joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9af6
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1401d39f0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x1400c9c72
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x14021e780]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1401151c0
mov rcx, rbx
call fcn.140113994
sub r14, rax
lea rdx, [0x1401dc65e]
mov rcx, rbx
mov r8, r14
call fcn.1401151c0
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1400eee80
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400c9bd2
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140115208
test eax, eax
je 0x1400c9c96
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400c9c0d
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140115208
test eax, eax
je 0x1400c9c96
xor eax, eax
mov byte [0x14021e379], al
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1401e4925]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c9c9d
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [case.0x140166830.0]
test eax, eax
je 0x1400c9c9d
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x14021e980], al
mov byte [0x14021e378], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x1400c9c0f
xor eax, eax
jmp 0x1400c9c65
Function at 0x1400c9dd2
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x1400c9e05
mov rax, qword [rsi + 8]
test rax, rax
je 0x1400c9f01
bt ebx, 8
jae 0x1400c9e21
mov eax, ebx
and eax, 0x200
jne 0x1400c9f01
cmp edi, 2
lea rax, [0x14021e380]
lea rcx, [0x14021e580]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400c9f01
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x1400c9f01
cmp byte [0x14021e980], 0
setne al
bt ebx, 8
jb 0x1400c9f01
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400c9f01
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movzx ebp, byte [rsi + 0x17]
test bpl, bpl
jns 0x1400c9f5d
mov r14, qword [rsi]
mov rbp, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x1400c9eee
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.1401093c4
test eax, eax
je 0x1400c9f20
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x1400c9ece
cmp dword [rsp + 0x2c], 0
jne 0x1400c9f65
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ecd30
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x1400c9f2e
test ecx, ecx
jne 0x1400c9eee
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x1400c9f8e
cmp dword [rsp + 0x2c], 2
jne 0x1400c9f9f
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400c9f9f
mov r14, rsi
jmp 0x1400c9eb1
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x1400c9f71
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.1400a39bc
jmp 0x1400c9f01
lea rdx, [0x1401ea9d0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
cmp cx, 0x5c
jne 0x1400c9fb8
lea r14, [rax + 2]
dec r13
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x1400c9fa5
jmp 0x1400c9fbb
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov rbp, r13
jmp 0x1400c9ef5
Function at 0x1400ca28b
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov r15, rdx
mov rbx, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x14021e378], 0
je 0x1400ca3e6
xorps xmm0, xmm0
lea r14, [rsp + 0x50]
movaps xmmword [r14], xmm0
mov rcx, r14
mov rdx, r15
call sub.ntdll.dll_RtlInitUnicodeString
lea r13, [rsp + 0x4c]
mov dword [r13], 0x18
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x30]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [r15], xmm0
mov edx, 0x18
mov rcx, r15
call fcn.1400604a4
mov ebp, 5
mov edx, dword [rsp + 0x4c]
mov r12, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
sub rax, r12
cmp rax, rdx
jb 0x1400ca364
ja 0x1400ca3f7
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edx
mov rcx, rbx
mov rdx, r14
mov r8d, 1
mov r9, r12
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0x80000005
je 0x1400ca35e
cmp eax, 0xc0000023
jne 0x1400ca37a
dec ebp
jne 0x1400ca317
jmp 0x1400ca37e
sub rdx, rax
mov rcx, r15
call fcn.140046e26
mov r12, qword [rsp + 0x30]
mov edx, dword [rsp + 0x4c]
jmp 0x1400ca333
test eax, eax
jns 0x1400ca3b4
xor esi, esi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ca394
mov qword [rsp + 0x38], rcx
call fcn.1400eb6ac
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ecd30
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r12 + 4]
mov dword [rdi], eax
mov r8d, dword [r12 + 0xc]
test r8, r8
je 0x1400ca3dd
mov edx, dword [r12 + 8]
add rdx, r12
add r8, rdx
mov rcx, rsi
call fcn.14008b5e2
mov sil, 1
jmp 0x1400ca380
mov rax, qword [rsi]
mov qword [rsi + 8], rax
