joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c26d64
Capabilities:
Check http status code

Disassembly:
push r14
jo 0x140bbc218
mov rsi, qword [rsp + 0x18]
movabs r14, 0x78b61e1830800a15
cmp r14, 0x61b87c8d
mov rdi, r14
call fcn.141213807
or al, 0xd0
push rcx
add qword [r9 - 0x7a], rbp
lodsb al, byte [rsi]
in al, 0x64
invalid
mov rdi, qword [rsp]
push rsi
movabs rsi, 0x3ce073460e15138f
push r10
jno 0x140c0ed86
in eax, dx
invalid
movabs r9, 0x788b55fb1457272f
mov r9b, 0xf0
mov bpl, r8b
push rdi
push r13
jno 0x140b7c4e6
add sil, 8
seta sil
call fcn.140b0695c
test edi, 0x298b64d5
push r9
push rsi
call fcn.140b6e84e
cwde
pop rsp
or edx, dword [rcx - 0xb541cd6]
invalid
call fcn.140c4ec1e
call fcn.140b67641
xor r9b, r10b
add r12b, 0x4a
neg qword [rsp + 0x40]
add r12w, 0x384b
sete r9b
cmp ebp, 0x7fdf4515
js 0x140bbbf95
call fcn.140b79e18
call fcn.140c35607
adc eax, 0x786875eb
push rsp
outsb dx, byte [rsi]
test byte [rcx], ch
lodsd eax, dword [rsi]
invalid
je 0x140b069a0
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.1415ef857
je 0x140c20826
add qword [rsp + 8], 0xffffffffbedd4454
call fcn.140b7f52f
invalid

Function at 0x140c28351
Capabilities:
Encode data using xor

Disassembly:
call fcn.140b08d5b
setbe byte [rsp]
neg word [rsp]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.14164b959
xor dh, bh
jne 0x140c283f1
insd dword [rdi], dx
pop rbp
fistp qword [rbx + 0x406b2589]
in al, 0x6d
fimul dword [rdx + rcx]
or al, 0x7c
ficom dword [rbx + rbp*4 + 0x29259b6d]
pushf
and eax, 0x87703fa5
and eax, 0x62e3d861
fiadd dword [rax - 0x258351a7]
invalid
fcom st(5)
invalid

Function at 0x140c28dff
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffbf454c06
call fcn.140b7d9a5
sub qword [rsp + 0x60], 0x12aa7639
movabs r9, 0x6e6753b408e05d94
ja 0x140c0ed78
sbb al, 0x93
or eax, 0x58a11bba
fcomp dword [rbx + 0x24bf120b]
pop rsi
xor al, 0xbf
xchg ecx, eax
not dword [rbx + 0x35]
mov edi, 0xe1ad6370
push rax
jbe 0x140c28e1f
invalid

Function at 0x140c3af22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.1415c03f3

Function at 0x140c4d64a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], 0x7c8405c8
movzx r9w, di
mov r9, qword [rsp + 0x20]
setne byte [rsp + 8]
test byte [rsp + 0x18], 0x36
jb 0x140aed8ae
and rdi, 0x1ceb7247
setle dl
jns 0x140c78107
call fcn.140c74d94
je 0x140aed874
adc ah, al
jne 0x140c50e7d
jl 0x140c50e75
or ecx, ebx
and al, 0xa4
loope 0x140c50e8a
push 0x489cf775
mov esi, 0x66907776
popfq
push rdx
invalid
sub ah, cl
invalid
or eax, 0x910f4115
invalid
invalid
neg rdx
cmp rdx, qword [rsp + 8]
jo 0x140c50e0b
movsx dx, dl
lea rdx, [rdx + rdx + 0x338807ed]
sub dword [rsp + 8], edi
add qword [rsp], 0x1191a5
ret 8

Function at 0x140c4e170
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov rsi, qword [rsp + 0x20]
add r11b, 0xa6
mov r10b, byte [rsp + 0x36]
setns r8b
mov byte [rsp + 0x30], 0xae
sub dword [rsp + 0x30], 0x556a7b86
cmovb r11, qword [rsp + 0x30]
seto r10b
and word [rsp + 0x30], r8w
jge 0x140bae66d
Function at 0x140c53907
Capabilities:
Encode data using xor

Disassembly:
not cx
cmovo cx, r8w
test cx, 0x7f90
jl 0x141218706
push rcx
add qword [rsp + 8], 0x708a05
push rdi
mov rdi, r8
mov rdi, qword [rsp]
lea rsp, [rsp + 0x10]
ret
mov r8d, 0x8ae4be4
test r13w, 0x5dee
not r8b
setae r8b
movabs r13, 0x7d9c08e00d9a7cc7
mov r8, qword [rsp + 0x18]
cmp r13, 0x1ecf44e1
lea r13, [r13 + r13*8 + 0x61c06d4c]
jno 0x1412273d0
push r8
pushfq
movabs r8, 0x3c2520a65423679e
lea r8, [r8 + r8 + 0x561c689d]
lea r8, [r8*4 + 0x677a594a]
push r13
movabs r13, 0x2d8161ad31d40c0a
cmp r13d, 0x231135a9
or al, 0xd4
xor dword [rbp + 0x412d8161], ebp
cmp ebp, 0x231135a9
not r13
mov r13w, 0x3ecb
lea r8, [r13 + 0x705a260a]
call fcn.140c5e023
jle 0x14121875f
push 0xffffffffd038427a
invalid

Function at 0x140c6bafe
Capabilities:
Authenticate hmac

Disassembly:
neg word [rsp + 0x28]
add word [rsp + 0x10], 0x28f
mov qword [rsp + 0x68], 0x440f2320
mov r13, qword [rsp + 0x48]
not word [rsp + 0x28]
call fcn.141235719

Function at 0x140c6e932
Capabilities:
Encode data using xor

Disassembly:
bswap r8d
neg di
cmovno rdi, rbx
cmp rbx, qword [rsp + 0x40]
lea r8, [rbx + r12*4 + 0x7b88706f]
setbe dil
jns 0x140b9fc21
cmp word [rsp + 0x10], 0x3218
not r12
sete byte [rsp + 0x40]
seto dil
xor word [rsp + 0x40], bx
xor r8, 0x53392257
and r8d, 0x485b492b
add r8d, dword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
call fcn.140b5aea9
bswap edi
mov dil, 0xb3
lea r15, [r13 + r15*8 + 0x1a73329f]
setno byte [rsp + 0x48]
pop rdi
cmp r13b, 0xa1
seta r15b
call fcn.140b4c62f

Function at 0x140c6f4a6
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffbf49b54f
cmp word [rsp + 0x30], 0x17b0
not byte [rsp + 0x30]
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
call fcn.141588dd1
jae 0x140b0926e
test byte [rbx + 0x5d], ch
sub esp, dword [rax + 0x19]
test al, 0xbb
enter 0xffffffffffffefba, 0xffffffffffffffbb
push rbp
and al, 0xd0
push rax
test al, 0x19
invalid
Function at 0x140c74436
Capabilities:
Encode data using xor

Disassembly:
xor byte [rsp], r8b
not esi
mov rsi, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffd6363886
lea r13, [r13 + r13*4 + 0x68620cd8]
and byte [rsp], 0x45
push r15
movzx r13w, r8b
mov r15, qword [rsp + 8]
push rdi
not r13d
xor r8w, 0x745f
push r9
not r8d
xor r13w, 0x23b1
mov r9, r15
add r15d, r9d
jl 0x140bbfc13
test r13w, 0x1e17
movsx r13w, word [rsp + 0x1e]
movsx r15, byte [rsp + 0x18]
push rbp
push rcx
lea r13, [r15*4 + 0x590d1130]
push r15
mov rdi, qword [rsp]
mov r9, qword [rsp + 0x18]
mov rbp, qword [rsp]
setle r13b
mov rcx, r8
cmovae rcx, qword [rsp + 0x30]
sub r15d, 0x227009a4
cmovns cx, word [rsp + 0x32]
test rdi, 0x120c6037
setbe r8b
sub cl, dil
test rcx, r13
lea r15, [r13*4 + 0x637240fe]
lea edi, [rbp*4 + 0x637240fe]
jns 0x140c71634
mov r8d, 0x488fcf5f
sub byte [rax + 0x65717630], bh
cmpsb byte [rsi], byte [rdi]
xor byte [rax + 0x61], bl
out dx, al
movabs eax, dword [0x829b30bf372de830]
mov eax, 0x8f45cf43
cmp bl, byte [rcx - 0x31]
adc bl, byte [rax - 0x1acf4157]
and al, byte [rcx - 0x51]
xor ah, al
wait
and byte [rax - 0x31], cl
jg 0x140c1ca6b
iretd
or dword [rdi - 0x31], ecx
sbb al, 0x47
cmp eax, 0xc0f9cf54
scasb al, byte [rdi]
mov cl, 0x30
cwde
jrcxz 0x140c1ca3d
xor byte [rdi], dh
jno 0x140c1cafa
test al, 0x30
invalid
xchg ecx, eax
invalid
mov qword [rsp + 0x50], 0x422a7759
not r8
movsx r13w, word [rsp + 0x23]
mov rbp, qword [rsp + 0x30]
movsx ecx, cl
jo 0x140c1c994
cmove r8, qword [rsp + 0x50]
cmp r8, 0x91404b5
setbe r8b
and cl, 0x67
test word [rsp + 0x21], r13w
not r13
not byte [rsp + 0x50]
jns 0x1414f9afb
or byte [rsp + 0x10], r8b
movsx cx, r12b
xor byte [rsp + 0x10], 0xe3
setg r8b
and qword [rsp + 0x20], 0x119869d4
movsx r8d, r8b
bswap ecx
test qword [rsp + 0x50], 0x3327243
bswap rcx
not dword [rsp + 0x50]
mov r8b, 0x94
mov r8, qword [rsp + 0x60]
jg 0x140c11896
Function at 0x140c7818d
Capabilities:
Encode data using xor

Disassembly:
add r10d, esi
and qword [rsp], 0x73e353ba
sub qword [rsp], 0x34ae173e
sub dil, dil
sub edi, 0x253955e0
mov rsi, qword [rsp + 0x28]
call fcn.140b0a29c
test dword [rsp + 0x20], 0x3fad5fc0
movzx ebx, cl
pop rcx
movsx bx, bpl
mov rbp, qword [rsp + 0x28]
cmovge rsi, qword [rsp + 0x18]
lea r11, [r11 + r11*4 + 0x165d0092]
and r11w, si
jne 0x140c1e41e
invalid
jnp 0x140afca38
xor r11d, 0x68b1036b
add qword [rsp], 0xfffffffffff220b3
cmp esi, dword [rsp + 0x31]
ret
cmp dword [rsp + 0x28], 0x243516bf
not qword [rsp + 0x20]
setns byte [rsp + 0x20]
or byte [rsp + 0x28], 0x2f
add qword [rsp + 8], 0xffffffffbede5fb1
add qword [rsp], 0xffffffffbf4a84bc
mov byte [rsp + 0x20], 0x3c
neg word [rsp + 0x28]
not qword [rsp + 0x20]
and al, 0x20
jle 0x140c5e24c
jle 0x140afcaa7
imul ebp, dword [rsi + 0x78], 0x13de3a45
xchg edi, eax
in eax, dx
jo 0x140afcb21
xchg dword fs:[rsi + 0xec130de], edx
stc
jbe 0x140afca5a
mov eax, eax
mov al, 0xfa
add ch, dh
jge 0x140afcb42
invalid
and al, 0x1c
mov byte [rsp + 0x18], r8b
mov r12, qword [rsp + 0x10]
setb sil
xor r9d, dword [rsp + 0x1a]
test bl, r8b
not edx
ja 0x140afcb29
sub esi, edx
jne 0x140bb158c
setl byte [rsp]
cmp qword [rsp], r10
cmovae di, word [rsp + 0x19]
test byte [rsp + 0x18], 0x9b
not dword [rsp]
movzx si, byte [rsp + 0x1e]
movzx di, byte [rsp + 0x33]
mov dword [rsp + 0x30], r10d
jg 0x140aec11e
fistp dword [rax + 0x6d]
setp byte [rdi]
imul ebp, esi, 0x10f6a6f0
lahf
invalid
add esi, dword [rsp + 0x1c]
add si, 0x79a8
not ebx
add qword [rsp + 8], 0x124b9
lea rsi, [rsi*2 + 0x558472b2]
or bx, bx
call fcn.140c26017
xor qword [rsp + 0x20], 0xe334dd7
sub qword [rsp + 0x20], 0x11fd781c
add dword [rsp + 0x20], 0x69d40db8
call fcn.140b1b970
mov word [rsp + 0x28], 0x3415
setb byte [rsp + 0x28]
setne byte [rsp + 0x28]
jae 0x140afca71
invalid

Function at 0x1412114e1
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x10], 0xffffffffbeb02fa1
not rbp
add dword [rsp + 0x48], r14d
neg rsi
test word [rsp + 0x43], si
call fcn.140b96fa3
sub r14b, sil
jle 0x140c4a858
add byte [rax], al
add dword [rax], eax
add byte [rax], al
adc ah, bl
sub byte [rax + 0x64839ff4], 0x57
mov bpl, 0x6b
jne 0x141211555
test dword [rdx + rcx + 0x71dea892], eax
and edx, dword [rbp + 0x1728b2a8]
mov gs, word [rax + 0x6b843fb8]
push rdi
int1
leave
jne 0x14121156e
out 0x7e, eax
jb 0x141211573
mov byte [rdx - 0x65], dh
insb byte [rdi], dx
push rdi
xor esi, dword [rbp + 0x1aa89014]
invalid
wait
pop rdi
imul eax, dword [0x17d5e310e], 0xc307c6b2
and ch, cl
lea ecx, [rdi]
add al, 0x55
or dh, bh
mov al, 0xde
invalid
clc
hlt
in al, dx
sbb eax, 0xa557fa32
and dword [rax], ebp
sbb eax, 0x18aeb69a
xchg esi, eax
invalid

Function at 0x141221bea
Capabilities:
Encode data using xor

Disassembly:
movsxd r10, r8d
js 0x1414f911b
and bpl, byte [rsp + 0x1d]
not r14w
neg r13
cmovs r13d, dword [rsp + 0x1b]
and rbp, r14
sete r14b
Function at 0x1412360f9
Capabilities:
Encode data using xor

Disassembly:
lea r9, [r9*8 + 0x32124b38]
jbe 0x14123337d
or r9w, 0x51f8
test byte [rsp + 0x33], r9b
lea r9, [r9*8 + 0x3a5c20bf]
mov r9, qword [rsp + 0x18]
setns byte [rsp + 0x30]
add qword [rsp + 0x10], 0x6cf500
mov qword [rsp + 0x30], 0x4ba906d9
and byte [rsp + 0x30], 0x5e
neg qword [rsp + 0x30]
mov byte [rsp + 0x30], 0xd
add word [rsp + 0x30], 0x5c33
sub byte [rsp + 0x30], 0xde
sets byte [rsp + 0x30]
mov qword [rsp + 0x30], 0x7c5c7fc2
call fcn.140b260e4
Function at 0x180730058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1807301df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180730089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18073006f
add dl, dl
jne 0x180730096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807300f6
xor eax, eax
add dl, dl
jne 0x1807300a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807301ad
add dl, dl
jne 0x1807300b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807300c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807300d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807300dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807300ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18073007e
mov eax, 1
add dl, dl
jne 0x180730106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180730113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807300fb
sub eax, ebx
mov ebx, 1
jne 0x18073014c
mov ecx, 1
add dl, dl
jne 0x18073012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18073013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180730123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180730168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180730175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18073015d
cmp eax, 0x7d00
jae 0x18073019b
cmp eax, 0x500
jb 0x180730196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073007e
cmp eax, 0x7f
ja 0x18073019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807301d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18073007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400ff244
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
mov dword [rcx + 8], edx
xor ecx, ecx
call fcn.140079c60
lea rcx, [rsi + 0x20]
call fcn.14006f8bc
xor ecx, ecx
call fcn.140079c60
xor ebx, ebx
test byte [rsi + 8], 1
je 0x1400ff394
lea r9, [rbp + 0x38]
xor edx, edx
lea r8, [0x1403d22c0]
mov rcx, rsi
call fcn.140101e1c
mov ebx, eax
test eax, eax
jns 0x1400ff2ad
mov ecx, eax
call fcn.140079c40
mov edi, dword [rbp + 0x30]
jmp 0x1400ff2b1
movzx edi, byte [rbp + 0x38]
mov ecx, ebx
call fcn.140079c60
lea eax, [rbx + 0x3ffb2cff]
cmp eax, 1
ja 0x1400ff2c7
xor edi, edi
xor ebx, ebx
test ebx, ebx
js 0x1400ff38d
test edi, edi
je 0x1400ff394
mov rcx, rsi
call fcn.1401009a0
mov ebx, eax
test eax, eax
jns 0x1400ff2ec
mov ecx, eax
jmp 0x1400ff38f
and qword [rbp + 0x20], 0
cmp dword [0x14043ffa0], 0
mov byte [rbp + 0x38], 0
jne 0x1400ff305
mov ecx, 0xc004d101
jmp 0x1400ff35b
and qword [rbp - 0x20], 0
lea rax, [0x140028f18]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x40], 3
mov qword [rbp - 0x30], rax
xor r9d, r9d
mov rax, qword [0x140440188]
mov ecx, 0xb9
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rbp - 0x14], rax
lea r8d, [r9 + 0x34]
mov dword [rbp - 0x18], 0xa0014
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x30]
test ecx, ecx
jns 0x1400ff360
call fcn.140079c40
call fcn.1401652e4
mov ecx, eax
mov ebx, eax
call fcn.140079c60
lea rcx, [rbp + 0x20]
call fcn.140053010
test ebx, ebx
jns 0x1400ff382
mov ecx, ebx
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
test ebx, ebx
jns 0x1400ff394
mov ecx, ebx
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015f80c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa0
mov r14, rcx
xorps xmm0, xmm0
xor eax, eax
lea rcx, [rbp - 0x59]
xor r12d, r12d
mov qword [rbp - 0x49], rax
mov qword [rbp + 0x6f], r12
mov r15, rdx
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
xorps xmm0, xmm0
lea rcx, [rbp - 0x41]
xor eax, eax
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rax, [rbp + 0x6f]
xor edx, edx
lea r9, [0x1403d2f40]
mov qword [rsp + 0x20], rax
lea r8d, [r12 + 1]
lea rcx, [0x1403c73f0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x14015f8a2
mov ecx, eax
call fcn.140079c40
jmp 0x14015f9e6
mov rbx, qword [rbp + 0x6f]
or r13d, 0xffffffff
mov rax, qword [rbx]
mov rdi, qword [rax + 0x240]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
movzx edx, r13w
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14015f896
mov rbx, qword [rbp + 0x6f]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x1f8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
movzx edx, r12w
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14015f896
cmp dword [0x140440768], 1
lea eax, [r13 + 9]
movsd xmm1, qword [rbp - 0x49]
mov rsi, r12
mov rbx, qword [rbp + 0x6f]
cmove rsi, qword [0x14043ff30]
mov word [rbp - 0x59], ax
mov rax, r12
cmove rax, qword [0x14043ff38]
mov qword [rbp - 0x51], rax
mov rax, qword [rbx]
movups xmm0, xmmword [rbp - 0x59]
movsd qword [rbp - 0x19], xmm1
mov rdi, qword [rax + 0x280]
mov rax, qword [0x1403c1610]
mov rcx, rdi
movaps xmmword [rbp - 0x29], xmm0
call rax
mov rax, rdi
lea r8, [rbp - 0x29]
mov rdx, rsi
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14015f896
movups xmm0, xmmword [r15]
mov rbx, qword [rbp + 0x6f]
movsd xmm1, qword [r15 + 0x10]
movaps xmmword [rbp - 0x29], xmm0
movsd qword [rbp - 0x19], xmm1
mov rax, qword [rbx]
mov rdi, qword [rax + 0x1d0]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x29]
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14015f896
cmp word [rbp + 0x67], r13w
je 0x14015f9d7
mov rcx, qword [r14]
test rcx, rcx
je 0x14015f9cb
mov rdx, qword [rbp + 0x6f]
call fcn.14010b454
mov ebx, 0x8004bd01
mov ecx, ebx
jmp 0x14015f898
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x6f], r12
mov qword [rax], rcx
mov ecx, ebx
call fcn.140079c60
xor r9d, r9d
mov qword [rbp - 9], 3
lea rax, [0x14001a518]
mov qword [rbp + 7], r12
mov qword [rbp - 1], rax
lea rdx, [rbp - 9]
lea rax, [rbp + 0x6f]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp + 0xf], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140160158
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rsp + 0x68], 0
mov r14, rcx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rbp + 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1401601ac
lea rax, [0x1403a7268]
mov qword [rsi], rax
mov dword [rsi + 0x10], 1
lock inc dword [0x14043f384]
jmp 0x1401601ae
xor esi, esi
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1401601d3
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x68], rsi
test rsi, rsi
jne 0x1401601eb
mov ebp, 0x8007000e
mov ecx, ebp
call fcn.140079c40
jmp 0x1401601f3
and qword [rsp + 0x68], rbp
mov qword [r14], rsi
mov ecx, ebp
call fcn.140079c60
and qword [rsp + 0x30], 0
lea rax, [0x140021a18]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140162098
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rcx + 8]
mov rdi, rdx
mov r15d, dword [rcx]
mov rsi, rcx
mov r12d, dword [rcx + 4]
and qword [rcx + 8], 0
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 4], eax
mov rbp, qword [rdx + 8]
and qword [rdx + 8], 0
mov r14, qword [rcx + 8]
mov qword [rsp + 0x70], rbx
test r14, r14
je 0x1401620fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x70]
xor eax, eax
test rbp, rbp
cmovne rax, rbp
and qword [rsp + 0x70], 0
mov qword [rsi + 8], rax
mov dword [rdi], r15d
mov dword [rdi + 4], r12d
mov rsi, qword [rdi + 8]
test rsi, rsi
je 0x140162135
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov qword [rsp + 0x20], 3
test rbx, rbx
lea rdx, [rsp + 0x20]
mov ecx, 0xb9
cmovne rax, rbx
and qword [rsp + 0x30], 0
mov qword [rdi + 8], rax
xor r9d, r9d
lea rax, [0x140026818]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401621a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov rdi, rcx
mov qword [rbp + 0x20], rbx
cmp dword [rcx], ebx
je 0x140162255
mov eax, dword [rcx + 4]
xor esi, esi
test eax, eax
cmovle esi, eax
jle 0x140162225
movsxd rdx, ebx
shl rdx, 4
add rdx, qword [rdi + 8]
je 0x14016221a
xor r9d, r9d
mov qword [rbp - 0x18], rdx
lea rax, [0x14002fa58]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x28]
mov dword [rbp - 0x10], 1
lea r8d, [r9 + 0x24]
mov qword [rbp - 0x20], rax
mov ecx, 0xb9
call sub.ntdll.dll_NtQuerySystemInformation
inc ebx
cmp ebx, dword [rdi + 4]
jl 0x1401621d2
mov rbx, qword [rbp + 0x20]
mov r14, qword [rdi + 8]
test r14, r14
je 0x140162242
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test rbx, rbx
cmovne rax, rbx
mov qword [rdi + 8], rax
and dword [rdi], 0
mov dword [rdi + 4], esi
xor ecx, ecx
call fcn.140079c60
and qword [rbp - 0x20], 0
lea rax, [0x140026b58]
xor r9d, r9d
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x30], 3
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x24]
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1401633d4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x20], 0
mov rdi, rcx
movsxd rsi, edx
cmp dword [rcx], esi
je 0x14016353b
mov r15d, dword [rcx + 4]
cmp esi, r15d
cmovl r15d, esi
test edx, edx
jle 0x1401634b6
xor ebx, ebx
mov rcx, rsi
test edx, edx
je 0x140163443
mov r14, rcx
shl r14, 5
mov rax, r14
shr rax, 5
cmp rax, rcx
je 0x140163446
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140079c40
mov r14, qword [rbp + 0x20]
jmp 0x140163446
xor r14d, r14d
mov ecx, ebx
call fcn.140079c60
test ebx, ebx
jns 0x14016345d
mov ecx, ebx
call fcn.140079c40
jmp 0x14016353d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, qword [rbp + 0x20]
mov rbx, rax
test r14, r14
je 0x140163491
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x140163595
mov qword [rbp + 0x20], rbx
test r15d, r15d
je 0x1401634b6
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd r8, r15d
shl r8, 5
call sub.msvcrt.dll_memcpy
cmp esi, dword [rdi + 4]
jge 0x140163502
mov ebx, esi
movsxd rdx, ebx
shl rdx, 5
add rdx, qword [rdi + 8]
je 0x1401634fb
and qword [rbp - 0x10], 0
lea rax, [0x140019198]
xor r9d, r9d
mov qword [rbp - 8], rdx
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 3
mov ecx, 0xb9
mov qword [rbp - 0x18], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc ebx
cmp ebx, dword [rdi + 4]
jl 0x1401634bd
mov r14, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140163528
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test r14, r14
cmovne rax, r14
mov qword [rdi + 8], rax
mov dword [rdi + 4], r15d
mov dword [rdi], esi
xor ebx, ebx
mov ecx, ebx
call fcn.140079c60
and qword [rbp - 0x10], 0
lea rax, [0x1400223d8]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
mov ebx, 0x8007000e
jmp 0x140163451