joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016ede4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
movsxd rsi, edx
mov rdi, rcx
mov qword [rbp + 0x20], rbx
cmp dword [rcx], esi
je 0x14016ef03
mov r14d, dword [rcx + 4]
cmp esi, r14d
cmovl r14d, esi
test edx, edx
jle 0x14016eecc
lea r15, [rsi + rsi*2]
movabs rax, 0xaaaaaaaaaaaaaaab
shl r15, 3
mul r15
shr rdx, 4
cmp rdx, rsi
je 0x14016ee54
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140082a8c
mov r15, qword [rbp + 0x20]
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x14016ee6b
mov ecx, ebx
call fcn.140082a8c
jmp 0x14016ef03
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rbp + 0x20]
mov rbx, rax
test r15, r15
je 0x14016ee9f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14016ef5b
mov qword [rbp + 0x20], rbx
test r14d, r14d
je 0x14016eecc
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd rax, r14d
lea r8, [rax + rax*2]
shl r8, 3
call sub.msvcrt.dll_memcpy
mov rbx, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
mov r15, qword [rdi + 8]
test r15, r15
je 0x14016eeee
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test rbx, rbx
cmovne rax, rbx
xor ebx, ebx
mov qword [rdi + 8], rax
mov dword [rdi + 4], r14d
mov dword [rdi], esi
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x14003391c]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
mov ebx, 0x8007000e
jmp 0x14016ee5f
Function at 0x140170034
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, rdx
lea rcx, [rbp - 9]
xor edx, edx
lea r8d, [rdx + 0x40]
call sub.msvcrt.dll_memset
cmp dword [0x1404522b8], 0
jne 0x140170070
mov ecx, 0xc004d101
jmp 0x1401700f9
mov rcx, 0xffffffff80000002
mov qword [rbp + 7], rbx
lea rax, str.data.dat
mov qword [rbp + 0xf], rcx
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x39]
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov qword [rbp + 0x1f], rcx
mov qword [rbp + 0x17], rax
xor r9d, r9d
lea rax, str.SYSTEMWPA
mov qword [rbp - 0x39], 3
mov qword [rbp + 0x27], rax
mov ecx, 0xb9
mov rax, qword [0x140452298]
mov qword [rbp + 0x2f], rax
lea r8d, [r9 + 0x28]
mov rax, qword [0x140452498]
mov qword [rbp - 0x21], rax
lea rax, [0x140037a1c]
mov qword [rbp - 0x31], rax
lea rax, [rbp + 0x5f]
mov qword [rbp - 0x29], rax
lea rax, [rbp - 9]
mov qword [rbp - 0x19], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x5f]
test ecx, ecx
jns 0x1401700fe
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x140170128
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov esi, r9d
cmp dword [0x1404522b8], edi
mov r14, r8
mov ebp, edx
mov r15, rcx
je 0x14017017c
test r9d, r9d
je 0x14017017c
mov bl, byte [r14]
lea edx, [rdi + rbp]
lea r8, [rsp + 0x48]
mov rcx, r15
call fcn.14018f20c
xor bl, byte [rsp + 0x48]
inc edi
inc r14
mov byte [rax], bl
cmp edi, esi
jb 0x14017015a
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14017019c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [0x1404522b8], 0
mov rsi, r8
mov ebx, edx
je 0x140170202
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], edx
test r9d, r9d
je 0x140170202
mov edi, r9d
movaps xmm1, xmmword [rsp + 0x20]
lea r8, [rsp + 0x48]
movdqa xmm0, xmm1
inc ebx
psrldq xmm0, 8
movq rcx, xmm1
movd edx, xmm0
mov dword [rsp + 0x28], ebx
call fcn.14018f20c
mov cl, byte [rax]
xor cl, byte [rsp + 0x48]
mov byte [rsi], cl
inc rsi
sub rdi, 1
jne 0x1401701ca
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401702b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
lea esi, [r8 - 1]
mov qword [rsp + 0x20], rcx
add esi, edx
mov dword [rsp + 0x28], edx
cmp dword [0x1404522b8], 0
mov edi, edx
mov rbp, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x38], esi
je 0x14017035a
cmp edx, esi
jae 0x14017035a
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, rbp
call fcn.14018f20c
movaps xmm1, xmmword [rsp + 0x20]
inc edi
movdqa xmm0, xmm1
mov dword [rsp + 0x28], edi
psrldq xmm0, 8
mov r9d, esi
mov bl, byte [rax]
mov r8, rbp
xor bl, byte [rsp + 0x68]
movq rcx, xmm1
movd edx, xmm0
call fcn.14018f308
movaps xmm1, xmmword [rsp + 0x30]
lea r8, [rsp + 0x70]
movdqa xmm0, xmm1
dec esi
psrldq xmm0, 8
movq rcx, xmm1
movd edx, xmm0
mov dword [rsp + 0x38], esi
call fcn.14018f20c
mov cl, byte [rsp + 0x70]
xor cl, bl
mov byte [rax], cl
cmp edi, esi
jb 0x1401702ea
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140171580
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x28], 0
mov rbx, rdx
cmp dword [0x1404522b8], 0
jne 0x1401715ad
mov ecx, 0xc004d101
call fcn.140082a8c
jmp 0x140171653
test rbx, rbx
jne 0x1401715b9
mov ecx, 0x80070057
jmp 0x1401715a3
mov rdx, rcx
lea r9, [rbp + 0x28]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x1401715a3
mov rax, qword [rbp + 0x28]
test byte [rax + 0x18], 1
jne 0x1401715e9
mov ecx, 0xc004d314
jmp 0x1401715a3
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x14003f25c]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x18], rcx
lea r8d, [r9 + 0x34]
mov qword [rbp - 0x20], rdx
mov ecx, 0xb9
lea rdx, [rbp - 0x38]
mov qword [rbp - 0xc], rax
mov qword [rbp - 0x38], 3
mov dword [rbp - 0x10], 0xa0005
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x20]
test ecx, ecx
js 0x1401715a3
mov rax, qword [rbp - 0x40]
mov dword [rbx], eax
shr rax, 0x20
mov dword [rbx + 4], eax
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp + 0x28]
call fcn.140071d54
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140171680
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x40], 0
mov ebx, r8d
cmp dword [0x1404522b8], 0
mov edi, edx
jne 0x1401716af
mov ecx, 0xc004d101
jmp 0x14017173b
mov rdx, rcx
lea r9, [rbp - 0x40]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x14017173b
mov rax, qword [rbp - 0x40]
test byte [rax + 0x18], 1
jne 0x1401716df
mov ecx, 0xc004d314
jmp 0x14017173b
test bl, 2
je 0x1401716eb
mov ecx, 0x80070057
jmp 0x14017173b
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x14003bb1c]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x18], rcx
mov ecx, 0xb9
mov qword [rbp - 0x20], rdx
lea r8d, [r9 + 0x30]
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x38], 3
mov dword [rbp - 0x10], edi
mov dword [rbp - 0xc], ebx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x28]
test ecx, ecx
jns 0x140171740
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp - 0x40]
call fcn.140071d54
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140171770
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
cmp dword [0x1404522b8], 0
jne 0x140171786
mov ecx, 0xc004d101
jmp 0x1401717e4
mov rax, qword [0x140452498]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rax, [0x14003ce9c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rcx
mov ecx, 0xb9
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], r8
lea r8d, [r9 + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], 3
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rsp + 0x88]
test ecx, ecx
jns 0x1401717e9
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x140171808
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x50], 0
mov esi, r8d
and qword [rbp - 0x58], 0
mov r14, rdx
cmp dword [0x1404522b8], 0
mov r12, rcx
jne 0x140171851
mov edx, 0xc004d101
mov ecx, edx
call fcn.140082a8c
jmp 0x1401719fc
test r12, r12
jne 0x14017185d
mov edx, 0x80070057
jmp 0x140171845
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140171892
and qword [rbx + 0x10], 0
mov dword [rax + 8], 1
lea rax, [0x1403b9318]
mov qword [rbx], rax
jmp 0x140171894
xor ebx, ebx
mov qword [rbp - 0x50], rbx
test rbx, rbx
jne 0x1401718a4
mov edx, 0x8007000e
jmp 0x140171845
test r14, r14
jne 0x1401718b4
mov edx, 0x80070057
mov edi, edx
mov ecx, edx
jmp 0x1401718f0
test sil, 3
je 0x1401718a9
test esi, 0xfffffff8
jne 0x1401718a9
mov eax, esi
and al, 6
cmp al, 4
je 0x1401718a9
lea rdx, [rbx + 0x10]
mov dword [rbx + 0x18], esi
mov rcx, r14
call fcn.140082960
mov edi, eax
test eax, eax
js 0x1401718ee
mov rcx, qword [rbx + 0x10]
call fcn.14018ae38
mov edi, eax
test eax, eax
jns 0x1401718f5
mov ecx, eax
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
mov edx, edi
test edi, edi
jns 0x140171909
mov ecx, edi
jmp 0x140171847
mov rax, qword [0x140452498]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x28], rax
xor r9d, r9d
lea rax, [0x14003f25c]
mov qword [rbp - 0x40], 3
mov qword [rbp - 0x38], rax
mov ecx, 0xb9
lea rax, [rbp + 0x48]
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x30], rax
lea r8d, [r9 + 0x34]
lea rax, [rbp - 0x48]
mov dword [rbp - 0x18], 0xa0000
mov qword [rbp - 0x14], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, dword [rbp + 0x48]
xor edx, edx
mov r15d, 0xc004d315
cmp edi, r15d
cmovne edx, edi
test edx, edx
js 0x140171845
mov rcx, qword [0x1404522b0]
lea r9, [rbp - 0x58]
mov r8d, 4
mov rdx, rbx
