joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010aab0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x48
mov eax, dword [0x140215b00]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1f4
xor edx, edx
mov rcx, qword [0x140215ae0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x140215b04], eax
movsxd rax, dword [0x140215b04]
mov qword [rsp + 0x20], 0
mov r9d, 0x3c
lea r8, [0x140213d80]
mov rdx, rax
mov rcx, qword [0x140215ae0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
movzx eax, byte [0x14021511c]
cmp eax, 1
jne 0x14010ab36
mov eax, dword [0x140215b04]
add eax, 0x13
mov dl, 0x40
mov ecx, eax
call fcn.14010d360
nop
jmp 0x14010ab55
movzx eax, byte [0x14021511e]
cmp eax, 1
jne 0x14010ab55
mov eax, dword [0x140215b04]
add eax, 0x13
mov dl, 0x50
mov ecx, eax
call fcn.14010d360
nop
movzx eax, byte [0x14021511d]
cmp eax, 1
jne 0x14010ab76
mov eax, dword [0x140215b04]
add eax, 0x13
mov dl, 0x40
mov ecx, eax
call fcn.14010d360
nop
jmp 0x14010ab95
movzx eax, byte [0x14021511f]
cmp eax, 1
jne 0x14010ab95
mov eax, dword [0x140215b04]
add eax, 0x13
mov dl, 0x50
mov ecx, eax
call fcn.14010d360
nop
mov eax, dword [0x140215b04]
add eax, 0x5e
mov ecx, dword [0x140215b04]
add ecx, 9
mov edx, eax
call fcn.14010d3a0
mov eax, dword [rsp + 0x30]
add eax, 8
cdqe
mov qword [rsp + 0x20], 0
mov r9d, 7
lea r8, [0x140215af8]
mov rdx, rax
mov rcx, qword [0x140215ae0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsxd rax, dword [0x140215b04]
mov qword [rsp + 0x20], 0
mov r9d, 7
lea r8, [0x140215af8]
mov rdx, rax
mov rcx, qword [0x140215ae0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
add rsp, 0x48
ret

Function at 0x14010dbe0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x1401a4040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14010dc2e
xor eax, eax
jmp 0x14010dca2
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14010dc8f
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14010dc7b
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x4c], eax
jbe 0x14010dc7b
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14010dc4a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x24]
jmp 0x14010dca2
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14010f220
add rsp, 0x288
ret
Function at 0x14010dd80
Capabilities:
Allocate or change rwx memory

Disassembly:
movss dword [rsp + 0x10], xmm1
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x1401a4040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [0x140215ad8]
mov dword [rsp + 0x30], eax
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x60]
mov ecx, dword [0x140215090]
add ecx, eax
mov eax, ecx
mov eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8d, 4
mov edx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [rsp + 0x60]
mov ecx, dword [0x140215090]
add ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x68]
mov edx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [rsp + 0x60]
mov ecx, dword [0x140215090]
add ecx, eax
mov eax, ecx
mov eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 2
mov r8d, 4
mov edx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010f220
add rsp, 0x58
ret

Function at 0x1401101a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401101f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401101f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401101f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401101f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1401101f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401101f4
xor al, al
add rsp, 0x28
ret
Function at 0x1808ef058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1808ef1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1808ef089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808ef06f
add dl, dl
jne 0x1808ef096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808ef0f6
xor eax, eax
add dl, dl
jne 0x1808ef0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808ef1ad
add dl, dl
jne 0x1808ef0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ef0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ef0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ef0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1808ef0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1808ef07e
mov eax, 1
add dl, dl
jne 0x1808ef106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ef113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808ef0fb
sub eax, ebx
mov ebx, 1
jne 0x1808ef14c
mov ecx, 1
add dl, dl
jne 0x1808ef12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1808ef13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808ef123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808ef07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1808ef168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1808ef175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808ef15d
cmp eax, 0x7d00
jae 0x1808ef19b
cmp eax, 0x500
jb 0x1808ef196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808ef07e
cmp eax, 0x7f
ja 0x1808ef19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808ef07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1808ef1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1808ef07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x127f5b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x127f5bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x127f5cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x127f5b5
lea eax, [rcx + 1]
jmp 0x127f5db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x127f5ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x127f5d4
sub eax, 3
jb 0x127f60e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x127f65d
sar eax, 1
movsxd rbp, eax
jb 0x127f644
jmp 0x127f61c
add ebx, ebx
jne 0x127f61a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x127f644
inc ecx
add ebx, ebx
jne 0x127f62a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x127f644
call r11
adc ecx, ecx
add ebx, ebx
jne 0x127f63d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x127f62c
add ecx, 2
jmp 0x127f649
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0127f572
jmp 0x127f5bd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xe6f000]
mov eax, dword [rdi]
or eax, eax
je 0x127f6b9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xe81980]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x127f669
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x127f6b3
mov qword [rbx], rax
add rbx, 8
jmp 0x127f689
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x127f6fd
cmp al, 0xef
ja 0x127f6e5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x127f6c5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x127f6d4
mov eax, dword [rdi]
add rdi, 4
jmp 0x127f6d4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x127f751
sub rsp, 0xffffffffffffff80
jmp 0x46e640
Function at 0x140055428
Capabilities:
Get token membership

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x28
lea rax, str.S_1_5_80_123231216_2592883651_3715271367_3753151631_4175906628
xor ecx, ecx
mov qword [rbp + 0x50], rax
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
cmp eax, 0x6bd
jne 0x14005545a
xor ebx, ebx
jmp 0x14005561f
test eax, eax
je 0x14005548c
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
mov r12d, 0x80004005
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
mov ecx, ebx
call fcn.1400790f8
jmp 0x14005561f
and dword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
call fcn.1400688cc
lea rdx, [0x140428ac0]
mov ebx, eax
lea rcx, [0x14040ab88]
call fcn.1400e977c
test ebx, ebx
jns 0x1400554d1
mov ecx, ebx
call fcn.1400790f8
lea rdx, [0x140427980]
lea rcx, [0x140411fe8]
call fcn.1400e90f0
jmp 0x140055617
cmp dword [rbp + 0x38], 0
je 0x1400554de
xor ebx, ebx
jmp 0x140055617
cmp dword [0x14042eb74], 0
je 0x14005560b
xor r14d, r14d
lea r15, [rbp + 0x50]
mov r12d, 0x80004005
mov rcx, qword [r15]
lea rdx, [rbp + 0x48]
xor esi, esi
xor ebx, ebx
and qword [rbp + 0x48], rsi
and dword [rbp + 0x40], ebx
mov dword [rbp + 0x38], esi
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x14005553d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140055526
mov ebx, r12d
jmp 0x140055534
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.1400790f8
jmp 0x140055557
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140055517
mov esi, dword [rbp + 0x40]
mov dword [rbp + 0x38], esi
mov ecx, ebx
call fcn.140079118
lea rcx, [rbp + 0x48]
call fcn.140069668
test ebx, ebx
js 0x140055649
test esi, esi
jne 0x1400554d7
inc r14d
add r15, 8
cmp r14d, 1
jb 0x1400554f8
lea r8, [rbp + 0x38]
lea edx, [rsi + 0x12]
call fcn.14006e9a8
lea rdx, [0x1404295c0]
mov ebx, eax
lea rcx, [0x14040b568]
call fcn.1400e9438
test ebx, ebx
js 0x140055610
cmp dword [rbp + 0x38], esi
jne 0x1400554d7
lea r8, [rbp + 0x38]
lea edx, [rsi + 0x13]
call fcn.14006e9a8
mov ebx, eax
test eax, eax
jns 0x1400555cc
mov ecx, eax
jmp 0x140055612
cmp dword [rbp + 0x38], 0
jne 0x1400554d7
lea r8, [rbp + 0x38]
mov edx, SafeArrayUnaccessData
call fcn.14006e9a8
mov ebx, eax
test eax, eax
js 0x1400555c8
cmp dword [rbp + 0x38], 0
jne 0x1400554d7
lea rcx, [rbp + 0x38]
call fcn.140055244
test eax, eax
js 0x14005560b
cmp dword [rbp + 0x38], 0
jne 0x1400554d7
mov ebx, 0xc004f025
mov ecx, ebx
call fcn.1400790f8
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
mov ecx, ebx
call fcn.140079118
lea rdx, [0x1404271d4]
lea rcx, [0x140414f20]
call fcn.1400e8db8
mov eax, ebx
add rsp, 0x28
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ecx, ebx
call fcn.1400790f8
lea rdx, [0x1404289a4]
lea rcx, [0x14041a8e8]
call fcn.1400e9ac8
jmp 0x140055617
Function at 0x14005a750
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
and qword [rbp + 0x1f], 0
xorps xmm0, xmm0
and qword [rbp + 0x47], 0
mov rdi, rdx
mov rbx, rcx
movdqa xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x27], xmm0
lea rdx, [0x140429128]
movdqa xmmword [rbp + 0x37], xmm1
lea rcx, [0x14040b154]
call fcn.1400e8a6c
lea rax, [0x14004bd78]
mov qword [rbp - 0x29], 3
mov qword [rbp - 0x21], rax
lea rdx, [0x14042bf98]
lea rax, [rbp + 0x67]
mov qword [rbp - 9], rbx
mov qword [rbp - 0x19], rax
lea rcx, [0x1404057c8]
lea rax, [rbp + 7]
mov qword [rbp - 0x11], rax
call fcn.1400ea158
xor r9d, r9d
lea rdx, [rbp - 0x29]
mov ecx, 0xb9
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x67]
test ebx, ebx
jns 0x14005a7fe
mov ecx, ebx
call fcn.1400790f8
jmp 0x14005a867
lea rdx, [0x140425e70]
lea rcx, [0x140410a5c]
call fcn.1400e9e10
mov rcx, qword [rbp + 0x37]
mov rdx, rdi
call fcn.140078fc0
mov ebx, eax
test eax, eax
jns 0x14005a827
mov ecx, eax
jmp 0x14005a7f7
mov rcx, qword [rbp + 0x3f]
lea rdx, [rdi + 8]
call fcn.140078fc0
mov ebx, eax
test eax, eax
js 0x14005a823
mov rcx, qword [rbp + 0x47]
lea rdx, [rdi + 0x10]
call fcn.140078fc0
mov ebx, eax
test eax, eax
jns 0x14005a867
mov ecx, eax
call fcn.1400790f8
lea rdx, [0x140428a68]
lea rcx, [0x14041aa28]
call fcn.1400ea7f4
mov ecx, ebx
call fcn.140079118
lea rcx, [rbp + 7]
call fcn.14005a3f4
lea rdx, [0x14042d888]
lea rcx, [0x14040f420]
call fcn.1400ea4ac
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005ba1c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov r13, rdx
mov rdi, rcx
mov qword [rbp - 0x31], rbx
lea rdx, [0x14042ba4c]
mov qword [rbp - 1], rbx
lea rcx, [0x14040d77c]
mov esi, ebx
mov r14d, ebx
mov r15, r9
mov r12, r8
call fcn.1400ea7f4
xorps xmm0, xmm0
mov qword [rbp + 0x17], rbx
xor edx, edx
lea r8d, [rbx + 0x30]
lea rcx, [rbp - 1]
movdqu xmmword [rbp + 7], xmm0
call sub.msvcrt.dll_memset
test r15, r15
jne 0x14005ba9e
mov ebx, 0x80070057
mov ecx, ebx
call fcn.1400790f8
jmp 0x14005bb7e
mov rbx, qword [0x14042eab0]
lea rdx, [0x14042bb38]
lea rcx, [0x14040d820]
lea rsi, [rbx + 8]
call fcn.1400e8a6c
test rsi, rsi
je 0x14005bad2
mov r14d, 1
mov rcx, rsi
mov edx, r14d
call fcn.140071b04
lea rax, [0x140049678]
mov qword [rbp + 0x1f], rdi
mov qword [rbp - 0x21], rax
lea rdx, [0x140429374]
lea rax, [rbp + 0x7f]
mov qword [rbp + 0x27], rbx
lea rcx, [0x1404027bc]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x29], 3
call fcn.1400e9e10
xor r9d, r9d
lea rax, [rbp - 1]
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp - 0x31]
mov ecx, 0xb9
mov qword [rbp - 9], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x7f]
test ebx, ebx
js 0x14005ba92
mov rbx, qword [rbp - 0x31]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x1403af620]
lea r9, [rbp - 0x39]
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rdi
lea rdx, [0x14042c674]
mov ebx, eax
lea rcx, [0x14040e2e8]
call fcn.1400ea4ac
test ebx, ebx
js 0x14005ba92
mov eax, dword [rbp - 0x39]
mov dword [r15], eax
mov ecx, ebx
call fcn.140079118
lea rdx, [0x14042a96c]
lea rcx, [0x140414b88]
call fcn.1400ea158
lea rcx, [rbp - 1]
call fcn.140057570
lea rcx, [rbp - 0x31]
call fcn.1400574c4
test rsi, rsi
je 0x14005bbbc
test r14d, r14d
je 0x14005bbbc
mov rcx, rsi
call fcn.1400719a0
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400657ac
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov rdi, r8
and dword [rcx], ebx
mov rsi, rcx
cmp qword [rcx + 0x18], rbx
jne 0x1400657e0
mov edi, 0xc004f07a
mov ecx, edi
call fcn.1400790f8
jmp 0x14006589e
xor ecx, ecx
call fcn.140079118
xor ecx, ecx
call fcn.140079118
mov eax, 0x40
mov edx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x14006580c
mov edi, 0x8007000e
jmp 0x1400657d4
movups xmm0, xmmword [rdi]
mov dword [rbp + 0x20], 0x10000
mov edx, 4
movups xmm1, xmmword [rdi + 0x10]
mov dword [rax], edx
lea rcx, [0x14004ee38]
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rbx + 8], rax
lea r8d, [rdx + 0x38]
movups xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x20], xmm1
movups xmmword [rbx + 0x30], xmm0
mov rax, qword [rsi + 0x18]
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x38], rcx
lea rcx, [rbp + 0x38]
mov qword [rbp - 0x14], rax
lea rax, [rsi + 4]
mov qword [rbp - 0x30], rcx
lea ecx, [r8 + 0x7d]
mov dword [rbp - 0x20], edx
lea rdx, [rbp - 0x40]
mov qword [rbp - 0xc], rax
mov dword [rbp + 0x28], SafeArrayUnaccessData
mov qword [rbp - 0x1c], rbx
mov qword [rbp - 0x40], 3
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, dword [rbp + 0x38]
test edi, edi
js 0x1400657d4
mov ecx, dword [rbp + 0x28]
mov dword [rsi], ecx
mov ecx, edi
call fcn.140079118
test rbx, rbx
je 0x1400658b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140084198
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rax, [0x14004d438]
mov qword [rbp - 0x39], 3
mov qword [rbp - 0x31], rax
mov r12, rdx
lea rax, [rbp - 0x49]
mov rbx, rcx
lea rdx, [0x140427810]
mov qword [rbp - 0x29], rax
lea rcx, [0x140411dec]
mov r15, r9
mov r14, r8
call fcn.1400e9e10
xor r9d, r9d
mov qword [rbp - 0x21], rbx
lea rax, [rbp + 0x17]
mov qword [rbp - 0x19], r12
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], rax
lea ebx, [r9 + 0x50]
mov r8d, ebx
lea ecx, [rbx + 0x69]
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp - 0x49]
xor edi, edi
test esi, esi
jns 0x140084250
mov ecx, esi
call fcn.1400790f8
lea rdx, [0x1404280e0]
lea rcx, [0x140412710]
call fcn.1400ea4ac
jmp 0x140084336
lea rax, [0x14004cdb8]
mov qword [rbp - 0x39], 3
mov qword [rbp - 0x31], rax
lea rdx, [0x14042b654]
lea rax, [rbp - 0x45]
lea rcx, [0x14040d2ec]
mov qword [rbp - 0x29], rax
call fcn.1400ea7f4
lea rax, [rbp + 0x17]
mov qword [rbp - 0x21], r12
mov qword [rbp - 9], rax
lea rdx, [rbp - 0x39]
lea rax, [rbp - 0x41]
mov qword [rbp - 0x19], rdi
xor r9d, r9d
mov qword [rbp + 0xf], rax
mov r8, rbx
mov qword [rbp - 0x11], r14
mov ecx, 0xb9
mov dword [rbp - 1], edi
mov dword [rbp + 3], 1
mov qword [rbp + 7], rdi
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp - 0x45]
cmp ecx, 0xc004d304
je 0x140084333
mov esi, ecx
test ecx, ecx
jns 0x1400842d4
call fcn.1400790f8
jmp 0x140084336
mov ebx, dword [rbp - 0x41]
mov r12d, 0xfff
mov r14d, ebx
and r14d, 0xf000
cmp r14d, 0xc000
jne 0x140084301
mov eax, ebx
and eax, r12d
sub eax, 0x401
cmp eax, 0x95
jbe 0x14008432e
lea rdx, [0x14042c1f0]
lea rcx, [0x140405a98]
call fcn.1400ea158
cmp r14d, 0xc000
jne 0x140084333
and ebx, r12d
sub ebx, 0x497
cmp ebx, 0x169
ja 0x140084333
mov edi, 1
mov dword [r15], edi
mov ecx, esi
call fcn.140079118
lea rdx, [0x1404296b0]
lea rcx, [0x14040b5f4]
call fcn.1400e8a6c
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140368700
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14008fcc8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x27], rax
and qword [rbp - 0x41], 0
lea rax, [rbp - 0x49]
and dword [rbp - 0x39], 0
lea r9, [rbp - 0x41]
and dword [rbp - 0x35], 0
lea r8, str.PolicyValuesArray
and qword [rbp - 0x31], 0
lea rdx, [0x1403b9cf0]
mov qword [rsp + 0x20], rax
mov r15, rcx
call fcn.14008fe50
mov edi, eax
mov r13d, 0x8007000d
cmp eax, 0x80070002
jne 0x14008fd3f
xor edi, edi
jmp 0x14008fdd3
test eax, eax
jns 0x14008fd4f
mov ecx, eax
call fcn.1400790f8
jmp 0x14008fdd3
mov ecx, dword [rbp - 0x49]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov rbx, rdx
shr rbx, 5
lea rax, [rbx + rbx*2]
shl rax, 4
sub rcx, rax
je 0x14008fd7b
mov edi, r13d
mov ecx, r13d
jmp 0x14008fd45
mov rsi, qword [rbp - 0x41]
xor r14d, r14d
test ebx, ebx
je 0x14008fdc7
movups xmm0, xmmword [rsi]
lea r8, [rbp - 0x49]
movups xmm1, xmmword [rsi + 0x10]
lea rdx, [rbp - 9]
movdqu xmmword [rbp - 9], xmm0
lea rcx, [rbp - 0x39]
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp + 0x17], xmm0
call fcn.14008ae4c
mov edi, eax
test eax, eax
js 0x14008fd43
cmp dword [rbp - 0x49], 0
je 0x14008fd73
inc r14d
add rsi, 0x30
cmp r14d, ebx
jb 0x14008fd86
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.14008fb20
xor ebx, ebx
cmp edi, r13d
cmovne ebx, edi
mov ecx, ebx
call fcn.140079118
lea rcx, [rbp - 0x39]
call fcn.14008f6dc
and qword [rbp - 0x19], 0
lea rax, [0x140048978]
xor r9d, r9d
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x29], 3
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x11], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140368700
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret