joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fbb0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
xor r8d, r8d
jmp 0x14004fbb0
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.DoCopyFile
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xaf
call fcn.140038520
lea rcx, [rsp + 0x50]
xor ebp, ebp
mov rdx, rbx
xor r8d, r8d
call fcn.140045190
mov rcx, rdi
call fcn.140037150
test al, al
jne 0x14004fccd
mov rcx, rsi
call fcn.140037150
test al, al
je 0x14004fc28
xor ebp, ebp
jmp 0x14004fccd
cmp byte [rdi + 0x17], 0
jns 0x14004fc38
cmp qword [rdi + 8], 0x103
ja 0x14004fc21
cmp byte [rsi + 0x17], 0
jns 0x14004fc48
cmp qword [rsi + 8], 0x103
ja 0x14004fc21
lea rdx, str.DoCopyFile
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xbc
call fcn.140038520
lea rcx, [rsp + 0x28]
mov rdx, rbx
call fcn.140075bb0
cmp byte [rsi + 0x17], 0
jns 0x14004fc7f
mov rsi, qword [rsi]
movzx r8d, r14b
cmp byte [rdi + 0x17], 0
jns 0x14004fc8c
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14004fcc1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004fcc1
mov bpl, 1
test al, 1
je 0x14004fcc3
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x14004fcc3
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.140075e80
lea rcx, [rsp + 0x50]
call fcn.1400452c0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140163e00
mov eax, ebp
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14004fe80
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x558
mov r15d, r8d
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov qword [rsp + 0x20], r14
xor ebp, ebp
lea rsi, [rsp + 0x290]
mov rcx, rsi
xor r8d, r8d
mov r9d, 3
call fcn.140062cb0
lea rdi, [rsp + 0x28]
mov rcx, rsi
mov rdx, rdi
call fcn.140062de0
movzx eax, byte [rsp + 0x3f]
test al, al
jns 0x14004feec
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140050022
lea rsi, [rsp + 0x290]
lea rbx, [rsp + 0x40]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
jmp 0x14004ff1c
mov r13d, ebp
test rax, rax
je 0x140050022
mov rcx, rsi
mov rdx, rbx
call fcn.140062d50
mov edx, dword [rsp + 0x40]
test dl, 1
je 0x14004ff5d
test r15b, r15b
jne 0x14004ff45
mov rcx, rbx
call fcn.140062af0
test al, al
jne 0x14004ff5d
mov edx, dword [rsp + 0x40]
and edx, 0xfffffffe
cmp byte [rsp + 0x3f], 0
mov rcx, rdi
jns 0x14004ff57
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.140062af0
test al, al
je 0x14004ffb0
xor ebp, ebp
test r15b, r15b
je 0x14004ffde
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.14004fe80
mov ebp, eax
test eax, eax
jne 0x14004ffde
cmp byte [rsp + 0x3f], 0
mov rcx, rdi
jns 0x14004ff93
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14004ffde
jmp 0x14004ffc8
cmp byte [rsp + 0x3f], 0
mov rcx, rdi
jns 0x14004ffbf
mov rcx, qword [rsp + 0x28]
call r12
xor ebp, ebp
test eax, eax
jne 0x14004ffde
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
or eax, 1
cmp eax, 3
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, rbx
call fcn.14000c280
mov rcx, rsi
mov rdx, rbx
call fcn.140062de0
mov rcx, rdi
mov rdx, rbx
call fcn.140034b90
mov rcx, rbx
call fcn.140034b60
movzx eax, byte [rsp + 0x3f]
test al, al
jns 0x14004ff10
mov rax, qword [rsp + 0x30]
jmp 0x14004ff10
lea rcx, [rsp + 0x28]
call fcn.140034b60
lea rcx, [rsp + 0x290]
call fcn.140062ce0
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.140163e00
mov eax, ebp
add rsp, 0x558
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140050240
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3d
call fcn.140038520
lea rcx, [rsp + 0x60]
mov rdx, rbx
xor r8d, r8d
call fcn.140045190
test esi, esi
js 0x140050307
lea rcx, [rsp + 0x30]
call fcn.1400457d0
call fcn.140062a10
test al, al
je 0x1400502c8
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.140062ab0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], eax
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005030e
mov esi, dword [rsp + 0x2c]
jmp 0x14005031f
mov esi, 0xffffffff
jmp 0x140050329
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x30]
call fcn.140062a80
lea rcx, [rsp + 0x60]
call fcn.1400452c0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140050360
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, str.ReadAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x56
call fcn.140038520
lea rcx, [rsp + 0x58]
mov rdx, rdi
xor r8d, r8d
call fcn.140045190
test esi, esi
js 0x140050407
lea rcx, [rsp + 0x38]
call fcn.1400457d0
call fcn.140062a10
test al, al
je 0x1400503e0
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x38]
mov r8, rbx
call fcn.140062ab0
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005040e
mov esi, dword [rsp + 0x34]
jmp 0x14005041f
mov esi, 0xffffffff
jmp 0x140050429
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x38]
call fcn.140062a80
lea rcx, [rsp + 0x58]
call fcn.1400452c0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140050450
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x72
call fcn.140038520
lea rcx, [rsp + 0x68]
xor esi, esi
mov rdx, r15
xor r8d, r8d
call fcn.140045190
lea rcx, [rsp + 0x30]
call fcn.1400457d0
call fcn.140062a10
test al, al
je 0x1400504da
movsxd r9, ebp
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.140062ab0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], eax
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.140062a80
lea rcx, [rsp + 0x68]
call fcn.1400452c0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140050550
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x87
call fcn.140038520
lea rcx, [rsp + 0x58]
mov rdx, rdi
xor r8d, r8d
call fcn.140045190
test esi, esi
js 0x140050604
lea rcx, [rsp + 0x38]
call fcn.1400457d0
call fcn.140062a10
test al, al
je 0x1400505d0
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x38]
mov r8, rbx
call fcn.140062ab0
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x34]
lea rcx, [rsp + 0x38]
call fcn.140062a80
jmp 0x140050609
mov esi, 0xffffffff
lea rcx, [rsp + 0x58]
call fcn.1400452c0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140050630
Capabilities:
Get file size

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x9b
call fcn.140038520
lea rcx, [rsp + 0x48]
mov rdx, rdi
xor r8d, r8d
call fcn.140045190
lea rcx, [rsp + 0x28]
call fcn.1400457d0
call fcn.140062a10
test al, al
je 0x1400506a3
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x28]
mov r8, rsi
xor r9d, r9d
call fcn.140062ab0
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140062a80
lea rcx, [rsp + 0x48]
call fcn.1400452c0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140163e00
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140050cf0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.MapImageToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1a
call fcn.140038520
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.140045190
mov rcx, rsi
call fcn.140050060
test al, al
je 0x140050de2
lea rbx, [rsi + 0x40]
mov rcx, rsi
call fcn.140050070
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rbx
mov rdx, rax
call fcn.1400022d0
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140050de2
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x140050de2
lea rcx, [0x14019e3a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400763e8
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.1400452c0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140163e00
mov eax, edi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400514d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1400514ff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140051502
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140051523
test bl, bl
je 0x140051572
cmp byte [rdi + 8], 0
je 0x140051564
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140051567
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14005153a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005153d
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140051553
xor edi, edi
jmp 0x1400515ee
cmp byte [rdi + 8], 0
je 0x1400515a6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400515a9
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x140051583
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140051586
mov rcx, qword [rdi]
call fcn.140067b00
mov rcx, qword [0x1401f3ac8]
mov dil, 1
test rcx, rcx
je 0x1400515ee
mov edx, eax
mov r8d, esi
call fcn.140065900
jmp 0x1400515ee
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400515bc
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x1400515cd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400515d0
mov rcx, qword [rdi]
call fcn.140067b00
mov rcx, qword [0x1401f3ac8]
test rcx, rcx
je 0x1400515eb
mov edx, eax
mov r8d, esi
call fcn.140065900
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140163e00
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140051f90
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14005200b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14005200b
cmp dword [rsp + 0x38], 4
jne 0x14005200b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140163e00
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140052030
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rsi
push rdi
mov eax, 0x1048
call fcn.140163d90
sub rsp, rax
mov rsi, r8
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400520ea
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x1400520af
mov edi, 0x3f4
cmp eax, 1
jne 0x1400520ea
lea rdx, [rsp + 0x840]
jmp 0x1400520e0
lea rcx, [rsp + 0x840]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x1400520ea
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002ee92
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140163e00
mov eax, edi
add rsp, 0x1048
pop rdi
pop rsi
ret

Function at 0x140052110
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.140184604
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140052f00
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, dword [0x1401f1928]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140052f60
lea rsi, [0x1401f1920]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140163e00
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x1401f1928]
call fcn.140163bb0
cmp dword [0x1401f1928], 0xffffffff
jne 0x140052f3c
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call fcn.140166bf0
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140163a50
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x1401f1960]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140053021
lea r8, [0x1401f1930]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov r9d, edi
call fcn.1400531e0
mov qword [0x1401f1920], rsi
lea rcx, [0x1401f1928]
call fcn.140163c48
jmp 0x140052f3c
lea rcx, [0x1401f1960]
call fcn.140163bb0
cmp dword [0x1401f1960], 0xffffffff
jne 0x140052ff2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x1401f1950], xmm2
movups xmmword [0x1401f1940], xmm1
movups xmmword [0x1401f1930], xmm0
lea rcx, [0x1401f1960]
call fcn.140163c48
jmp 0x140052ff2

Function at 0x1400530b0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401f1960]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005313a
movzx eax, word [0x1401f1930]
cmp rax, 0xc
ja case.0x140053102.1
xor esi, esi
lea rcx, [0x1400531a4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov esi, 3
jmp case.0x140053102.0
mov esi, 5
jmp case.0x140053102.0
mov esi, 2
jmp case.0x140053102.0
mov esi, 1
jmp case.0x140053102.0
mov esi, 4
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401f1960]
call fcn.140163bb0
cmp dword [0x1401f1960], 0xffffffff
jne 0x1400530e5
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [0x1401f1950], xmm2
movups xmmword [0x1401f1940], xmm1
movups xmmword [0x1401f1930], xmm0
lea rcx, [0x1401f1960]
call fcn.140163c48
jmp 0x1400530e5
Function at 0x1400541f0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401f1990]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14005435f
jp 0x14005435f
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401f19a0]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005437e
mov eax, dword [0x1401f19b0]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400543b8
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x1401f19a8]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x140198a60]
subpd xmm1, xmmword [0x140198a70]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x14019e5a8]
ucomisd xmm1, xmm0
ja 0x14005435f
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401f1998]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x140198a60]
subpd xmm1, xmmword [0x140198a70]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401f1990], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140163e00
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1401f19a0]
call fcn.140163bb0
cmp dword [0x1401f19a0], 0xffffffff
jne 0x140054271
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401f1998], rdx
lea rcx, [0x1401f19a0]
call fcn.140163c48
jmp 0x140054271
lea rcx, [0x1401f19b0]
call fcn.140163bb0
cmp dword [0x1401f19b0], 0xffffffff
jne 0x140054296
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1401f19a8], rax
lea rcx, [0x1401f19b0]
call fcn.140163c48
jmp 0x140054296
Function at 0x140055b7c
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rsi, rdx
mov edx, ecx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rbx, [rsp + 0x50]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140055c0b
mov qword [rsp + 0x28], rbx
cmp word [rsp + 0x50], 0
je 0x140055bdd
xor eax, eax
cmp word [rsp + rax*2 + 0x52], 0
lea rax, [rax + 1]
jne 0x140055bcf
jmp 0x140055bdf
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.140034b10
mov rcx, rsi
mov rdx, rdi
call fcn.140034b90
mov rcx, rdi
call fcn.140034b60
mov dil, 1
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140163e00
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret