joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400054a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400054c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400054d8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400054f4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400054f6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005532
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400055ce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000556d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400055ae
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400055ce
cmp rbx, rax
ja 0x140005580
test rbx, rbx
je 0x1400055ce
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140005a30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140005a5d
xor eax, eax
jmp 0x140005bc9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005a97
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005a97
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005bc9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005bbc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140005ada
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005b05
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005bc1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005b74
sub eax, 1
je 0x140005b74
cmp eax, 2
jne 0x140005bbc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005bc1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005ba2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140005bbc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140005bc1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000a9a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140006160
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006233
cmp byte [rcx + 0x71], 0
je 0x140006233
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000622f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400061f4
sub eax, 1
je 0x1400061f8
cmp eax, 2
jne 0x14000622f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a9a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006226
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000622f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400061dc
xor al, al
jmp 0x1400061dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a9a0
add rsp, 0x60
pop rbx
ret
Function at 0x140007910
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea r9, [rsp + 0x20]
mov rsi, rcx
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400079a1
test rbx, rbx
je 0x140007969
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140007953
test eax, eax
jns 0x1400079c2
test rbx, rbx
je 0x1400079c7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140007a8d
test rbx, rbx
jne 0x1400079ce
xor eax, eax
jmp 0x140007a8d
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x140007a75
nop dword [rax + rax]
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.140005f70
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140007a13
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140007aaa
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140007a6b
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a66
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007af3
call fcn.14000aa04
inc edi
cmp edi, dword [rbx]
jb 0x1400079e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000a9a0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140007aff
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007afa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007afa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000aa04
mov rax, rdi
jmp 0x140007a88
Function at 0x140008390
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000842f
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000842f
mov r8d, dword [rax + rcx + 0xd8]
test r8d, r8d
je 0x140008422
mov rdi, qword [r8 + rcx + 0x58]
test rdi, rdi
je 0x140008422
sub rcx, rdx
movabs rsi, 0x2b992ddfa232
add rdi, rcx
cmp qword [rdi], rsi
jne 0x14000842f
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x1400096a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400097b2
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400097b2
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x140009719
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x1400097bd
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x1400097a0
mov edx, dword [rbx + 4]
test edx, edx
je 0x1400097a0
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x140009779
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x140009795
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14000a0c0
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x140009731
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x1400097bd
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000a9a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000b560
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b5aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b5aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b5aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b5aa
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b5aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b5ac
xor al, al
add rsp, 0x28
ret
Function at 0x1400014a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
lea rax, [rsp + 0x30]
mov rdi, r8
mov r9d, 8
mov r8, rbx
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140001538
lea rax, [rsp + 0x38]
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001509
cmp rbx, qword [rsp + 0x38]
jne 0x140001509
mov dil, 1
jmp 0x14000150c
xor dil, dil
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor edx, edx
movzx ecx, dil
test eax, eax
cmove ecx, edx
movzx eax, cl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000577c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400055e4
Function at 0x1400542d8
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
and dword [rsp + 0x20], 0
lea r8, [r11 + 0x10]
xor eax, eax
mov rsi, rcx
and dword [rcx + 8], eax
xor r9d, r9d
and qword [r11 + 0x10], rax
lea rcx, str.D:PAI_A_OICI_FA___WD_
mov qword [r11 - 0x30], rax
xor ebx, ebx
lea ebp, [rax + 1]
mov qword [r11 - 0x28], rax
mov edx, ebp
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x140054354
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14005433a
mov edi, 0x80004005
jmp 0x140054348
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.140078308
jmp 0x14005441f
mov rax, qword [rsp + 0x68]
lea r8, str.Global552FFA80_3393_423d_8671_7BA046BB5906
and dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
jne 0x1400543c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400543af
lea r8, str.Global552FFA80_3393_423d_8671_7BA046BB5906
xor edx, edx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
test rax, rax
jne 0x1400543c3
jmp 0x140054329
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14005441f
jmp 0x140054348
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400543f7
cmp eax, 0x80
je 0x1400543ed
cmp eax, 0x102
jne 0x1400543fa
mov edi, 0x800705b4
jmp 0x140054348
mov edi, 0x8000ffff
jmp 0x140054348
mov dword [rsi + 8], ebp
mov rcx, qword [rsi]
mov r14, rbx
mov rbp, rbx
xor ebx, ebx
test rcx, rcx
je 0x140054413
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsi], rbx
xor eax, eax
test rbp, rbp
cmovne rax, r14
mov qword [rsi], rax
mov ecx, edi
call fcn.140078324
test rbx, rbx
je 0x140054434
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140054444
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140054fcc
Capabilities:
Get token membership

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x28
lea rax, str.S_1_5_80_123231216_2592883651_3715271367_3753151631_4175906628
xor ecx, ecx
mov qword [rbp + 0x50], rax
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
cmp eax, 0x6bd
jne 0x140054ffe
xor ebx, ebx
jmp 0x1400551c3
test eax, eax
je 0x140055030
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
mov r12d, 0x80004005
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
mov ecx, ebx
call fcn.140078308
jmp 0x1400551c3
and dword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
call fcn.1400680a8
lea rdx, [0x14041bbf8]
mov ebx, eax
lea rcx, [0x1403fd608]
call fcn.1400e6078
test ebx, ebx
jns 0x140055075
mov ecx, ebx
call fcn.140078308
lea rdx, [0x14041aae8]
lea rcx, [0x1404048e8]
call fcn.1400e775c
jmp 0x1400551bb
cmp dword [rbp + 0x38], 0
je 0x140055082
xor ebx, ebx
jmp 0x1400551bb
cmp dword [0x140421b94], 0
je 0x1400551af
xor r14d, r14d
lea r15, [rbp + 0x50]
mov r12d, 0x80004005
mov rcx, qword [r15]
lea rdx, [rbp + 0x48]
xor esi, esi
xor ebx, ebx
and qword [rbp + 0x48], rsi
and dword [rbp + 0x40], ebx
mov dword [rbp + 0x38], esi
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x1400550e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400550ca
mov ebx, r12d
jmp 0x1400550d8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.140078308
jmp 0x1400550fb
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400550bb
mov esi, dword [rbp + 0x40]
mov dword [rbp + 0x38], esi
mov ecx, ebx
call fcn.140078324
lea rcx, [rbp + 0x48]
call fcn.140068dc8
test ebx, ebx
js 0x1400551ed
test esi, esi
jne 0x14005507b
inc r14d
add r15, 8
cmp r14d, 1
jb 0x14005509c
lea r8, [rbp + 0x38]
lea edx, [rsi + 0x12]
call fcn.14006dfe0
lea rdx, [0x14041c6d8]
mov ebx, eax
lea rcx, [0x1403fdfe8]
call fcn.1400e7a9c
test ebx, ebx
js 0x1400551b4
cmp dword [rbp + 0x38], esi
jne 0x14005507b
lea r8, [rbp + 0x38]
lea edx, [rsi + 0x13]
call fcn.14006dfe0
mov ebx, eax
test eax, eax
jns 0x140055170
mov ecx, eax
jmp 0x1400551b6
cmp dword [rbp + 0x38], 0
jne 0x14005507b
lea r8, [rbp + 0x38]
mov edx, SafeArrayGetElement
call fcn.14006dfe0
mov ebx, eax
test eax, eax
js 0x14005516c
cmp dword [rbp + 0x38], 0
jne 0x14005507b
lea rcx, [rbp + 0x38]
call fcn.140054dec
test eax, eax
js 0x1400551af
cmp dword [rbp + 0x38], 0
jne 0x14005507b
mov ebx, 0xc004f025
mov ecx, ebx
call fcn.140078308
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
mov ecx, ebx
call fcn.140078324
lea rdx, [0x14041a378]
lea rcx, [0x140407760]
call fcn.1400e7410
mov eax, ebx
add rsp, 0x28
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ecx, ebx
call fcn.140078308
lea rdx, [0x14041badc]
lea rcx, [0x14040cfc8]
call fcn.1400e7de0
jmp 0x1400551bb
Function at 0x14005a228
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
and qword [rbp + 0x1f], 0
xorps xmm0, xmm0
and qword [rbp + 0x47], 0
mov rdi, rdx
mov rbx, rcx
movdqa xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x27], xmm0
lea rdx, [0x14041c258]
movdqa xmmword [rbp + 0x37], xmm1
lea rcx, [0x1403fdbd4]
call fcn.1400e6d84
lea rax, [0x14001dba0]
mov qword [rbp - 0x29], 3
mov qword [rbp - 0x21], rax
lea rdx, [0x14041eff8]
lea rax, [rbp + 0x67]
mov qword [rbp - 9], rbx
mov qword [rbp - 0x19], rax
lea rcx, [0x1403f8328]
lea rax, [rbp + 7]
mov qword [rbp - 0x11], rax
call fcn.1400e6704
xor r9d, r9d
lea rdx, [rbp - 0x29]
mov ecx, 0xb9
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x67]
test ebx, ebx
jns 0x14005a2d6
mov ecx, ebx
call fcn.140078308
jmp 0x14005a33f
lea rdx, [0x140419070]
lea rcx, [0x1404033bc]
call fcn.1400e63b8
mov rcx, qword [rbp + 0x37]
mov rdx, rdi
call fcn.1400781e4
mov ebx, eax
test eax, eax
jns 0x14005a2ff
mov ecx, eax
jmp 0x14005a2cf
mov rcx, qword [rbp + 0x3f]
lea rdx, [rdi + 8]
call fcn.1400781e4
mov ebx, eax
test eax, eax
js 0x14005a2fb
mov rcx, qword [rbp + 0x47]
lea rdx, [rdi + 0x10]
call fcn.1400781e4
mov ebx, eax
test eax, eax
jns 0x14005a33f
mov ecx, eax
call fcn.140078308
lea rdx, [0x14041bba0]
lea rcx, [0x14040d108]
call fcn.1400e70c4
mov ecx, ebx
call fcn.140078324
lea rcx, [rbp + 7]
call fcn.140059ed4
lea rdx, [0x140420870]
lea rcx, [0x140401dc0]
call fcn.1400e6a48
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005b4e4
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor esi, esi
mov r12, r8
and qword [rbp - 0x31], rsi
mov r13, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp - 1]
mov r15, r9
lea r8d, [rsi + 0x20]
xor r14d, r14d
call sub.msvcrt.dll_memset
and qword [rbp + 0x17], rsi
lea r8d, [rsi + 0x30]
xorps xmm0, xmm0
lea rcx, [rbp - 1]
xor edx, edx
movdqu xmmword [rbp + 7], xmm0
call sub.msvcrt.dll_memset
test r15, r15
jne 0x14005b55c
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140078308
jmp 0x14005b64f
mov rbx, qword [0x140421ad0]
lea rdx, [0x14041eba8]
lea rcx, [0x1404001f0]
call fcn.1400e6d84
lea rsi, [rbx + 8]
test rsi, rsi
je 0x14005b5b6
lea rdx, [0x14041f6cc]
lea rcx, [0x140400cc8]
call fcn.1400e6a48
mov r14d, 1
mov rcx, rsi
mov edx, r14d
call fcn.140070fcc
lea rdx, [0x14041c49c]
lea rcx, [0x1403f53dc]
call fcn.1400e63b8
lea rax, [0x14001b4a0]
mov qword [rbp + 0x1f], rdi
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp + 0x7f]
mov qword [rbp + 0x27], rbx
mov qword [rbp - 0x19], rax
xor r9d, r9d
lea rax, [rbp - 1]
mov qword [rbp - 0x29], 3
mov qword [rbp - 0x11], rax
mov ecx, 0xb9
lea rax, [rbp - 0x31]
lea r8d, [r9 + 0x28]
mov qword [rbp - 9], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x7f]
test ebx, ebx
js 0x14005b550
mov rbx, qword [rbp - 0x31]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x1403a2250]
lea r9, [rbp - 0x39]
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rdi
lea rdx, [0x14041eac4]
mov ebx, eax
lea rcx, [0x14040014c]
call fcn.1400e70c4
test ebx, ebx
js 0x14005b550
mov eax, dword [rbp - 0x39]
mov dword [r15], eax
mov ecx, ebx
call fcn.140078324
lea rcx, [rbp - 1]
call fcn.1400570b0
lea rcx, [rbp - 0x31]
call fcn.14005700c
test rsi, rsi
je 0x14005b67a
test r14d, r14d
je 0x14005b67a
mov rcx, rsi
call fcn.140070e60
lea rdx, [0x14041da1c]
lea rcx, [0x1404073b8]
call fcn.1400e6704
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret