joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401682ec
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rsi, rcx
mov edi, r8d
xorps xmm0, xmm0
lea rcx, [rbp - 0x40]
xor eax, eax
mov r14, rdx
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
and qword [rbp + 0x30], 0
mov ecx, 0x11
mov r8d, edi
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rcx, qword [rbp + 0x30]
mov rbx, rax
test rcx, rcx
je 0x14016834e
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
test rbx, rbx
je 0x1401683bb
lea rdx, [rbp + 0x38]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov ebx, eax
test eax, eax
jns 0x14016836e
mov ecx, eax
jmp 0x1401683c2
mov rcx, qword [rbp + 0x38]
mov r8, rdi
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x14016836a
mov eax, 0x2011
lea rdx, [rbp - 0x40]
mov word [rbp - 0x40], ax
mov rcx, rsi
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x28], rax
call fcn.14016bc30
mov ebx, eax
test eax, eax
jns 0x1401683c7
jmp 0x14016836a
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x18], 0
lea rax, [0x14002fe9c]
xor r9d, r9d
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], 3
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x10], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140169600
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x20], 0
mov rdi, rcx
and qword [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
mov r15, r9
mov rsi, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x1a8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp + 0x20]
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
test eax, eax
js 0x140169716
movsd xmm1, qword [rbp - 0x48]
mov eax, 8
mov rbx, qword [rbp + 0x20]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x50], r15
movups xmm0, xmmword [rbp - 0x58]
mov rax, qword [rbx]
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x140169716
mov rax, qword [r14]
mov rbx, qword [rax + 0x88]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x60]
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
js 0x140169716
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp + 0x20]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
jns 0x14016971d
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x14003531c]
mov r14d, 3
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r14
mov edi, 0xb9
mov qword [rbp - 8], rax
xor r9d, r9d
lea rdx, [rbp - 0x20]
lea esi, [r14 + 0x1d]
mov ecx, edi
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x10], 0
lea rax, [0x140034fdc]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], r14
xor r9d, r9d
mov qword [rbp - 8], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140169ff8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rsp + 0x68], 0
mov r14, rcx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rbp + 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14016a04c
lea rax, [0x1403b5290]
mov qword [rsi], rax
mov dword [rsi + 0x10], 1
lock inc dword [0x1404515d4]
jmp 0x14016a04e
xor esi, esi
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14016a073
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x68], rsi
test rsi, rsi
jne 0x14016a08b
mov ebp, 0x8007000e
mov ecx, ebp
call fcn.140082a8c
jmp 0x14016a093
and qword [rsp + 0x68], rbp
mov qword [r14], rsi
mov ecx, ebp
call fcn.140082b34
and qword [rsp + 0x30], 0
lea rax, [0x14002e49c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x14016b75c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
movsxd rsi, edx
mov rdi, rcx
mov qword [rbp + 0x20], rbx
cmp dword [rcx], esi
je 0x14016b83c
mov r14d, dword [rcx + 4]
cmp esi, r14d
cmovl r14d, esi
test edx, edx
jle 0x14016b805
mov rbx, rsi
xor ecx, ecx
call fcn.140082b34
shl rbx, 3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rbp + 0x20]
mov rbx, rax
test r15, r15
je 0x14016b7dc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14016b894
mov qword [rbp + 0x20], rbx
test r14d, r14d
je 0x14016b805