jmp 0x1400ca3d8
call fcn.1400c9af6
test al, al
jne 0x1400ca2c3
xor esi, esi
jmp 0x1400ca394
lea rax, [r12 + rdx]
mov qword [rsp + 0x38], rax
jmp 0x1400ca333
Function at 0x1400cb690
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x1401d39f0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov r8d, 6
call fcn.140081440
xor edi, edi
test eax, eax
je 0x1400cb71d
lea rcx, [rsp + 0x20]
call fcn.140081400
movzx r15d, byte [0x1401ee775]
cmp rax, r15
jne 0x1400cb738
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14006a010
lea r14, [0x1401ee768]
test r15b, r15b
je 0x1400cb713
lea rdx, [0x1401ee76c]
mov rcx, rax
mov r8, rbx
call fcn.1400ee6d0
test eax, eax
jne 0x1400cb738
mov eax, dword [r14]
mov dword [rsi], eax
mov edi, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ecd30
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [rsp + 0x20]
call fcn.140081400
movzx r15d, byte [0x1401ee855]
cmp rax, r15
jne 0x1400cb77e
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14006a010
lea r14, [0x1401ee848]
test r15b, r15b
je 0x1400cb713
lea rdx, [0x1401ee84c]
mov rcx, rax
mov r8, rbx
call fcn.1400ee6d0
test eax, eax
je 0x1400cb713
lea rcx, [rsp + 0x20]
call fcn.140081400
movzx r15d, byte [0x1401ee935]
cmp rax, r15
jne 0x1400cb7cc
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14006a010
lea r14, [0x1401ee928]
test r15b, r15b
je 0x1400cb713
lea rdx, [0x1401ee92c]
mov rcx, rax
mov r8, rbx
call fcn.1400ee6d0
test eax, eax
je 0x1400cb713
lea rcx, [rsp + 0x20]
call fcn.140081400
movzx r15d, byte [0x1401eea15]
cmp rax, r15
jne 0x1400cb81a
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14006a010
lea r14, [0x1401eea08]
test r15b, r15b
je 0x1400cb713
lea rdx, [0x1401eea0c]
mov rcx, rax
mov r8, rbx
call fcn.1400ee6d0
test eax, eax
je 0x1400cb713
lea rcx, [rsp + 0x20]
call fcn.140081400
movzx r15d, byte [0x1401eeafd]
cmp rax, r15
jne 0x1400cb71d
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14006a010
lea r14, [0x1401eeaf0]
test r15b, r15b
je 0x1400cb713
lea rdx, [0x1401eeaf4]
mov rcx, rax
mov r8, rbx
call fcn.1400ee6d0
test eax, eax
je 0x1400cb713
jmp 0x1400cb71d
Function at 0x1400ce260
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1400ce230]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14021f850]
lea rdx, [0x1400ce1c0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400ce358
cmp dword [0x14021f858], 0
jne 0x1400ce365
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x14021f85c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x1400ce30c
mov ecx, 1
mov edx, 0x28
call fcn.14006a810
test rax, rax
je 0x1400ce365
mov r14, rax
mov ecx, dword [0x14021f85c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400ce35d
lea r15, [0x14021f860]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x14021f870]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ecd30
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140105dc0
mov rcx, r14
call fcn.14006a770
mov rcx, rsi
mov rax, rdi
call qword [case.0x140166830.0]
xor esi, esi
jmp 0x1400ce33c

Function at 0x1400cee30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400cee6c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400cee76
add rdi, rbx
sub rsi, rbx
jne 0x1400cee4a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140105dc0
int3
Function at 0x1400cf740
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400cf750
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400cf771
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400cf791
cmp byte [r14 + 0x68], 0
jne 0x1400cf856
or edi, 0x20000000
test dil, 8
jne 0x1400cf827
xor r15d, r15d
cmp byte [r14 + 0x70], 0
mov r12d, 0
je 0x1400cf7af
mov r12, qword [r14 + 0x78]
cmp byte [r14 + 0x50], 0
mov r13d, 0
je 0x1400cf7c0
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x28], 0
je 0x1400cf7d3
lea rcx, [r14 + 0x30]
call fcn.1400b95f0
mov r15, rax
cmp byte [r14], 0
je 0x1400cf83c
add r14, 8
mov rcx, r14
call fcn.1400b95f0
mov edx, 1
test ebx, ebx
jne 0x1400cf840
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x1400cf84c
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [r14 + 0x88], 0
je 0x1400cf873
or edi, 0x40000000
jmp 0x1400cf79b
xor eax, eax
jmp 0x1400cf7e5
cmp ebx, 4
jne 0x1400cf861
mov edx, 6
jmp 0x1400cf7ee
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400cf812
or edi, 0x80000000
jmp 0x1400cf791
lea ecx, [rbx - 2]
cmp ecx, 2
jae 0x1400cf87e
mov edx, 7
jmp 0x1400cf7ee
or edi, 0x10000000
jmp 0x1400cf79b
cmp ebx, 1
jne 0x1400cf88d
mov edx, 4
jmp 0x1400cf7ee
xor edx, edx