call fcn.140172d68
mov edx, eax
test eax, eax
jns 0x140171996
mov ecx, eax
jmp 0x140171847
cmp edi, r15d
jne 0x1401719ef
test sil, 4
je 0x140171a3d
mov rax, qword [0x140452498]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x28], rax
xor r9d, r9d
lea rax, [0x14003c81c]
mov qword [rbp - 0x40], 3
mov qword [rbp - 0x38], rax
mov ecx, 0xb9
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r14
lea r8d, [r9 + 0x34]
mov qword [rbp - 0x30], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov edx, dword [rbp - 0x60]
test edx, edx
js 0x140171845
mov rax, qword [rbp - 0x58]
and qword [rbp - 0x58], 0
mov qword [r12], rax
mov ecx, edx
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp - 0x58]
call fcn.14005af5c
lea rcx, [rbp - 0x50]
call fcn.140071d54
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov edx, r15d
mov ecx, r15d
jmp 0x140171847
Function at 0x140171a94
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
cmp dword [0x1404522b8], 0
mov rbx, rcx
jne 0x140171ab4
mov ecx, 0xc004d101
jmp 0x140171b5c
test rbx, rbx
jne 0x140171ac3
mov ecx, 0x80070057
jmp 0x140171b5c
mov edx, 1
cmp dword [0x1404524a0], edx
je 0x140171ad5
xor dil, dil
jmp 0x140171afb
lea rcx, [0x140451a20]
call fcn.14007afcc
xor r8d, r8d
mov rdx, rbx
call fcn.14018b7b0
lea rcx, [0x140451a20]
mov dil, al
call fcn.14007ae68
xor ecx, ecx
call fcn.140082b34
test dil, dil
je 0x140171b0e
mov ecx, 0xc004d316
jmp 0x140171b5c
mov rax, qword [0x140452498]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [0x14003cb5c]
mov qword [rsp + 0x20], 3
mov qword [rsp + 0x28], rax
mov ecx, 0xb9
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rbx
lea r8d, [r9 + 0x28]
mov qword [rsp + 0x30], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rsp + 0x68]
test ecx, ecx
jns 0x140171b61
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140171b84
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x58], 0
mov ebx, r9d
cmp dword [0x1404522b8], 0
mov rdi, r8
mov rsi, rdx
jne 0x140171bbf
mov ecx, 0xc004d101
jmp 0x140171c56
mov rdx, rcx
lea r9, [rbp - 0x58]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x140171c56
mov rax, qword [rbp - 0x58]
test byte [rax + 0x18], 2
jne 0x140171bef
mov ecx, 0xc004d314
jmp 0x140171c56
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x14003d1dc]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x30]
lea r8d, [r9 + 0x48]
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp + 0x38]
mov qword [rbp - 0x30], rcx
lea ecx, [r8 + 0x71]
mov qword [rbp - 0x38], rdx
lea rdx, [rbp - 0x50]
mov dword [rbp - 0xc], eax
mov qword [rbp - 0x50], 3
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x20], 1
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x10], ebx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp - 0x60]
test ecx, ecx
jns 0x140171c5b
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp - 0x58]
call fcn.140071d54
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140171c94
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x58], 0
mov rbx, r9
cmp dword [0x1404522b8], 0
mov rdi, r8
mov rsi, rdx
jne 0x140171cd4
mov ecx, 0xc004d101
call fcn.140082a8c
jmp 0x140171d7a
mov rdx, rcx
lea r9, [rbp - 0x58]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x140171cca
mov rax, qword [rbp - 0x58]
test byte [rax + 0x18], 1
jne 0x140171d04
mov ecx, 0xc004d314
jmp 0x140171cca
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x14003db9c]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x5c]
lea r8d, [r9 + 0x4c]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x38], rdx
lea ecx, [r8 + 0x6d]
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x50], 3
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x20], 1
mov qword [rbp - 0x14], rdi
mov qword [rbp - 0xc], rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp - 0x60]
test ecx, ecx
js 0x140171cca
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x140171d7a
mov eax, dword [rbp - 0x5c]
mov dword [rdx], eax
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp - 0x58]
call fcn.140071d54
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140171db4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x28], 0
mov rbx, rdx
cmp dword [0x1404522b8], 0
jne 0x140171ddc
mov ecx, 0xc004d101
jmp 0x140171e61
mov rdx, rcx
lea r9, [rbp + 0x28]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x140171e61
mov rax, qword [rbp + 0x28]
test byte [rax + 0x18], 2
jne 0x140171e0c
mov ecx, 0xc004d314
jmp 0x140171e61
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x14003e21c]
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], rcx
mov ecx, 0xb9
mov qword [rbp - 0x28], rdx
lea r8d, [r9 + 0x34]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x40], 3
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x10], 1
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x20]
test ecx, ecx
jns 0x140171e66
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp + 0x28]
call fcn.140071d54
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140171e94
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x58], 0
mov rbx, r9
cmp dword [0x1404522b8], 0
mov rdi, r8
mov rsi, rdx
jne 0x140171ecf
mov ecx, 0xc004d101
jmp 0x140171f5b
mov rdx, rcx
lea r9, [rbp - 0x58]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x140171f5b
mov rax, qword [rbp - 0x58]
test byte [rax + 0x18], 1
jne 0x140171eff
mov ecx, 0xc004d314
jmp 0x140171f5b
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x14003e55c]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x30], rcx
lea r8d, [r9 + 0x44]
mov qword [rbp - 0x38], rdx
lea ecx, [r8 + 0x75]
mov qword [rbp - 0x50], 3
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x20], 1
mov qword [rbp - 0x1c], rdi
mov qword [rbp - 0x14], rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp - 0x60]
test ecx, ecx
jns 0x140171f60
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp - 0x58]
call fcn.140071d54
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140171f9c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x48], 0
mov ebx, r9d
cmp dword [0x1404522b8], 0
mov edi, r8d
mov rsi, rdx
jne 0x140171fd4
mov ecx, 0xc004d101
jmp 0x140172058
mov rdx, rcx
lea r9, [rbp - 0x48]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x140172058
mov rax, qword [rbp - 0x48]
test byte [rax + 0x18], 2
jne 0x140172004
mov ecx, 0xc004d314
jmp 0x140172058
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x14004091c]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x20], rcx
mov ecx, 0xb9
mov qword [rbp - 0x28], rdx
lea r8d, [r9 + 0x38]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x40], 3
mov qword [rbp - 0x18], rsi
mov dword [rbp - 0x10], edi
mov dword [rbp - 0xc], ebx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp - 0x50]
test ecx, ecx
jns 0x14017205d
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp - 0x48]
call fcn.140071d54
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140172094
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x40], 0
mov rbx, r8
cmp dword [0x1404522b8], 0
mov rdi, rdx
jne 0x1401720c4
mov ecx, 0xc004d101
jmp 0x140172146
mov rdx, rcx
lea r9, [rbp - 0x40]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x140172146
mov rax, qword [rbp - 0x40]
test byte [rax + 0x18], 1
jne 0x1401720f4
mov ecx, 0xc004d314
jmp 0x140172146
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x140040c5c]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x18], rcx
mov ecx, 0xb9
mov qword [rbp - 0x20], rdx
lea r8d, [r9 + 0x38]
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x38], 3
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x28]
test ecx, ecx
jns 0x14017214b
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp - 0x40]
call fcn.140071d54
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14017217c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x28], 0
mov rbx, rdx
cmp dword [0x1404522b8], 0
jne 0x1401721a1
mov ecx, 0xc004d101
jmp 0x14017221f
mov rdx, rcx
lea r9, [rbp + 0x28]
mov rcx, qword [0x1404522b0]
mov r8d, 4
call fcn.140173aac
mov ecx, eax
test eax, eax
js 0x14017221f
mov rax, qword [rbp + 0x28]
test byte [rax + 0x18], 2
jne 0x1401721d1
mov ecx, 0xc004d314
jmp 0x14017221f
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x140452498]
lea rax, [0x140040f9c]
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rcx
mov ecx, 0xb9
mov qword [rbp - 0x18], rdx
lea r8d, [r9 + 0x30]
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x30], 3
mov qword [rbp - 8], rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x20]
test ecx, ecx
jns 0x140172224
call fcn.140082a8c
call fcn.14016fdd0
mov ecx, eax
mov ebx, eax
call fcn.140082b34
lea rcx, [rbp + 0x28]
call fcn.140071d54
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret