joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012fa90
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x178], rax
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
lea rax, [0x14029eca0]
mov qword [rcx], rax
lea rax, [0x14029e120]
mov qword [rcx + 0x18], rax
xor ecx, ecx
mov qword [rsi + 0x20], rcx
mov byte [rsi + 0x28], cl
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rcx
mov byte [rsi + 0x40], cl
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14012fb07
cmp rcx, rdi
je 0x14012fcad
test rcx, rcx
jne 0x14012fbb5
mov qword [rsi + 0x20], rdi
cmp dword [0x1402e5a28], 2
jg 0x14012fb26
test rdi, rdi
je 0x14012fc13
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14012fb4e
cmp rcx, rdi
je 0x14012fcad
test rcx, rcx
jne 0x14012fbbf
mov qword [rsi + 0x38], rdi
cmp dword [0x1402e5a28], 2
jg 0x14012fb69
test rdi, rdi
je 0x14012fc60
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14013c8c0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14012fbc6
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
call fcn.140139420
jmp 0x14012fb10
call fcn.140139420
jmp 0x14012fb53
lea rdx, str.Start
lea r8, str.thread_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r9d, 0x1b
call fcn.140158eb0
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov rdx, rdi
call fcn.14023e730
lea rdx, [0x1402b5cf4]
mov rcx, rbx
call fcn.1402586d0
mov rcx, rbx
call fcn.14023e760
jmp 0x14012fb97
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.session_end_watcher.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x5a
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x40]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.140206b20
mov rcx, rdi
call fcn.14023caa0
jmp 0x14012fb26
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.session_end_watcher.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x5d
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x40]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.140206b20
mov rcx, rdi
call fcn.14023caa0
jmp 0x14012fb69
call fcn.1401e6290
int3
Function at 0x140173400
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1402e4048]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14017345a
mov rax, qword [0x1402e4040]
test rax, rax
je 0x1401734a6
mov rcx, rdi
mov rdx, rsi
call qword [0x1402f5008]
test eax, eax
je 0x1401734d8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1402e4048]
call fcn.1401cc16c
cmp dword [0x1402e4048], 0xffffffff
jne 0x140173430
lea rcx, str.bcryptprimitives.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1401734db
lea rdx, str.ProcessPrng
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e4040], rax
lea rcx, [0x1402e4048]
call fcn.1401cc1d4
jmp 0x140173430
test rsi, rsi
je 0x140173450
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1401734de
add rdi, rbx
sub rsi, rbx
jne 0x1401734b1
jmp 0x140173450
int3
int3
int3

Function at 0x1401738b0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1402e3f38]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140173914
mov rax, qword [0x1402e3f30]
mov rsi, qword [rax + 0x58]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1402e3f38]
call fcn.1401cc16c
cmp dword [0x1402e3f38], 0xffffffff
jne 0x1401738ec
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1401d06e0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401cbbc4
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1402e3f80]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401739d4
lea r8, [0x1402e3f50]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14002f740
mov qword [0x1402e3f30], rsi
lea rcx, [0x1402e3f38]
call fcn.1401cc1d4
jmp 0x1401738ec
lea rcx, [0x1402e3f80]
call fcn.1401cc16c
cmp dword [0x1402e3f80], 0xffffffff
jne 0x1401739a5
xorps xmm0, xmm0
movups xmmword [0x1402e3f70], xmm0
movups xmmword [0x1402e3f60], xmm0
movups xmmword [0x1402e3f50], xmm0
lea rcx, [0x1402e3f50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1402e3f80]
call fcn.1401cc1d4
jmp 0x1401739a5
Function at 0x14017a320
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x14017a36c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14017a377
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14017a35a
mov qword [rdi], rsi
call fcn.14017a3f0
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14017a3f0
mov r14, qword [rdi]
cmp qword [0x1402e5b90], 0
je 0x14017a3a8
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402f5008]
mov qword [rdi], 0
jmp 0x14017a348
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14017a3e9
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14017a3e3
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14017a389
xor ecx, ecx
mov dl, 1
jmp 0x14017a3dc
xor ecx, ecx
jmp 0x14017a3da
Function at 0x140198f20
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140199022
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140198fb0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140198f87
mov qword [rsi], rdi
call fcn.14017a3f0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 0
inc rax
cmp rax, 1
jbe 0x140199026
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14017a3f0
mov r14, qword [rsi]
cmp qword [0x1402e5b90], 0
je 0x140198fe1
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402f5008]
mov qword [rsi], 0
jmp 0x140198f75
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140199029
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14019901c
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x140198fc2
xor ecx, ecx
mov dl, 1
jmp 0x140199015
mov byte [rsi + 8], 0
int3
xor ecx, ecx
jmp 0x140199013
Function at 0x140199120
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov eax, dword [0x1402e4048]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140199214
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x28], rdi
mov rax, qword [0x1402e4040]
lea rcx, [rsp + 0x28]
test rax, rax
je 0x1401992d2
mov edx, 8
call qword [0x1402f5008]
test eax, eax
je 0x1401992e7
mov rax, qword [rsp + 0x28]
mov qword [rsi], rax
mov qword [rsp + 0x28], rdi
mov eax, dword [0x1402e4048]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14019926b
mov rax, qword [0x1402e4040]
lea rcx, [rsp + 0x28]
test rax, rax
je 0x1401992be
mov edx, 8
call qword [0x1402f5008]
test eax, eax
je 0x1401992ea
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x1402e4048]
call fcn.1401cc16c
cmp dword [0x1402e4048], 0xffffffff
jne 0x140199163
lea rcx, str.bcryptprimitives.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1401992ed
lea rdx, str.ProcessPrng
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e4040], rax
lea rcx, [0x1402e4048]
call fcn.1401cc1d4
jmp 0x140199163
lea rcx, [0x1402e4048]
call fcn.1401cc16c
cmp dword [0x1402e4048], 0xffffffff
jne 0x1401991cc
lea rcx, str.bcryptprimitives.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1401992f0
lea rdx, str.ProcessPrng
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e4040], rax
lea rcx, [0x1402e4048]
call fcn.1401cc1d4
jmp 0x1401991cc
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1401991f4
jmp 0x1401992f3
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14019919a
int3
int3
int3
int3
int3
int3
Function at 0x1401a1a80
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x1401a1a95
mov r8d, r8d
add rsp, 0x28
jmp fcn.1401a1ac0
test r8d, r8d
jne 0x1401a1ab4
lea rcx, [0x1402e5e28]
lea rdx, [0x140129e00]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401a22f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1401a23ee
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1402a45c0]
nop dword [rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm4, 0
movdqa xmm8, xmm2
pclmulqdq xmm8, xmm4, 0
movdqa xmm9, xmm1
pclmulqdq xmm9, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm1, xmm5, 0x11
movdqu xmm10, xmmword [rcx]
pxor xmm10, xmm6
pxor xmm0, xmm10
movdqu xmm6, xmmword [rcx + 0x10]
pxor xmm6, xmm7
pxor xmm3, xmm6
movdqu xmm6, xmmword [rcx + 0x20]
pxor xmm6, xmm8
pxor xmm2, xmm6
movdqu xmm6, xmmword [rcx + 0x30]
pxor xmm6, xmm9
pxor xmm1, xmm6
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x1401a2360
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1402a45d0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp rdx, 0x10
jb 0x1401a247d
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x1401a2453
movdqa xmm1, xmmword [0x1402a45d0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
pclmulqdq xmm0, xmmword [0x1402a45e0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1401a2d90
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x1401a2dbc
call fcn.14017a3f0
mov qword [rsi], 0
test r15, r15
je 0x1401a2df6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1401a2ec6
cmp r12, 2
jb 0x1401a2dee
mov qword [rsi], r15
call fcn.14017a3f0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
cmp byte [rdi + 0x1f], 0
jns 0x1401a2e65
mov r14, qword [rdi + 8]
mov rbx, qword [rdi + 0x10]
cmp rbx, 0xa
jbe 0x1401a2e79
movabs r15, 0x7ffffffffffffff7
cmp rbx, r15
ja 0x1401a2efa
mov rax, rbx
and rax, 0xfffffffffffffffc
add rax, 4
mov r12, rbx
or r12, 3
cmp r12, 0xb
cmove r12, rax
inc r12
js 0x1401a2eff
lea rcx, [r12 + r12]
call fcn.1401cbbc4
mov rcx, rax
mov qword [rsi + 8], rax
add r15, 9
or r15, r12
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x10], rbx
jmp 0x1401a2e7c
lea rax, [rdi + 8]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
jmp 0x1401a2ea3
mov byte [rsi + 0x1f], bl
cmp rcx, r14
ja 0x1401a2e92
lea rax, [rcx + rbx*2]
add rax, 2
cmp rax, r14
ja 0x1401a2f45
inc rbx
add rbx, rbx
mov rdx, r14
mov r8, rbx
call fcn.1401d0030
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14017a3f0
mov r14, qword [rsi]
cmp qword [0x1402e5b90], 0
je 0x1401a2f04
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402f5008]
mov qword [rsi], 0
jmp 0x1401a2de0
call fcn.140207060
call fcn.140207060
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401a2f48
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1401a2f3f
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x1401a2ed8
xor ecx, ecx
mov dl, 1
jmp 0x1401a2f38
int3
xor ecx, ecx
jmp 0x1401a2f36
Function at 0x1401a46c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
test r8, r8
je 0x1401a47de
mov rcx, qword [rcx + 8]
movsxd r9, dword [rcx + 0x3c]
cmp dword [rcx + r9 + 0x84], 0
je 0x1401a47de
add r9, rcx
xor eax, eax
cmp word [r9 + 0x14], 0x78
jb 0x1401a47d7
add r9, 0x88
je 0x1401a47d7
mov eax, dword [r9]
test rax, rax
je 0x1401a47de
add rax, rcx
je 0x1401a47de
cmp rdx, 0xffff
jbe 0x1401a47d1
mov r10d, dword [rax + 0x20]
lea r9, [rcx + r10]
test r10, r10
cmove r9, r10
mov r10d, dword [rax + 0x18]
lea r10, [r9 + r10*4]
lea r11, [rdx + 1]
mov rsi, r9
jmp 0x1401a4766
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ebp, bpl
movzx ebx, byte [rbx]
lea r14, [rdi + 4]
cmp ebp, ebx
cmovg rsi, r14
cmovs r10, rdi
cmp bpl, bl
je 0x1401a47b6
cmp rsi, r10
je 0x1401a47de
mov rdi, r10
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
shr rdi, 0x3f
add rdi, rbx
and rdi, 0xfffffffffffffffe
mov r14d, dword [rsi + rdi*2]
lea rbx, [rcx + r14]
test r14, r14
cmove rbx, r14
mov bpl, byte [rdx]
test bpl, bpl
je 0x1401a4746
mov r14, r11
nop dword [rax]
cmp bpl, byte [rbx]
jne 0x1401a4748
inc rbx
movzx ebp, byte [r14]
inc r14
test bpl, bpl
jne 0x1401a47a0
jmp 0x1401a4746
mov edx, dword [rax + 0x24]
add rcx, rdx
test rdx, rdx
cmove rcx, rdx
sub rdi, r9
sar rdi, 1
movzx edx, word [rcx + rdi]
add dx, word [rax + 0x10]
mov word [r8], dx
mov al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x1401a47d7
Function at 0x1401af1d0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1402e3f38]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401af231
mov rax, qword [0x1402e3f30]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1402e3f38]
call fcn.1401cc16c
cmp dword [0x1402e3f38], 0xffffffff
jne 0x1401af20c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1401d06e0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401cbbc4
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1402e3f80]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401af2f1
lea r8, [0x1402e3f50]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14002f740
mov qword [0x1402e3f30], rsi
lea rcx, [0x1402e3f38]
call fcn.1401cc1d4
jmp 0x1401af20c
lea rcx, [0x1402e3f80]
call fcn.1401cc16c
cmp dword [0x1402e3f80], 0xffffffff
jne 0x1401af2c2
xorps xmm0, xmm0
movups xmmword [0x1402e3f70], xmm0
movups xmmword [0x1402e3f60], xmm0
movups xmmword [0x1402e3f50], xmm0
lea rcx, [0x1402e3f50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1402e3f80]
call fcn.1401cc1d4
jmp 0x1401af2c2
Function at 0x1401b0420
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x48]
movups xmmword [rdi + 0x34], xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x18], xmm0
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi - 8], xmm0
movaps xmm0, xmmword [0x1402b09d0]
movups xmmword [rdi - 0x28], xmm0
movaps xmm0, xmmword [0x1402b09e0]
movups xmmword [rdi - 0x18], xmm0
mov dword [rdi + 0x44], 0x20
test rdx, rdx
je 0x1401b04bc
mov r14, rdx
mov rbx, rcx
lea eax, [rdx*8]
mov rcx, rdx
shr rcx, 0x1d
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x40], eax
mov r8, rdx
cmp rdx, 0x40
jae 0x1401b05f3
mov dword [rsp + 0x88], r14d
mov rcx, rdi
mov rdx, rbx
call fcn.1401d0030
mov eax, dword [rsp + 0x88]
lea rcx, [rax + 1]
mov ebx, dword [rsp + 0x8c]
mov ebp, dword [rsp + 0x40]
mov r14d, dword [rsp + 0x44]
mov byte [rsp + rax + 0x48], 0x80
cmp rax, 0x38
jae 0x1401b0620
cmp rcx, 0x38
je 0x1401b04ff
mov r8d, 0x38
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.1401d06e0
bswap r14d
lea rcx, [rsp + 0x20]
mov dword [rcx + 0x60], r14d
bswap ebp
mov dword [rcx + 0x64], ebp
mov r8d, 1
mov rdx, rdi
call fcn.140109a40
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
lea eax, [rbx - 0x21]
cmp eax, 0xffffffe3
jb 0x1401b05ac
shr ebx, 2
mov eax, dword [rsp + 0x20]
bswap eax
mov dword [rsi], eax
cmp ebx, 1
je 0x1401b05ac
mov eax, dword [rsp + 0x24]
bswap eax
mov dword [rsi + 4], eax
cmp ebx, 2
je 0x1401b05ac
mov eax, dword [rsp + 0x28]
bswap eax
mov dword [rsi + 8], eax
cmp ebx, 3
je 0x1401b05ac
mov eax, dword [rsp + 0x2c]
bswap eax
mov dword [rsi + 0xc], eax
cmp ebx, 4
je 0x1401b05ac
mov eax, dword [rsp + 0x30]
bswap eax
mov dword [rsi + 0x10], eax
cmp ebx, 5
je 0x1401b05ac
mov eax, dword [rsp + 0x34]
bswap eax
mov dword [rsi + 0x14], eax
cmp ebx, 6
je 0x1401b05ac
mov eax, dword [rsp + 0x38]
bswap eax
mov dword [rsi + 0x18], eax
cmp ebx, 7
je 0x1401b05ac
mov eax, dword [rsp + 0x3c]
bswap eax
mov dword [rsi + 0x1c], eax
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
shr r8, 6
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140109a40
mov r8, r14
and r8, 0x3f
je 0x1401b04bc
and r14, 0xffffffffffffffc0
add rbx, r14
mov r14d, r8d
jmp 0x1401b04a9
cmp eax, 0x3f
je 0x1401b0638
mov r8d, 0x3f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.1401d06e0
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.140109a40
xor ecx, ecx
jmp 0x1401b04ec
Function at 0x1401b0d80
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1402e3f38]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401b0de0
mov rsi, qword [0x1402e3f30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1402e3f38]
call fcn.1401cc16c
cmp dword [0x1402e3f38], 0xffffffff
jne 0x1401b0dbc
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1401d06e0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401cbbc4
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1402e3f80]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401b0ea0
lea r8, [0x1402e3f50]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14002f740
mov qword [0x1402e3f30], rsi
lea rcx, [0x1402e3f38]
call fcn.1401cc1d4
jmp 0x1401b0dbc
lea rcx, [0x1402e3f80]
call fcn.1401cc16c
cmp dword [0x1402e3f80], 0xffffffff
jne 0x1401b0e71
xorps xmm0, xmm0
movups xmmword [0x1402e3f70], xmm0
movups xmmword [0x1402e3f60], xmm0
movups xmmword [0x1402e3f50], xmm0
lea rcx, [0x1402e3f50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1402e3f80]
call fcn.1401cc1d4
jmp 0x1401b0e71