joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008702a
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402471c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, rsi
call fcn.14008808e
mov rcx, rsi
mov rdx, rdi
call fcn.14008811a
mov rcx, rsi
call fcn.1400882de
mov rbx, rax
mov rcx, rsi
call fcn.1400882d4
cmp rax, 3
jb 0x1400870ae
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x14008709e
cmp word [rbx + 4], 0x5c
jne 0x1400870ae
movzx eax, word [rbx]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x1400870ae
jmp 0x14008716b
cmp word [rbx], 0x5c
jne 0x1400870ae
cmp ax, 0x5c
je 0x14008716b
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401c9840]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.140088020
xor ecx, ecx
mov rdx, rbx
call fcn.140086f5d
test eax, eax
js 0x1400871aa
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400882d4
mov r14, rax
mov rcx, rbx
call fcn.1400882de
mov rcx, rsi
mov rdx, rax
mov r8, r14
call fcn.14008814c
mov rcx, rbx
call fcn.1400882de
mov rcx, rax
mov dx, 0x5c
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
je 0x1400871bb
mov rbx, rax
lea r14, [rsp + 0x20]
mov rcx, r14
call fcn.1400882de
sub rbx, rax
add rbx, 2
sar rbx, 1
mov rcx, r14
call fcn.1400882de
mov rcx, rsi
mov rdx, rax
mov r8, rbx
call fcn.14008814c
mov rcx, rsi
mov rdx, rdi
call fcn.1400881fe
mov rcx, r14
call fcn.140088032
mov rcx, rsi
call fcn.140086e9e
xor ebx, ebx
test al, al
jne 0x1400871ca
lea rcx, str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
mov rdi, qword [sym.imp.kernel32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.1400882de
mov rcx, rax
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rcx, [0x1401c9b9e]
call rdi
mov ebx, 0x80070002
jmp 0x1400871ca
mov ebx, eax
lea rcx, str.WebView2:_Failed_to_find_the_app_exe_path._n
call qword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x1400871c0
mov ebx, 0x80004005
lea rcx, [rsp + 0x20]
call fcn.140088032
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401bb650
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140087c37
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov r15, rcx
mov rax, qword [0x1402471c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x3c], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
movzx eax, bl
mov rcx, 0xffffffff80000002
sub rcx, rax
mov qword [rsp + 0x20], rdx
xor ebx, ebx
mov rdx, r15
xor r8d, r8d
mov r9d, 0x20219
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x140087cde
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401bb650
mov eax, ebx
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rdx, str.EBWebView
xor ebx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebp, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebp, ebp
jne 0x140087cbc
cmp dword [rsp + 0x3c], 3
jb 0x140087cbc
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14008811a
mov rcx, rsi
call fcn.1400882de
mov rcx, rax
mov dx, 0x5c
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
je 0x140087d8b
mov rbx, rax
add rbx, 2
movaps xmm0, xmmword [0x1401c9840]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov rcx, rbx
call fcn.140087b06
test al, al
je 0x140087d8b
test rdi, rdi
je 0x140087d77
mov rcx, rdi
mov rdx, rbx
call fcn.14008811a
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140087d92
mov ebx, eax
jmp 0x140087cbc
xor ebx, ebx
jmp 0x140087cbc

Function at 0x140087d92
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
xor eax, eax
lea rdx, [0x1401c9e50]
mov r8d, dword [rax + rdx]
cmp dword [rcx + rax], r8d
ja 0x140087dba
jb 0x140087dc8
add rax, 4
cmp rax, 0x10
jne 0x140087da4
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140086e9e
lea rcx, str.WebView2:_skipped_an_incompatible_version
mov rdi, qword [sym.imp.kernel32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.1400882de
mov rcx, rax
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rcx, [0x1401c9b9e]
call rdi
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14008895b
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov r15, qword [rsp + 0xa0]
mov rax, qword [0x1402471c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r15, r15
je 0x1400889fe
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call qword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x140088a27
mov rcx, r14
mov rdx, rbx
mov r8, rsi
mov r9, rdi
call 0x140088a5b
test al, al
je 0x140088a3a
mov rcx, qword [rsi]
test rcx, rcx
je 0x140088a57
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstol
cmp eax, 1
jmp 0x140088a2c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401bb650
mov rcx, r14
mov rdx, rbx
mov r8, rsi
mov r9, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140088a5b
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [r15], eax
mov sil, 1
jmp 0x140088a3c
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401bb650
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
jmp 0x140088a2f
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1402471c0]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x140088aec
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14008811a
mov rcx, rdi
call fcn.1400882de
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401bb650
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140088a5b
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov r15, qword [rsp + 0xa0]
mov rax, qword [0x1402471c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r15, r15
je 0x1400889fe
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call qword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x140088a27
mov rcx, r14
mov rdx, rbx
mov r8, rsi
mov r9, rdi
call 0x140088a5b
test al, al
je 0x140088a3a
mov rcx, qword [rsi]
test rcx, rcx
je 0x140088a57
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstol
cmp eax, 1
jmp 0x140088a2c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401bb650
mov rcx, r14
mov rdx, rbx
mov r8, rsi
mov r9, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140088a5b
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [r15], eax
mov sil, 1
jmp 0x140088a3c
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401bb650
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
jmp 0x140088a2f
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1402471c0]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x140088aec
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14008811a
mov rcx, rdi
call fcn.1400882de
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401bb650
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140088bbc
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
mov rax, qword [0x1402471c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.kernel32.dll_LoadLibraryW]
test rax, rax
je 0x140088c32
mov rdi, rax
lea rdx, str.CreateWebViewEnvironmentWithOptionsInternal
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140088ccc
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
mov ecx, r14d
mov edx, ebp
mov r8, rsi
call qword [0x1401be9b8]
mov esi, eax
jmp 0x140088d51
call qword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401c9840]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.140088020
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rdi
call fcn.140088b14
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
mov r14, qword [sym.imp.kernel32.dll_OutputDebugStringW]
call r14
mov rcx, rdi
call fcn.1400882de
mov rcx, rax
call r14
lea rcx, str._path
call r14
mov rcx, rbx
call r14
lea rcx, [0x1401ca266]
call r14
mov rcx, rdi
call fcn.140088032
jmp 0x140088d6f
call qword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401c9840]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.140088020
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rbx
call fcn.140088b14
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
mov r14, qword [sym.imp.kernel32.dll_OutputDebugStringW]
call r14
mov rcx, rbx
call fcn.1400882de
mov rcx, rax
call r14
lea rcx, [0x1401ca266]
call r14
mov rcx, rbx
call fcn.140088032
lea rdx, str.DllCanUnloadNow
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140088d6f
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401bb650
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140088d8c
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140088de0
mov ebx, eax
mov edx, eax
mov rcx, rsi
call fcn.14008808e
test al, al
je 0x140088de0
mov rcx, rsi
call fcn.1400882d8
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400881dc
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400c14a0
Capabilities:
Inspect section memory permissions