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd r8, r14d
shl r8, 3
call sub.msvcrt.dll_memcpy
mov rbx, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
mov r15, qword [rdi + 8]
test r15, r15
je 0x14016b827
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test rbx, rbx
cmovne rax, rbx
xor ebx, ebx
mov qword [rdi + 8], rax
mov dword [rdi + 4], r14d
mov dword [rdi], esi
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x14002f4dc]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.140082a8c
jmp 0x14016b83c
Function at 0x14016bc30
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa0
mov r14, rcx
xorps xmm0, xmm0
xor eax, eax
lea rcx, [rbp - 0x59]
xor r12d, r12d
mov qword [rbp - 0x49], rax
mov qword [rbp + 0x6f], r12
mov r15, rdx
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
xorps xmm0, xmm0
lea rcx, [rbp - 0x41]
xor eax, eax
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rax, [rbp + 0x6f]
xor edx, edx
lea r9, [0x1403e2d20]
mov qword [rsp + 0x20], rax
lea r8d, [r12 + 1]
lea rcx, [0x1403d6fe0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x14016bcc6
mov ecx, eax
call fcn.140082a8c
jmp 0x14016be0a
mov rbx, qword [rbp + 0x6f]
or r13d, 0xffffffff
mov rax, qword [rbx]
mov rdi, qword [rax + 0x240]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
movzx edx, r13w
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14016bcba
mov rbx, qword [rbp + 0x6f]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x1f8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
movzx edx, r12w
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14016bcba
cmp dword [0x140452a98], 1
lea eax, [r13 + 9]
movsd xmm1, qword [rbp - 0x49]
mov rsi, r12
mov rbx, qword [rbp + 0x6f]
cmove rsi, qword [0x140452180]
mov word [rbp - 0x59], ax
mov rax, r12
cmove rax, qword [0x140452188]
mov qword [rbp - 0x51], rax
mov rax, qword [rbx]
movups xmm0, xmmword [rbp - 0x59]
movsd qword [rbp - 0x19], xmm1
mov rdi, qword [rax + 0x280]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
movaps xmmword [rbp - 0x29], xmm0
call rax
mov rax, rdi
lea r8, [rbp - 0x29]
mov rdx, rsi
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14016bcba
movups xmm0, xmmword [r15]
mov rbx, qword [rbp + 0x6f]
movsd xmm1, qword [r15 + 0x10]
movaps xmmword [rbp - 0x29], xmm0
movsd qword [rbp - 0x19], xmm1
mov rax, qword [rbx]
mov rdi, qword [rax + 0x1d0]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x29]
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14016bcba
cmp word [rbp + 0x67], r13w
je 0x14016bdfb
mov rcx, qword [r14]
test rcx, rcx
je 0x14016bdef
mov rdx, qword [rbp + 0x6f]
call fcn.140114994
mov ebx, 0x8004bd01
mov ecx, ebx
jmp 0x14016bcbc
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x6f], r12
mov qword [rax], rcx
mov ecx, ebx
call fcn.140082b34
xor r9d, r9d
mov qword [rbp - 9], 3
lea rax, [0x14002899c]
mov qword [rbp + 7], r12
mov qword [rbp - 1], rax
lea rdx, [rbp - 9]
lea rax, [rbp + 0x6f]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp + 0xf], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14016cd30
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rcx + 8]
mov rdi, rdx
mov r15d, dword [rcx]
mov rsi, rcx
mov r12d, dword [rcx + 4]
and qword [rcx + 8], 0
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 4], eax
mov rbp, qword [rdx + 8]
and qword [rdx + 8], 0
mov r14, qword [rcx + 8]
mov qword [rsp + 0x70], rbx
test r14, r14
je 0x14016cd96
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x70]
xor eax, eax
test rbp, rbp
cmovne rax, rbp
and qword [rsp + 0x70], 0
mov qword [rsi + 8], rax
mov dword [rdi], r15d
mov dword [rdi + 4], r12d
mov rsi, qword [rdi + 8]
test rsi, rsi
je 0x14016cdcd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov qword [rsp + 0x20], 3
test rbx, rbx
lea rdx, [rsp + 0x20]
mov ecx, 0xb9
cmovne rax, rbx
and qword [rsp + 0x30], 0
mov qword [rdi + 8], rax
xor r9d, r9d
lea rax, [0x140031f1c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14016dcb4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x20], 0
mov rdi, rcx
movsxd rsi, edx
cmp dword [rcx], esi
je 0x14016ddea
mov r14d, dword [rcx + 4]
cmp esi, r14d
cmovl r14d, esi
test edx, edx
jle 0x14016dd65
mov rbx, rsi
xor ecx, ecx
call fcn.140082b34
shl rbx, 5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rbp + 0x20]
mov rbx, rax
test r15, r15
je 0x14016dd33
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
jne 0x14016dd49
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.140082a8c
jmp 0x14016ddec
mov qword [rbp + 0x20], rbx
test r14d, r14d
je 0x14016dd65
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd r8, r14d
shl r8, 5
call sub.msvcrt.dll_memcpy
cmp esi, dword [rdi + 4]
jge 0x14016ddb1
mov ebx, esi
movsxd rdx, ebx
shl rdx, 5
add rdx, qword [rdi + 8]
je 0x14016ddaa
and qword [rbp - 0x10], 0
lea rax, [0x14002761c]
xor r9d, r9d
mov qword [rbp - 8], rdx
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 3
mov ecx, 0xb9
mov qword [rbp - 0x18], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc ebx
cmp ebx, dword [rdi + 4]
jl 0x14016dd6c
mov r15, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14016ddd7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test r15, r15
cmovne rax, r15
mov qword [rdi + 8], rax
mov dword [rdi + 4], r14d
mov dword [rdi], esi
xor ebx, ebx
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x14002f19c]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14016de4c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x20], 0
mov rdi, rcx
movsxd rsi, edx
cmp dword [rcx], esi
je 0x14016dfc0
mov r14d, dword [rcx + 4]
cmp esi, r14d
cmovl r14d, esi
test edx, edx
jle 0x14016df34
lea r15, [rsi + rsi*2]
movabs rax, 0xaaaaaaaaaaaaaaab
shl r15, 3
xor ebx, ebx
mul r15
shr rdx, 4
cmp rdx, rsi
je 0x14016debd
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140082a8c
mov r15, qword [rbp + 0x20]
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x14016ded4
mov ecx, ebx
call fcn.140082a8c
jmp 0x14016dfc2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rbp + 0x20]
mov rbx, rax
test r15, r15
je 0x14016df08
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
jne 0x14016df14
mov ebx, 0x8007000e
jmp 0x14016dec8
mov qword [rbp + 0x20], rbx
test r14d, r14d
je 0x14016df34
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd rax, r14d
lea r8, [rax + rax*2]
shl r8, 3
call sub.msvcrt.dll_memcpy
cmp esi, dword [rdi + 4]
jge 0x14016df87
mov ebx, esi
mov rdx, qword [rdi + 8]
movsxd rax, ebx
lea rcx, [rax + rax*2]
lea rax, [rdx + rcx*8]
test rax, rax
je 0x14016df80
and qword [rbp - 0x10], 0
lea rcx, [0x140025c1c]
xor r9d, r9d
mov qword [rbp - 0x18], rcx
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 3
mov ecx, 0xb9
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc ebx
cmp ebx, dword [rdi + 4]
jl 0x14016df3b
mov r15, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14016dfad
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test r15, r15
cmovne rax, r15
mov qword [rdi + 8], rax
mov dword [rdi + 4], r14d
mov dword [rdi], esi
xor ebx, ebx
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x1400301dc]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14016e584
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
movsxd r14, edx
mov ecx, dword [rcx + 4]
mov r12, r8
test ecx, ecx
jns 0x14016e5ae
mov edi, 0x8000ffff
mov ecx, edi
jmp 0x14016e5c8
lea r8, [rsp + 0x80]
mov edx, 1
call fcn.1400821a4
mov edi, eax
test eax, eax
jns 0x14016e5d2
mov ecx, eax
call fcn.140082a8c
jmp 0x14016e72f
mov edi, dword [rsi]
test edi, edi
jns 0x14016e5e6
mov edi, 0x8000ffff
mov ebx, edi
mov ecx, edi
jmp 0x14016e68b
cmp dword [rsp + 0x80], edi
jg 0x14016e5f6
xor ebx, ebx
jmp 0x14016e690
mov r15d, dword [rsp + 0x80]
test edi, edi
jne 0x14016e60b
mov edi, 0x20
xor ebx, ebx
jmp 0x14016e665
js 0x14016e647
lea ecx, [rdi + rdi]
xor ebx, ebx
mov eax, ecx
shr eax, 1
cmp eax, edi
je 0x14016e628
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140082a8c
jmp 0x14016e62b
mov r15d, ecx
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x14016e64c
test r15d, r15d
jns 0x14016e642
mov ebx, 0x80070216
jmp 0x14016e64c
mov edi, r15d
jmp 0x14016e653
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x14016e665
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x14016e6a4
cmp edi, dword [rsp + 0x80]
jl 0x14016e5fe
mov edx, edi
mov rcx, rsi
call fcn.14016e754
mov ebx, eax
test eax, eax
jns 0x14016e690
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
mov edi, ebx
test ebx, ebx
jns 0x14016e6a8
mov ecx, ebx
jmp 0x14016e5c8
mov ecx, ebx
jmp 0x14016e68b
mov r8d, dword [rsi + 4]
mov rbx, r14
cmp r14d, r8d
jge 0x14016e6d2
sub r8d, r14d
mov rdx, r14
shl rdx, 4
add rdx, qword [rsi + 8]
movsxd r8, r8d
shl r8, 4
lea rcx, [rdx + 0x10]
call sub.msvcrt.dll_memmove
mov rax, qword [rsi + 8]
lea rcx, [0x14003599c]
shl rbx, 4
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbx + rax], xmm0
mov rax, qword [rsi + 8]
lea r8d, [r9 + 0x28]
mov qword [rsp + 0x28], rcx
add rax, rbx
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], 3
mov qword [rsp + 0x30], rcx
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r12
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rsi + 4]
xor edi, edi
mov ecx, edi
call fcn.140082b34
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14016e754
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x20], 0
mov rdi, rcx
movsxd rsi, edx
cmp dword [rcx], esi
je 0x14016e88a
mov r14d, dword [rcx + 4]
cmp esi, r14d
cmovl r14d, esi
test edx, edx
jle 0x14016e805
mov rbx, rsi
xor ecx, ecx
call fcn.140082b34
shl rbx, 4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rbp + 0x20]
mov rbx, rax
test r15, r15
je 0x14016e7d3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
jne 0x14016e7e9
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.140082a8c
jmp 0x14016e88c
mov qword [rbp + 0x20], rbx
test r14d, r14d
je 0x14016e805
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd r8, r14d
shl r8, 4
call sub.msvcrt.dll_memcpy
cmp esi, dword [rdi + 4]
jge 0x14016e851
mov ebx, esi
movsxd rdx, ebx
shl rdx, 4
add rdx, qword [rdi + 8]
je 0x14016e84a
and qword [rbp - 0x10], 0
lea rax, [0x14003155c]
xor r9d, r9d
mov qword [rbp - 8], rdx
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 3
mov ecx, 0xb9
mov qword [rbp - 0x18], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc ebx
cmp ebx, dword [rdi + 4]
jl 0x14016e80c
mov r15, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14016e877
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test r15, r15
cmovne rax, r15
mov qword [rdi + 8], rax
mov dword [rdi + 4], r14d
mov dword [rdi], esi
xor ebx, ebx
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x140031f1c]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14016ea1c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
movsxd rsi, edx
mov rdi, rcx
mov qword [rbp + 0x20], rbx
cmp dword [rcx], esi
je 0x14016eafc
mov r14d, dword [rcx + 4]
cmp esi, r14d
cmovl r14d, esi
test edx, edx
jle 0x14016eac5
mov rbx, rsi
xor ecx, ecx
call fcn.140082b34
shl rbx, 3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rbp + 0x20]
mov rbx, rax
test r15, r15
je 0x14016ea9c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14016eb54
mov qword [rbp + 0x20], rbx
test r14d, r14d
je 0x14016eac5
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd r8, r14d
shl r8, 3
call sub.msvcrt.dll_memcpy
mov rbx, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
mov r15, qword [rdi + 8]
test r15, r15
je 0x14016eae7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test rbx, rbx
cmovne rax, rbx
xor ebx, ebx
mov qword [rdi + 8], rax
mov dword [rdi + 4], r14d
mov dword [rdi], esi
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x1400335dc]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.140082a8c
jmp 0x14016eafc