joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Js_tporsche_tjavagames_tjifen_twirelesscobrand_tsearchitem_tunpublished_tfolderbig_tgettingstarted_tstatuses_tclicknvote_twanted_tpoweruser_twebpages_tperldesk_tenvironmental_tnewmexico_tprojekty_tyshout_tpage_ttop_tdhl_tintranet_tcashback_tsbin_tnovinki_tkunena_tperfiles_tescola_troots_tsacs_torganizacion_tthaisresponde_tdomains_tvbadjuntos_tescort_tdropship_tsubmit_tawardingbodies_tgraphx_tplatforms_tcake_tgaw_tdentists_tvtiger_tagendas_tsite_twatchdog_tmatching_tic_tTravelUS_tsnoop_tpets_tatom_tlow_tcomputers_toptimized_tkadmin_tpublicsrc_tjensen
mov r10, rax
sub rbx, rax
movabs rdi, 0x83dcf94dc7570ce1
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1f1
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140008fd0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140009032
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000ab70
test al, al
jne 0x140009044
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140009000
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 9
mov dword [rbp - 0x20], 0x360001
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3e005b
mov dword [rbp - 0x18], 0x3e002a
mov dword [rbp - 0x14], 0x220031
mov dword [rbp - 0x10], 0x20003b
call fcn.140004fd0
mov rcx, rax
call 0x140008fd0
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x68
mov dword [rbp - 0x20], 0x360001
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3e005b
mov dword [rbp - 0x18], 0x3e002a
mov dword [rbp - 0x14], 0x510040
call fcn.1400022a0
mov rcx, rax
call 0x140008fd0
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x70024
mov dword [rbp - 0x1c], 0x1c006d
mov dword [rbp - 0x18], 0x720003
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140008fd0
Function at 0x14000a540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140009032
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000ab70
test al, al
jne 0x140009044
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140009000
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 9
mov dword [rbp - 0x20], 0x360001
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3e005b
mov dword [rbp - 0x18], 0x3e002a
mov dword [rbp - 0x14], 0x220031
mov dword [rbp - 0x10], 0x20003b
call fcn.140004fd0
mov rcx, rax
call 0x140008fd0
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x68
mov dword [rbp - 0x20], 0x360001
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3e005b
mov dword [rbp - 0x18], 0x3e002a
mov dword [rbp - 0x14], 0x510040
call fcn.1400022a0
mov rcx, rax
call 0x140008fd0
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x70024
mov dword [rbp - 0x1c], 0x1c006d
mov dword [rbp - 0x18], 0x720003
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140008fd0
Function at 0x14000d2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000d4ce
mov word [rbp + 0x50], 0x734a
mov word [rbp + 0x58], 0x734a
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000d354
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000d340
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000d385
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000d370
cmp rdi, rbx
jne 0x14000d4a2
mov r13, rsi
mov word [rbp - 0x50], 0x734a
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000d3c6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000d3b2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000d4c8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x73002b
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000d438
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x730030
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000d438
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x73002b
mov dword [rbp - 0x42], 0x73000b
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x73002b
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000d495
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x730030
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000d495
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x73002b
mov dword [rbp - 0x32], 0x73000b
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000d4a2
inc r14
jmp 0x14000d3a0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000d4ce
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000d310
mov rax, qword [rbp - 8]
jmp 0x14000d4d0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1b0019
mov dword [rbp - 0x1c], 0x1c006c
mov dword [rbp - 0x18], 0x410003
mov dword [rbp - 0x14], 0x4d0041
mov dword [rbp - 0x10], 0x9000c
mov dword [rbp - 0xc], 0x6a0065
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400171a0], rax
mov dword [rbp - 0x20], 0x1a001d
mov dword [rbp - 0x1c], 0x190067
mov dword [rbp - 0x18], 0x170001
mov dword [rbp - 0x14], 0x4d0007
mov dword [rbp - 0x10], 0x9000c
mov dword [rbp - 0xc], 0x6a0065
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140016320]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400171b0], rax
mov word [rbp - 0x10], 0x3a17
mov byte [rbp - 0xe], 0x65
call fcn.140004620
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1c6c1b19
mov dword [rbp - 0x1c], 0x60b3703
mov dword [rbp - 0x18], 0xf7d100b
mov word [rbp - 0x14], 0x7636
call fcn.140001180
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x157d1d03
mov dword [rbp - 0x1c], 0x17161c1d
mov dword [rbp - 0x18], 0x46c1527
mov word [rbp - 0x14], 0x7620
call fcn.140001180
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016450]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e8], rax
mov byte [rbp - 0x10], 0x61
call fcn.140004330
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400163a0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170f0], rax
mov dword [rbp - 0x10], 0x73000105
call fcn.140002660
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016360]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e0], rax
mov byte [rbp - 0x10], 0x61
call fcn.140004330
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016410]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170d8], rax
mov dword [rbp - 0x10], 0x320b0208
mov byte [rbp - 0xc], 9
call fcn.140003130
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016390]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2c0f
mov byte [rbp - 0xe], 0x65
call fcn.140004620
mov rcx, qword [0x1400171b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x180006a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, dword [rsp + 0x88]
xor r10d, r10d
mov r13d, dword [rsp + 0x88]
mov rdi, rcx
mov r15d, dword [rsp + 0x88]
mov esi, r10d
mov ebx, dword [rsp + 0x88]
mov r14d, dword [rsp + 0x88]
lea ebp, [r10 + 4]
lea rdx, [0x180000000]
cmp esi, 0xb9
ja case.0x180006b0d.9
mov eax, esi
movzx eax, byte [rdx + rax + 0x6d04]
mov ecx, dword [rdx + rax*4 + 0x6cdc]
add rcx, rdx
jmp rcx
test r13d, r13d
je case.0x180006b0d.9
mov r8, qword [0x1800aa330]
lea rdx, [rsp + 0x88]
mov ecx, 0xa3
call fcn.180030230
test eax, eax
je 0x180006b3e
cmp eax, 3
jne 0x180006cad
mov r14d, dword [rsp + 0x88]
test r14d, r14d
je 0x180006cd4
mov r9, qword [rsp + 0x98]
jmp 0x180006c96
mov dword [rsp + 0x30], r10d
mov r14d, r10d
test r9, r9
jne case.0x180006b0d.9
mov eax, 2
jmp 0x180006cad
mov r8d, dword [rdi + 0x3c]
mov eax, r10d
test r8d, r8d
je 0x180006bb2
mov r9d, dword [r9]
nop word [rax + rax]
mov edx, eax
lea rcx, [rdx + 4]
add rcx, rcx
cmp dword [rdi + rcx*8], r9d
je 0x180006cc5
inc eax
cmp eax, r8d
jb 0x180006b90
mov r9, qword [rsp + 0x98]
mov ebx, 1
jmp case.0x180006b0d.9
mov r15d, dword [rdi]
mov r12d, r15d
mov r13d, r15d
shr r12d, 2
shr r13d, 1
and r12d, 1
and r13d, 1
shr r15d, 3
and r15d, 1
mov dword [rsp + 0x90], r10d
jmp case.0x180006b0d.9
mov dword [rsp + 0x88], r10d
jmp case.0x180006b0d.9
test r12d, r12d
je 0x180006c46
mov rdx, qword [0x1800aa330]
lea rcx, [rsp + 0x90]
mov r8d, 0x83
call fcn.1800260a0
test eax, eax
je 0x180006c22
cmp eax, 3
jne 0x180006cad
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x180006cd4
test r14d, r14d
je 0x180006c3b
cmp eax, r14d
jae 0x180006c3e
mov r14d, eax
mov r9, qword [rsp + 0x98]
test r15d, r15d
je 0x180006c8f
mov rdx, qword [0x1800aa330]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], 0x2b
xor ecx, ecx
call fcn.180028c40
test eax, eax
je 0x180006c72
cmp eax, 3
jne 0x180006cad
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180006cd4
test r14d, r14d
je 0x180006c84
cmp eax, r14d
jae 0x180006c87
mov r14d, eax
mov r9, qword [rsp + 0x98]
lea eax, [r14 - 1]
mov dword [r9], eax
xor r10d, r10d
add ebp, 0x1c
add esi, 0x1c
cmp ebp, 0x100
jb 0x180006ae6
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
add rdx, rdx
mov ecx, dword [rdi + rdx*8 + 0x44]
mov dword [r10], ecx
mov eax, r10d
jmp 0x180006cad
mov eax, 1
jmp 0x180006cad
Function at 0x1800085a0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r12, r9
mov rsi, r8
mov r13, rcx
lea ebp, [rdx - 6]
movzx ebx, byte [rsp + 0xd8]
cmp edx, ebp
jbe case.0x180008613.0
lea edi, [rdx - 0x92]
lea rdx, [0x180000000]
mov r8, 0xffffffffffffffff
mov r15, qword [rsp + 0x38]
nop dword [rax]
cmp edi, 8
ja case.0x180008613.3
mov ecx, dword [rdx + rdi*4 + 0x87a8]
add rcx, rdx
jmp rcx
mov eax, dword [rsi + 0x30]
lea ecx, [rax + rax]
mov eax, 0x30
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180052a28
mov qword [rsi + 0x10], rax
mov bl, 1
jmp 0x18000875d
mov rax, qword [rsp + 0xf0]
movzx eax, byte [rax]
mov byte [rsp + 0xd8], al
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xd8]
mov edx, 0x9e
mov rcx, r15
call fcn.180028860
test al, al
je 0x18000879f
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0
mov r14, qword [rsi]
mov rbx, r14
mov rax, qword [r14 + 8]
cmp byte [rax + 0x19], 0
jne 0x1800086b9
mov ecx, dword [r15]
cmp dword [rax + 0x20], ecx
jae 0x1800086a3
mov rax, qword [rax + 0x10]
jmp 0x1800086a9
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180008698
cmp rbx, r14
je 0x1800086b9
cmp ecx, dword [rbx + 0x20]
jae 0x18000871a
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0
mov ecx, 0x38
call fcn.180052564
mov rcx, rax
lea r9, [rax + 0x20]
mov eax, dword [r15]
mov dword [r9], eax
xorps xmm0, xmm0
movups xmmword [r9 + 8], xmm0
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov word [rcx + 0x18], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rcx
mov r8, rbx
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.18004b210
mov rbx, qword [rsp + 0x38]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx + 0x28], xmm0
mov bl, 1
jmp 0x18000875d
mov r15, r12
jmp case.0x180008613.3
cmp qword [rsi + 0x28], 0
jne 0x1800087a3
mov r9, rsi
xor r8d, r8d
lea edx, [r8 + 0x32]
xor ecx, ecx
call fcn.180006dc0
test al, al
je 0x18000879f
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x88]
mov dword [rsi + 0x30], eax
lea rdx, [0x180000000]
mov r8, 0xffffffffffffffff
dec edi
lea eax, [rdi + 0x92]
cmp eax, ebp
ja 0x180008600
movzx eax, bl
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor al, al
jmp 0x18000877e
mov al, 1
jmp 0x18000877e
Function at 0x18000c8f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1800a5088]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea esi, [rcx + 8]
mov rbp, r8
mov r14, rdx
cmp ecx, esi
jae case.0x18000c95a.10
mov ebx, dword [rsp + 0x40]
lea edi, [rcx - 0xa1]
lea r15, [0x180000000]
mov edx, 0x2e75
mov r13d, 0x25
xor r12d, r12d
cmp edi, 0x12
ja case.0x18000c95a.2
mov ecx, dword [r15 + rdi*4 + 0xcb08]
add rcx, r15
jmp rcx
mov dword [rsp + 0x50], 0x2e7525
mov word [rsp + 0x53], r13w
mov word [rsp + 0x54], dx
jmp case.0x18000c95a.2
mov word [rsp + 0x56], r13w
mov dword [rsp + 0x57], 0x75252e75
mov byte [rsp + 0x5b], r12b
jmp case.0x18000c95a.2
mov r8d, dword [r14]
mov eax, r8d
movzx ecx, r8b
mov r9d, r8d
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
shr eax, 8
movzx edx, al
shr r9d, 0x10
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x50]
movzx r9d, r9b
shr r8d, 0x18
call fcn.180045940
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x18000c9d0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.180044ec0
jmp 0x18000cab2
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 0x21]
call fcn.180023d10
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r12
mov r8d, 0xa2
mov dword [rsp + 0x48], 1
call fcn.18000cb60
mov rbx, rax
test eax, eax
jne 0x18000caf3
cmp dword [0x1800a9dd0], r12d
jne 0x18000ca4b
xor r9d, r9d
lea r8d, [rax + 0x36]
xor edx, edx
xor ecx, ecx
call fcn.1800343c0
mov ebx, eax
jmp 0x18000ca61
lea rdx, str.INFO:_OS_interface_not_supported__n
mov ecx, 1
call fcn.18003cb00
mov ebx, 3
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x79]
call fcn.18002ca80
jmp 0x18000cab2
cmp qword [0x1800a9f20], r12
setne byte [rsp + 0x40]
jmp case.0x18000c95a.2
mov qword [rsp + 0x28], r12
lea r8, [0x180028830]
mov r9, r14
mov dword [rsp + 0x20], r12d
xor edx, edx
mov qword [0x1800aa348], r14
xor ecx, ecx
mov qword [r14 + 0x70], rbp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800a9f20], rax
mov edx, 0x2e75
inc edi
lea eax, [rdi + 0xa1]
cmp eax, esi
jb 0x18000c946
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180051f60
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x79]
call fcn.18002ca80
mov eax, ebx
jmp 0x18000cacb
Function at 0x180024150
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 8], ecx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x70]
lea r14, [0x180000000]
mov ebp, dword [rsp + 0x70]
xor r15d, r15d
mov esi, r15d
lea r12d, [r15 + 1]
cmp esi, 0xee
ja case.0x1800241a5.9
mov eax, esi
movzx eax, byte [r14 + rax + 0x243c0]
mov ecx, dword [r14 + rax*4 + 0x24398]
add rcx, r14
jmp rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x53]
call fcn.180033fb0
test eax, eax
je 0x1800241ce
mov r8d, eax
lea rdx, str.I_deal_with_tough_guys_like_you
mov ecx, 4
mov ebp, eax
call fcn.18003cb00
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x79]
call fcn.18001f580
test eax, eax
mov qword [0x1800aa338], r15
mov ebx, eax
cmovne ebp, eax
jmp case.0x1800241a5.9
call fcn.1800046c0
mov edx, 0x15
xor ecx, ecx
call fcn.18000de50
mov rbx, rax
jmp case.0x1800241a5.9
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 0x21]
call fcn.180023d10
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
mov r8d, 0xa2
mov dword [rsp + 0x70], r12d
call fcn.18000cb60
xor ecx, ecx
mov ebx, eax
test eax, eax
jne 0x180024314
xor edx, edx
mov r8d, 0x9f
call fcn.180033790
jmp case.0x1800241a5.9
mov ebx, r15d
mov ebp, r15d
jmp case.0x1800241a5.9
xor r9d, r9d
mov qword [0x1800aa340], r15
xor r8d, r8d
mov dword [0x1800a9dc8], r15d
xor ecx, ecx
lea edx, [r9 + 0x79]
call fcn.18002ca80
jmp case.0x1800241a5.9
test ebx, ebx
je case.0x1800241a5.9
mov r8d, ebx
lea rdx, str.ERROR:_cpuinfo_fini___error__d_n
mov ecx, 4
mov ebp, r12d
call fcn.18003cb00
jmp case.0x1800241a5.9
mov rax, qword [0x1800aa340]
mov edi, r15d
cmp dword [rax + 8], r15d
jbe 0x1800242dd
nop word [rax + rax]
mov ecx, edi
add rcx, rcx
mov rcx, qword [rax + rcx*8 + 0x18]
call fcn.180062c04
mov rax, qword [0x1800aa340]
inc edi
cmp edi, dword [rax + 8]
jb 0x1800242c0
mov rcx, rax
call fcn.180062c04
add esi, 0x22
lea eax, [rsi + 5]
cmp eax, 0x137
jb 0x180024183
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x79]
call fcn.18002ca80
xor edx, edx
mov ecx, 0x84
call fcn.180001ea0
mov eax, ebx
jmp 0x1800242fa
xorps xmm0, xmm0
lea rcx, [0x1800af638]
movups xmmword [0x1800af638], xmm0
movups xmmword [0x1800af648], xmm0
movups xmmword [0x1800af658], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [0x1800af638]
cmp ax, 9
je 0x180024372
cmp ax, 6
je 0x180024372
mov byte [rsp + 0x70], r15b
jmp 0x1800242f6
mov byte [rsp + 0x70], r12b
jmp 0x1800242f6
xor edx, edx
mov ecx, 0x84
call fcn.180001ea0
test eax, eax
cmovne ebp, r12d
mov eax, ebp
jmp 0x1800242fa