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x2c], ecx
call fcn.140111310
mov dword [rsp + 0x28], eax
call fcn.1401112d0
mov ecx, dword [rsp + 0x28]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
mov ecx, 0x4000000
mov edx, 0x2000000
call fcn.140111320
mov ecx, eax
mov edx, 0x80000
call fcn.140111320
mov ecx, eax
mov edx, 0xc00000
call fcn.140111320
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140111330
mov ecx, 0x10
mov edx, 0x100
call fcn.1401112e0
mov edx, eax
lea rcx, [rsp + 0x34]
call fcn.1401112f0
lea rcx, [rsp + 0x2c]
mov edx, 1
call fcn.1400c2140
test al, 1
jne 0x1400c1544
mov ecx, 1
mov edx, 0x800
call fcn.1400c21f0
mov edx, eax
lea rcx, [rsp + 0x2c]
call fcn.1400c2140
test al, 1
jne 0x1400c156a
jmp 0x1400c1555
lea rcx, [rsp + 0x30]
mov edx, 0x40000
call fcn.140111330
jmp 0x1400c1523
lea rcx, [rsp + 0x2c]
mov edx, 0x400
call fcn.1400c2140
test al, 1
jne 0x1400c1590
jmp 0x1400c157b
lea rcx, [rsp + 0x30]
mov edx, 0x10000
call fcn.140111330
jmp 0x1400c1555
lea rcx, [rsp + 0x2c]
mov edx, 2
call fcn.1400c2140
test al, 1
jne 0x1400c15b6
jmp 0x1400c15a1
lea rcx, [rsp + 0x30]
mov edx, 0x20000
call fcn.140111330
jmp 0x1400c157b
lea rcx, [rsp + 0x2c]
mov edx, 4
call fcn.1400c2140
test al, 1
jne 0x1400c15dc
jmp 0x1400c15c7
lea rcx, [rsp + 0x30]
mov edx, 0x10000000
call fcn.140111330
jmp 0x1400c15a1
lea rcx, [rsp + 0x2c]
mov edx, 8
call fcn.1400c2140
test al, 1
jne 0x1400c1602
jmp 0x1400c15ed
lea rcx, [rsp + 0x34]
mov edx, 0x40000
call fcn.1401112f0
jmp 0x1400c15c7
lea rcx, [rsp + 0x2c]
mov edx, 0x10
call fcn.1400c2140
test al, 1
jne 0x1400c1628
jmp 0x1400c1613
lea rcx, [rsp + 0x34]
mov edx, 8
call fcn.1401112f0
jmp 0x1400c15ed
lea rcx, [rsp + 0x2c]
mov edx, 0x40
call fcn.1400c2140
test al, 1
jne 0x1400c164e
jmp 0x1400c1639
lea rcx, [rsp + 0x34]
mov edx, 0x200000
call fcn.1401112f0
jmp 0x1400c1613
lea rcx, [rsp + 0x2c]
mov edx, 0x100
call fcn.1400c2140
test al, 1
jne 0x1400c1674
jmp 0x1400c165f
lea rcx, [rsp + 0x30]
mov edx, 0x40000000
call fcn.140111330
jmp 0x1400c1639
lea rcx, [rsp + 0x2c]
mov edx, 0x2000
call fcn.1400c2140
test al, 1
jne 0x1400c169a
jmp 0x1400c1685
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
call fcn.140111330
jmp 0x1400c165f
lea rcx, [rsp + 0x2c]
mov edx, 0x80
call fcn.1400c2140
test al, 1
jne 0x1400c16c0
jmp 0x1400c16ab
lea rcx, [rsp + 0x30]
mov edx, 0x20000000
call fcn.140111330
jmp 0x1400c1685
lea rcx, [rsp + 0x2c]
mov edx, 0x4000
call fcn.1400c2140
test al, 1
jne 0x1400c16f2
jmp 0x1400c16d1
lea rcx, [rsp + 0x30]
mov edx, 0x1000000
call fcn.140111330
jmp 0x1400c16ab
mov ecx, 0x8000
mov edx, 0x10000
call fcn.1400c21f0
mov edx, eax
lea rcx, [rsp + 0x2c]
call fcn.1400c2110
test al, 1
jne 0x1400c171c
jmp 0x1400c170f
mov ecx, 0x20
mov edx, 0x80000
call fcn.1401112e0
mov edx, eax
lea rcx, [rsp + 0x34]
call fcn.1401112f0
jmp 0x1400c16d1
mov eax, dword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
add rsp, 0x38
ret
mov ecx, 0xcf0000
call fcn.140111370
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140111350
jmp 0x1400c170f
Function at 0x1400c4470
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x24], ecx
call qword [sym.imp.user32.dll_GetKeyState]
nop
add rsp, 0x28
ret

Function at 0x1400c4580
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x24], edx
call qword [sym.imp.user32.dll_MapVirtualKeyW]
nop
add rsp, 0x28
ret

Function at 0x1400c45c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x24], ecx
call qword [sym.imp.user32.dll_GetAsyncKeyState]
nop
add rsp, 0x28
ret

Function at 0x1400c45e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0x100
call qword [sym.imp.user32.dll_GetKeyboardState]
nop
add rsp, 0x38
ret

Function at 0x1400c4660
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x24], ecx
call qword [sym.imp.user32.dll_GetKeyboardLayout]
nop
add rsp, 0x28
ret

Function at 0x1400d51c0
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x34], r8d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
call qword [sym.imp.user32.dll_RegisterRawInputDevices]
nop
add rsp, 0x48
ret
Function at 0x140135bd0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x378
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0xd8], rcx
mov byte [rsp + 0x1b7], 0
mov qword [rsp + 0x1b8], 1
mov byte [rsp + 0x1c7], 0
mov qword [rsp + 0x1c8], 1
lea rax, [rsp + 0x130]
mov qword [rsp + 0x1d0], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x1d8], rax
lea rcx, [rsp + 0x130]
mov edx, 8
call fcn.140137bd0
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x40
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x130]
mov r8d, 0x40
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x170]
lea rdx, [rsp + 0xf0]
mov r8d, 0x40
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x170]
mov r8d, 0x40
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x40
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x30]
call sub.kernel32.dll_GlobalMemoryStatusEx
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x138], rax
mov rax, qword [rsp + 0x40]
mov qword [rcx + 0x140], rax
mov byte [rsp + 0x31f], 0
mov qword [rsp + 0x320], 1
mov byte [rsp + 0x32f], 0
mov qword [rsp + 0x330], 1
lea rax, [rsp + 0x248]
mov qword [rsp + 0x338], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x248]
mov edx, 8
call fcn.140137bd0
lea rcx, [rsp + 0x248]
xor edx, edx
mov r8d, 0x68
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x248]
mov r8d, 0x68
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x2b0]
lea rdx, [rsp + 0x1e0]
mov r8d, 0x68
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x2b0]
mov r8d, 0x68
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x68
mov edx, eax
lea rcx, [rsp + 0x70]
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
je 0x140135dac
add rsp, 0x378
ret
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], r8
xor edx, edx
sub rax, r8
cmovb rax, rdx
mov qword [rsp + 0x370], rax
mov rdx, qword [rsp + 0x370]
call fcn.140163090
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x78]
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x348], rax
mov qword [rsp + 0x350], r8
xor edx, edx
sub rax, r8
cmovb rax, rdx
mov qword [rsp + 0x358], rax
mov rdx, qword [rsp + 0x358]
call fcn.140163090
mov rdx, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xe8], rcx
mov qword [rax + 0x148], rdx
mov qword [rax + 0x150], rcx
jmp 0x140135da4
Function at 0x14013f360
Capabilities:
Reference wmi statements

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp - 8], 0
cmp qword [rdx + 0x10], 1
je 0x14013f3b1
jmp 0x14013f473
mov rax, qword [rbp - 0x20]
add rax, 0x18
mov qword [rbp + 0x48], rax
lea rcx, [0x1401e4b92]
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], 4
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0xc0], 4
call sub.oleaut32.dll_SysAllocString
mov qword [rbp - 0x38], rax
mov rcx, rax
mov qword [rbp - 0x40], rcx
mov qword [rbp + 0x60], rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x70], 0x2c
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xb0], 0x2c
call sub.oleaut32.dll_SysAllocString
mov rdx, qword [rbp - 0x38]
mov r8, rax
mov rax, qword [rbp - 0x20]
mov rcx, r8
mov qword [rbp - 0x30], rcx
mov qword [rbp + 0x78], r8
mov rcx, qword [rax + 0x18]
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov rax, rsp
lea r9, [rbp - 8]
mov qword [rax + 0x28], r9
mov qword [rax + 0x20], 0
mov r9d, 0x30
call fcn.1401394b0
mov dword [rbp - 0x24], eax
jmp 0x14013f483
mov rax, qword [rbp - 0x18]
mov qword [rax], 2
jmp 0x14013f523
mov eax, dword [rbp - 0x24]
mov rcx, qword [rbp - 0x40]
mov dword [rbp + 0x84], eax
call sub.oleaut32.dll_SysFreeString
mov rcx, qword [rbp - 0x30]
call sub.oleaut32.dll_SysFreeString
mov ecx, dword [rbp - 0x24]
call fcn.1401686a0
mov byte [rbp - 0x41], al
jmp 0x14013f4ab
mov al, byte [rbp - 0x41]
test al, 1
jne 0x14013f4d3
jmp 0x14013f4b4
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 8]
mov qword [rbp + 8], rax
mov qword [rbp], 1
add rcx, 0x20
call fcn.14013d960
jmp 0x14013f4e0
mov rax, qword [rbp - 0x18]
mov qword [rax], 2
jmp 0x14013f523
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rdx + 0x20], rcx
mov qword [rdx + 0x28], rax
lea rcx, [rbp + 0x10]
mov r8d, 0x38
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp + 0x10]
mov r8d, 0x38
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x10]
add rsp, 0x150
pop rbp
ret
mov rcx, qword [rbp - 0x20]
call fcn.14013cda0
jmp 0x14013f516
Function at 0x14013fdc0
Capabilities:
List groups for user account

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rbp], rdx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x87], 0
call fcn.14013fb60
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0
mov dword [rbp + 0x2c], 0
lea rax, [0x1401e4cf8]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 1
lea rcx, [rbp + 0x20]
call fcn.14013fc60
mov qword [rbp + 0x18], rax
jmp 0x14013fe34
mov r11, qword [rbp + 0x18]
mov rdx, qword [rbp]
lea rcx, [0x1401e4cf8]
xor r8d, r8d
mov r9d, 1
lea r10, [rbp + 0x28]
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rax
call sub.netapi32.dll_NetUserGetLocalGroups
mov dword [rbp + 0x94], eax
cmp eax, 0
je 0x14013fe86
lea rcx, [rbp + 0x68]
call fcn.140141530
jmp 0x14013fe96
mov eax, dword [rbp + 0x28]
mov edx, eax
lea rcx, [rbp + 0x50]
call fcn.140141420
jmp 0x14013fef4
mov byte [rbp + 0x87], 1
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 8]
mov byte [rbp + 0x87], 0
mov rcx, qword [rbp + 0x30]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0x40]
mov qword [rax + 0x10], rcx
mov byte [rbp + 0x87], 0
lea rcx, [rbp + 0x20]
call fcn.14013adf0
mov rax, qword [rbp + 0x10]
add rsp, 0x140
pop rbp
ret
mov byte [rbp + 0x87], 1
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x40], rax
movups xmm0, xmmword [rbp + 0x50]
movaps xmmword [rbp + 0x30], xmm0
mov rcx, qword [rbp + 0x20]
call fcn.14016ee40
mov byte [rbp - 1], al
jmp 0x14013ff19
mov al, byte [rbp - 1]
test al, 1
jne 0x14013feb5
jmp 0x14013ff22
mov rcx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x28]
mov edx, eax
call fcn.140163290
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rax
jmp 0x14013ff3a
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa0], rdx
call fcn.14016f0c0
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rax
jmp 0x14013ff5f
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
call fcn.140157eb0
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rax
jmp 0x14013ff76
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x30]
call fcn.140145480
jmp 0x14013ff89
jmp 0x14013feb5
Function at 0x14014ff20
Capabilities:
Check os version

Disassembly:
sub rsp, 0x388
mov qword [rsp + 0x260], rcx
lea rcx, [rsp + 0x144]
call fcn.140155e40
lea rcx, [rsp + 0x26c]
lea rdx, [rsp + 0x144]
mov r8d, 0x11c
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x26c]
mov r8d, 0x11c
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x11c
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov ecx, eax
call fcn.140167900
test al, 1
jne 0x14014ff95
mov byte [rsp + 0x27], 1
jmp 0x14014ff9e
cmp dword [rsp + 0x2c], 6
ja 0x14014ffb5
jmp 0x14014ffac
mov al, byte [rsp + 0x27]
and al, 1
add rsp, 0x388
ret
cmp dword [rsp + 0x2c], 6
je 0x14014ffbc
jmp 0x14014ffcc
mov byte [rsp + 0x27], 1
jmp 0x14014ff9e
cmp dword [rsp + 0x30], 3
setae al
and al, 1
mov byte [rsp + 0x27], al
jmp 0x14014ff9e
mov byte [rsp + 0x27], 0
jmp 0x14014ff9e