api

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x128]
sub rsp, 0x220
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x140092ce4
mov edi, 0x80070057
mov ecx, edi
call fcn.140025d30
jmp 0x140092dec
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x44]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x40], 0x11c
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
nop dword [rax + rax]
test eax, eax
je 0x140092d29
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.140025c40
test eax, eax
jne 0x140092d29
mov edi, dword [rsp + 0x20]
jmp 0x140092cd8
cmp dword [rsp + 0x44], 6
jb 0x140092e4d
xor edx, edx
mov r8d, 0xaa
lea rcx, [rbp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
nop dword [rax + rax]
mov r8d, 0x55
lea rdx, [rbp + 0x60]
movzx ecx, ax
call fcn.140093d5c
test eax, eax
jne 0x140092d94
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140092d81
mov edi, 0x80004005
jmp 0x140092cd8
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140092cd8
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140029fcc
mov edi, eax
test eax, eax
jns 0x140092db1
mov ecx, eax
call fcn.140025d30
jmp 0x140092dd5
lea rcx, [rbp + 0x60]
lea r8, [rsp + 0x28]
mov edx, dword [rsp + 0x20]
call fcn.140028308
test eax, eax
mov edi, eax
jns 0x140092dd0
mov ecx, eax
call fcn.140025d30
mov rbx, qword [rsp + 0x28]
mov ecx, edi
call fcn.140025d50
test edi, edi
js 0x140092cd8
mov rax, rbx
xor ebx, ebx
mov qword [rsi], rax
mov ecx, edi
call fcn.140025d50
nop
test rbx, rbx
je 0x140092e22
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rbx - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
mov eax, edi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, [rsp + 0x20]
lea rcx, str.Unknown
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140092da8
lea rcx, str.Unknown
jmp 0x140092db5
Function at 0x140092e7c
Capabilities:
Check os version
Identify system language via api

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x128]
sub rsp, 0x220
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x140092ed8
mov edi, 0x80070057
mov ecx, edi
call fcn.140025d30
jmp 0x140092fe0
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x44]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x40], 0x11c
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
nop dword [rax + rax]
test eax, eax
je 0x140092f1d
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.140025c40
test eax, eax
jne 0x140092f1d
mov edi, dword [rsp + 0x20]
jmp 0x140092ecc
cmp dword [rsp + 0x44], 6
jb 0x140093041
xor edx, edx
mov r8d, 0xaa
lea rcx, [rbp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
nop dword [rax + rax]
mov r8d, 0x55
lea rdx, [rbp + 0x60]
movzx ecx, ax
call fcn.140093d5c
test eax, eax
jne 0x140092f88
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140092f75
mov edi, 0x80004005
jmp 0x140092ecc
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140092ecc
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140029fcc
mov edi, eax
test eax, eax
jns 0x140092fa5
mov ecx, eax
call fcn.140025d30
jmp 0x140092fc9
lea rcx, [rbp + 0x60]
lea r8, [rsp + 0x28]
mov edx, dword [rsp + 0x20]
call fcn.140028308
test eax, eax
mov edi, eax
jns 0x140092fc4
mov ecx, eax
call fcn.140025d30
mov rbx, qword [rsp + 0x28]
mov ecx, edi
call fcn.140025d50
test edi, edi
js 0x140092ecc
mov rax, rbx
xor ebx, ebx
mov qword [rsi], rax
mov ecx, edi
call fcn.140025d50
nop
test rbx, rbx
je 0x140093016
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rbx - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
mov eax, edi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, [rsp + 0x20]
lea rcx, str.Unknown
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140092f9c
lea rcx, str.Unknown
jmp 0x140092fa9
Function at 0x140093ab4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp qword [0x1400c52d0], 0
jne 0x140093c76
xor edi, edi
cmp byte [0x1400c9c44], dil
jne 0x140093bf3
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x140093b33
cmp dword [rsp + 0x54], 6
setb cl
mov byte [0x1400c9c10], cl
ja 0x140093b26
jne 0x140093b2b
cmp dword [rsp + 0x58], 1
jbe 0x140093b2b
mov edi, 1
test cl, cl
jne 0x140093bec
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140093b71
test edi, edi
je 0x140093be5
lea rcx, str.api_ms_win_eventing_provider_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140093be5
lea rdx, str.EventWrite
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x1400c9c18], rax
test rax, rax
je 0x140093be5
lea rdx, [0x1400b7bb8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [section..data], rax
test rax, rax
je 0x140093bd7
lea rdx, [0x1400b7bc8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x1400c9c08], rax
test rax, rax
jne 0x140093bec
lea rax, [0x1400938a0]
mov qword [section..data], rax
mov byte [0x1400c9c10], 1
mov byte [0x1400c9c44], 1
cmp byte [0x1400c9c10], 0
lea rdx, [0x1400c52d0]
jne 0x140093c26
mov rax, qword [section..data]
lea rcx, [0x1400b7be0]
mov r9, rdx
mov r8, rdx
lea rdx, [0x14008e6b0]
call qword [str.PN_t_]
jmp 0x140093c76
and qword [rsp + 0x48], 0
lea rax, [0x1400b7be0]
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x40]
and qword [rsp + 0x30], 0
mov r9d, 1
and qword [rsp + 0x28], 0
mov r8, rax
mov qword [rsp + 0x20], rcx
lea rcx, [0x140093740]
mov qword [0x1400c52d0], rdx
mov qword [rsp + 0x40], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140094220
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret
Function at 0x14001ec27
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400f9dd0
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f70e0
add rsp, 0x28
call fcn.1400f9ca0
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400f9ad0
call sub.KERNEL32.dll_GetTickCount
mov qword [rsp + 0x28], rax
fld dword [0x140249a34]
sub rsp, 8
fstp dword [rsp]
movss xmm0, dword [rsp]
add rsp, 8
call fcn.14006bb76
cmp dword [rsp + 0x38], 0
jne 0x14001eccf
call sub.KERNEL32.dll_GetTickCount
mov r15, rax
sub r15, qword [rsp + 0x28]
movsxd rax, dword [rsp + 0x58]
cmp r15, rax
jg 0x14001eccf
jmp 0x14001ecd8
mov rax, 1
jmp 0x14001ecdb
xor rax, rax
and rax, rax
je 0x14001ec94
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
pop rax
add rsp, 0x40
pop r15
ret