joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a3000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp edx, 0x921
jg 0x1400a3040
cmp edi, 0x692
je 0x1400a3059
cmp edi, 0x7da
jne 0x1400a307d
lea rdi, [0x14034a6a0]
jmp 0x1400a3069
cmp edi, 0x922
je 0x1400a3062
cmp edi, 0xdf0
jne 0x1400a307d
lea rdi, [0x14034a6c0]
jmp 0x1400a3069
lea rdi, [0x14034a690]
jmp 0x1400a3069
lea rdi, [0x14034a6b0]
call fcn.140093680
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
movsxd rax, dword [rax + 8]
mov edi, dword [rdi + rax*4]
mov rcx, qword [0x1403b94b8]
test rcx, rcx
je 0x1400a30b8
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov rdx, rsi
mov r8d, edi
call qword [0x1403db008]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140266dd0
add edi, dword [rax + 0x30]
mov r14, qword [0x1403b2578]
mov eax, edi
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400a3195
mov r15, rax
mov rcx, r14
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a3195
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400a3195
mov rbx, rax
mov rcx, r14
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
and edi, 0xf
je 0x1400a3155
test eax, eax
je 0x1400a3155
mov ecx, eax
mov rax, rbx
add rax, rcx
dec edi
movzx ecx, word [rbx]
lea rbx, [rbx + rcx*2]
add rbx, 2
cmp rbx, rax
setb cl
add edi, 0xffffffff
jae 0x1400a3155
cmp rbx, rax
jb 0x1400a313a
xor eax, eax
mov edx, 0
mov edi, 0
test cl, cl
je 0x1400a319b
movzx r15d, word [rbx]
xor eax, eax
test r15, r15
je 0x1400a3197
mov edx, 0
mov edi, 0
test rbx, rbx
je 0x1400a319b
add rbx, 2
cmp r15w, 0xb
jae 0x1400a31ab
lea r14, [rsp + 0x20]
mov byte [r14 + 0x17], r15b
jmp 0x1400a31d2
xor eax, eax
xor edx, edx
xor edi, edi
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
jmp 0x1400a309c
lea edi, [r15 + 8]
and edi, 0xfffffff8
lea rcx, [rdi + rdi]
call fcn.1401cfd80
mov r14, rax
mov qword [rsp + 0x20], rax
bts rdi, 0x3f
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r15
lea r8, [r15 + r15]
mov rcx, r14
mov rdx, rbx
call fcn.1401d2e10
mov word [r14 + r15*2], 0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
jmp 0x1400a319b
Function at 0x1400a3e80
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x238], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.1400a2760
test al, al
je 0x1400a3fac
mov rcx, rsi
call fcn.1400a3fe0
test al, al
je 0x1400a3eec
call fcn.140093680
mov rax, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rcx, rdi
mov rdx, rsi
xor r9d, r9d
call fcn.1400a7760
test al, al
jne 0x1400a3fac
lea rbx, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rbx
mov dl, 0xaa
call fcn.1401d34c0
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x100
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400a3f6f
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x1400a3f6f
mov rcx, rsi
call fcn.140063cc0
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.1400641f0
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14017ae20
call fcn.140093680
mov rax, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rcx, rdi
mov rdx, rsi
xor r9d, r9d
call fcn.1400a7760
test al, al
jne 0x1400a3fac
cmp byte [rsi + 0x17], 0
jns 0x1400a3fca
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
call fcn.140093680
mov rax, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rcx, rdi
mov rdx, rsi
xor r9d, r9d
call fcn.1400a7760
test al, al
jne 0x1400a3fac
mov rcx, rsi
call fcn.1400a3fe0
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x1400a3f85
Function at 0x1400df100
Capabilities:
Receive http response

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
lea r9, [rsp + 0x160]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], 0
mov rcx, qword [rcx + 0x40]
mov edx, 0x80000016
xor r8d, r8d
call fcn.14010a7b0
lea rcx, str..._.._components_winhttp_network_fetcher.cc
mov edx, 0x2c
call fcn.14017e610
cmp eax, 3
jge 0x1400df1c1
mov rcx, qword [rsi + 0x40]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1400df178
mov dword [rsi + 0x140], 0
jmp 0x1400df18f
call fcn.14010a780
mov dword [rsi + 0x140], eax
test eax, eax
jns 0x1400df18f
mov rcx, rsi
call fcn.1400de2c0
cmp byte [rsp + 0x177], 0
jns 0x1400df1a6
mov rcx, qword [rsp + 0x160]
call fcn.1401cfdbc
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401d1390
nop
add rsp, 0x188
pop rdi
pop rsi
ret
lea rdx, str..._.._components_winhttp_network_fetcher.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x114
mov r9d, 0xfffffffd
call fcn.14007d0b0
lea rcx, [rsp + 0x38]
lea rdx, str.request_headers:
mov r8d, 0x11
call fcn.14020f8f0
lea rdx, [rsp + 0x160]
mov rcx, rax
call fcn.14007d9a0
mov rcx, rdi
call fcn.14007d550
jmp 0x1400df15c
Function at 0x1400df220
Capabilities:
Receive http response

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
lea r9, [rsp + 0x160]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], 0
mov rcx, qword [rcx + 0x40]
mov edx, 0x16
xor r8d, r8d
call fcn.14010a7b0
lea rcx, str..._.._components_winhttp_network_fetcher.cc
mov edx, 0x2c
call fcn.14017e610
cmp eax, 3
jge 0x1400df3c7
lea r9, [rsi + 0x160]
mov rcx, qword [rsi + 0x40]
mov edx, 0x13
xor r8d, r8d
call fcn.14010ab00
mov dword [rsi + 0x140], eax
test eax, eax
js 0x1400df38d
lea r9, [rsp + 0x24]
mov dword [r9], 0
mov rcx, qword [rsi + 0x40]
mov edx, 5
xor r8d, r8d
call fcn.14010ab00
mov dword [rsi + 0x140], eax
test eax, eax
js 0x1400df38d
movsxd r8, dword [rsp + 0x24]
mov edx, dword [rsi + 0x160]
mov rcx, qword [rsi + 0x1d0]
lea rdi, [rsp + 0x28]
mov qword [rdi], rcx
mov qword [rsi + 0x1d0], 0
mov rax, qword [rcx + 8]
call qword [0x1403db008]
mov rcx, rdi
call fcn.14017b970
mov rdx, qword [rsi + 0x148]
mov r8, qword [rsi + 0x150]
mov rax, r8
sub rax, rdx
cmp rax, 0x3fff
ja 0x1400df348
lea rcx, [rsi + 0x148]
mov edx, 0x4000
sub rdx, rax
call fcn.140055a80
mov rdx, qword [rsi + 0x148]
mov r8, qword [rsi + 0x150]
jmp 0x1400df35e
cmp rax, 0x4000
je 0x1400df35e
lea r8, [rdx + 0x4000]
mov qword [rsi + 0x150], r8
sub r8d, edx
mov rcx, qword [rsi + 0x40]
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1400df37e
mov dword [rsi + 0x140], 0
jmp 0x1400df395
call fcn.14010a780
mov dword [rsi + 0x140], eax
test eax, eax
jns 0x1400df395
mov rcx, rsi
call fcn.1400de2c0
cmp byte [rsp + 0x177], 0
jns 0x1400df3ac
mov rcx, qword [rsp + 0x160]
call fcn.1401cfdbc
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401d1390
nop
add rsp, 0x188
pop rdi
pop rsi
ret
lea rdx, str..._.._components_winhttp_network_fetcher.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x128
mov r9d, 0xfffffffd
call fcn.14007d0b0
lea rcx, [rsp + 0x38]
lea rdx, str.response_headers:
mov r8d, 0x12
call fcn.14020f8f0
lea rdx, [rsp + 0x160]
mov rcx, rax
call fcn.14007d9a0
mov rcx, rdi
call fcn.14007d550
jmp 0x1400df280
Function at 0x1400e0410
Capabilities:
Initialize winhttp library

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x150], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x20], 0x10000000
mov rcx, rdx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
lea rax, [0x140336b68]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 0
test rdi, rdi
je 0x1400e0588
lea rbx, [rsp + 0x3c]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401d34c0
mov dword [rbx - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x100000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x30]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1400e0588
lea rbx, [rsp + 0x3c]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401d34c0
mov dword [rbx - 0xc], 0x11c
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x300000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x30]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x1400e0588
lea r8, [rsp + 0x30]
mov dword [r8], 0xa80
mov rcx, rdi
mov edx, 0x54
mov r9d, 4
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400e0950
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400e0977
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400e09b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400e09d0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401d1390
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400e0a90
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14017e5e0
test al, al
jne 0x1400e09e2
xor esi, esi
jmp 0x1400e09b4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x265
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14020f8f0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140185d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400e0a61
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.14020f8f0
cmp byte [rsp + 0x4f], 0
jns 0x1400e0a7d
mov rcx, qword [rsp + 0x38]
call fcn.1401cfdbc
lea rcx, [rsp + 0x50]
call fcn.14023e6f0
jmp 0x1400e09de
Function at 0x1400e0a90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x1400e0ab7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e0ae9
mov dil, 1
test al, 0x10
je 0x1400e0ba2
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401d1390
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14017e5e0
test al, al
je 0x1400e0bb0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x250
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14020f8f0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140185d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400e0b7a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.14020f8f0
cmp byte [rsp + 0x5f], 0
jns 0x1400e0b96
mov rcx, qword [rsp + 0x48]
call fcn.1401cfdbc
lea rcx, [rsp + 0x60]
call fcn.14023e6f0
jmp 0x1400e0bb0
mov ecx, 2
call fcn.14017e5e0
test al, al
jne 0x1400e0bb7
xor edi, edi
jmp 0x1400e0acd
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x254
mov r9d, 2
call fcn.14007d0b0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14020f8f0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140185d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400e0c2d
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.14020f8f0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.14020f8f0
cmp byte [rsp + 0x5f], 0
jns 0x1400e0c5e
mov rcx, qword [rsp + 0x48]
call fcn.1401cfdbc
lea rcx, [rsp + 0x60]
call fcn.14007d550
jmp 0x1400e0bb0
Function at 0x1400e2110
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r12, rdx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x20]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400e0ca0
mov rax, qword [rsi]
test rax, rax
je 0x1400e218b
mov rbx, qword [rax + 0x50]
mov rdi, qword [rax + 0x58]
xor esi, esi
cmp rbx, rdi
jne 0x1400e2192
lea rcx, [rsp + 0x20]
call fcn.1400e1820
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 3
jmp 0x1400e2162
lea r14, [r12 + 0x18]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x1400e21af
add rbx, 0x70
cmp rbx, rdi
je 0x1400e2162
jmp 0x1400e219e
cmp byte [rbx + 0x27], 0
jns 0x1400e21bb
mov rcx, qword [rbx + 0x10]
jmp 0x1400e21bf
lea rcx, [rbx + 0x10]
call r13
test al, 0x10
jne 0x1400e21a4
mov r15, qword [r12 + 8]
cmp r15, qword [r12 + 0x10]
je 0x1400e21eb
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.1400e2b10
add r15, 0x68
mov qword [r12 + 8], r15
jmp 0x1400e21a4
mov rcx, r12
mov rdx, rbx
call fcn.14029e3b0
jmp 0x1400e21a4

Function at 0x1400e2200
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r12, rdx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x20]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400e0ca0
mov rax, qword [rsi]
test rax, rax
je 0x1400e227b
mov rbx, qword [rax + 0x50]
mov rdi, qword [rax + 0x58]
xor esi, esi
cmp rbx, rdi
jne 0x1400e2282
lea rcx, [rsp + 0x20]
call fcn.1400e1820
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 3
jmp 0x1400e2252
lea r14, [r12 + 0x18]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x1400e22ce
cmp byte [rbx + 0x27], 0
jns 0x1400e22a0
mov rcx, qword [rbx + 0x10]
jmp 0x1400e22a4
lea rcx, [rbx + 0x10]
call r13
test al, 0x10
jne 0x1400e22ce
mov r15, qword [r12 + 8]
cmp r15, qword [r12 + 0x10]
je 0x1400e22dd
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.1400e2b10
add r15, 0x68
mov qword [r12 + 8], r15
add rbx, 0x70
cmp rbx, rdi
je 0x1400e2252
jmp 0x1400e228e
mov rcx, r12
mov rdx, rbx
call fcn.14029e3b0
jmp 0x1400e22ce
Function at 0x1400e3200
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1403bd568]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e323b
movzx eax, word [0x1403bd538]
cmp eax, 9
jne 0x1400e3283
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x1403bd568]
call fcn.1401cfee0
cmp dword [0x1403bd568], 0xffffffff
jne 0x1400e3225
xorps xmm0, xmm0
movups xmmword [0x1403bd558], xmm0
movups xmmword [0x1403bd548], xmm0
movups xmmword [0x1403bd538], xmm0
lea rcx, [0x1403bd538]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1403bd568]
call fcn.1401cff78
jmp 0x1400e3225
test eax, eax
je 0x1400e3236
cmp eax, 6
jne 0x1400e3293
mov eax, 2
jmp 0x1400e3236
cmp eax, 0xc
jne 0x1400e329f
mov eax, 3
jmp 0x1400e3236
mov eax, 4
jmp 0x1400e3236
Function at 0x1400e3ba0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov r15, rdx
mov r14d, ecx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x90]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x14033b990]
movaps xmmword [rsi], xmm0
lea rdx, str.CreateLocalWmiConnection
lea r8, str..._.._base_win_wmi.cc
lea rbx, [rsp + 0x70]
mov rcx, rbx
mov r9d, 0x1d
call fcn.14017e5b0
lea r8, [0x1403bd56c]
mov rcx, rsi
mov rdx, rbx
call fcn.1400f1ed0
mov qword [rbx], 0
mov qword [rsp + 0x20], rbx
lea rcx, [0x14030a170]
lea r9, [0x140380ef8]
xor esi, esi
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400e3d20
xor esi, esi
lea rdi, [rsp + 0x68]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x70]
lea rax, [0x140380f08]
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], 0xa
lea rbp, [rsp + 0x60]
mov rcx, rbp
call fcn.14010bfc0
mov rdx, qword [rbp]
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [0x1403db008]
mov ebx, eax
mov rcx, rbp
call fcn.14010c010
test ebx, ebx
js 0x1400e3d7f
test r14b, r14b
je 0x1400e3d04
mov rcx, qword [rsp + 0x68]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
xor esi, esi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1400e3d7f
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
mov rcx, qword [r15]
mov qword [r15], rax
mov sil, 1
test rcx, rcx
jne 0x1400e3d6f
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400e3d40
mov qword [rsp + 0x70], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1403db008]
lea rcx, [rsp + 0x90]
call fcn.1400f2000
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1403db008]
mov sil, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e3d20
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1403db008]
jmp 0x1400e3d20
Function at 0x1400e8910
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x1400e89fc
cmp qword [rsi], 0
jne 0x1400e89fc
cmp dword [rsi + 0x14], 0
jne 0x1400e89fc
cmp qword [rsi + 8], 0
jne 0x1400e89fc
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x1400e897f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400e89ce
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400e8977
mov qword [rsi], rbx
call fcn.14017e5d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x1400e89b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400e89e4
lea rax, [rbp + 1]
cmp rax, 2
jb 0x1400e89b1
mov qword [rsi + 8], rbp
call fcn.14017e5d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.14017e5d0
mov rcx, qword [rsi]
call fcn.140189420
mov qword [rsi], 0
jmp 0x1400e8965
call fcn.14017e5d0
mov rcx, qword [rsi + 8]
call fcn.140189420
mov qword [rsi + 8], 0
jmp 0x1400e899e
mov rcx, rsi
call fcn.1402a28f0
mov rax, qword [rsi]
jmp 0x1400e8949

Function at 0x1400ece50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403b1f38]
cmp ecx, 0xffffffff
je 0x1400ece75
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400ece70
Function at 0x1400ece80
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x1403b1f38]
cmp ecx, 0xffffffff
je 0x1400ecf5e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x1400ecf5e
mov eax, dword [0x1403bee68]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ecf68
mov rbx, qword [0x1403bee60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400ecfae
mov rax, qword [0x1403bd658]
inc rax
xor ecx, ecx
lea rdx, [0x1403bd660]
lea edi, [rax + rcx]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rdx + rsi*8], 0
jne 0x1400ecfbb
lea rax, [rdx + rsi*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x1403bd658], rdi
mov dword [r15], edi
mov eax, dword [rax + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x1400ecfd0
cmp eax, 0x100
jge 0x1400ecfd3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400ecfe0
jmp 0x1400eceae
lea rcx, [0x1403bee68]
call fcn.1401cfee0
cmp dword [0x1403bee68], 0xffffffff
jne 0x1400eced3
mov ecx, 8
call fcn.1401cfd80
mov rbx, rax
mov rcx, rax
call fcn.140189370
mov qword [0x1403bee60], rbx
lea rcx, [0x1403bee68]
call fcn.1401cff78
jmp 0x1400eced3
mov rcx, rbx
call fcn.140189380
jmp 0x1400eceeb
inc rcx
cmp rcx, 0x100
jne 0x1400ecefe
jmp 0x1400ecf32
int3
int3

Function at 0x1400ecfe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1401d1330
sub rsp, rax
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1403b1f38]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400ed094
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400ed0d2
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1401d34c0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1401cfdfc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1401d2e10
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401d1390
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140110820
test al, al
je 0x1400ed0d5
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x1400ed0d8
mov eax, 0xffffffff
lock cmpxchg dword [0x1403b1f38], ecx
je 0x1400ed018
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1403b1f38]
mov dword [rsp + 0x2c], ecx
jmp 0x1400ed018
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.140110820
test al, al
je 0x1400ed0fd
cmp dword [rsp + 0x2c], 0xffffffff
je 0x1400ed0fd
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x1400ed0ab
int3