jmp 0x1400cf7ee
Function at 0x1400cf750
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400cf750
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400cf771
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400cf791
cmp byte [r14 + 0x68], 0
jne 0x1400cf856
or edi, 0x20000000
test dil, 8
jne 0x1400cf827
xor r15d, r15d
cmp byte [r14 + 0x70], 0
mov r12d, 0
je 0x1400cf7af
mov r12, qword [r14 + 0x78]
cmp byte [r14 + 0x50], 0
mov r13d, 0
je 0x1400cf7c0
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x28], 0
je 0x1400cf7d3
lea rcx, [r14 + 0x30]
call fcn.1400b95f0
mov r15, rax
cmp byte [r14], 0
je 0x1400cf83c
add r14, 8
mov rcx, r14
call fcn.1400b95f0
mov edx, 1
test ebx, ebx
jne 0x1400cf840
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x1400cf84c
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [r14 + 0x88], 0
je 0x1400cf873
or edi, 0x40000000
jmp 0x1400cf79b
xor eax, eax
jmp 0x1400cf7e5
cmp ebx, 4
jne 0x1400cf861
mov edx, 6
jmp 0x1400cf7ee
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400cf812
or edi, 0x80000000
jmp 0x1400cf791
lea ecx, [rbx - 2]
cmp ecx, 2
jae 0x1400cf87e
mov edx, 7
jmp 0x1400cf7ee
or edi, 0x10000000
jmp 0x1400cf79b
cmp ebx, 1
jne 0x1400cf88d
mov edx, 4
jmp 0x1400cf7ee
xor edx, edx
jmp 0x1400cf7ee

Function at 0x1400cf8a0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400cf8d8
cmp byte [r15 + 0x68], 0
jne 0x1400cf9ab
or edi, 0x20000000
test dil, 8
jne 0x1400cf974
xor r14d, r14d
cmp byte [r15 + 0x70], 0
mov r12d, 0
je 0x1400cf8f6
mov r12, qword [r15 + 0x78]
cmp byte [r15 + 0x50], 0
mov r13d, 0
je 0x1400cf907
mov r13, qword [r15 + 0x58]
cmp byte [r15 + 0x28], 0
je 0x1400cf91a
lea rcx, [r15 + 0x30]
call fcn.1400b95f0
mov r14, rax
cmp byte [r15], 0
jne 0x1400cf925
xor r9d, r9d
jmp 0x1400cf934
add r15, 8
mov rcx, r15
call fcn.1400b95f0
mov r9, rax
cmp ebx, 4
jne 0x1400cf989
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x1400cf9a1
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [r15 + 0x88], 0
je 0x1400cf9b6
or edi, 0x40000000
jmp 0x1400cf8e2
mov edx, 1
test ebx, ebx
je 0x1400cf93e
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400cf9c1
mov edx, 7
jmp 0x1400cf93e
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400cf95f
or edi, 0x80000000
jmp 0x1400cf8d8
or edi, 0x10000000
jmp 0x1400cf8e2
cmp ebx, 1
jne 0x1400cf9d0
mov edx, 4
jmp 0x1400cf93e
xor edx, edx
jmp 0x1400cf93e
Function at 0x1400d4510
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor ecx, ecx
xor eax, eax
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x1400d4632
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x1400d4668
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x1400d4670
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test edi, edi
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x1400d4674
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x1400d467a
pop rdi
pop rsi
ret
xor r10d, r10d
jmp 0x1400d456c
xor eax, eax
jmp 0x1400d4601
mov dl, byte [r8 + 0x19]
jmp 0x1400d4661
cmp byte [r8 + 0x1a], 0
je 0x1400d4665
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x1400d4665
cmp ecx, 0x666f736f
jne 0x1400d4665
cmp edx, 0x76482074
jne 0x1400d4665
mov byte [r8 + 0x19], 1
jmp 0x1400d4665
Function at 0x1400d9a40
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x168], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdi, [rsp + 0x140]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
and byte [rdi], 0xf8
mov al, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdi + 0x1f], al
lea r14, [rsp + 0xa0]
mov r8d, 0xa0
mov rcx, r14
mov dl, 0xaa
call fcn.1400eee80
lea r8, [0x1401ef830]
mov rcx, r14
mov rdx, rdi
call fcn.140086500
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [r14 + 0x50]
mov rdx, qword [r14 + 0x28]
mov r10, qword [r14 + 0x30]
lea r11, [rdx + rax]
mov rcx, qword [r14 + 0x58]
lea r15, [r10 + rcx]
mov r8, qword [r14 + 0x60]
mov r12, qword [r14 + 0x38]
lea r13, [r12 + r8]
mov r9, qword [r14 + 0x68]
lea rbx, [rsp + 0x78]
mov qword [rbx], r11
mov r11, qword [r14 + 0x40]
mov qword [rbx + 8], r15
lea r15, [r11 + r9]
mov qword [rbx + 0x10], r13
mov r13, qword [r14 + 0x70]
mov r14, qword [r14 + 0x48]
mov qword [rbx + 0x18], r15
lea r15, [r14 + r13]
mov qword [rbx + 0x20], r15
movabs r15, 0xffffffffffffe
add rax, r15
sub rax, rdx
add rcx, r15
sub rcx, r10
add r8, r15
sub r8, r12
add r9, r15
sub r9, r11
add r13, r15
add rax, 0xffffffffffffffdc
sub r13, r14
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], r8
mov qword [rdx + 0x18], r9
mov qword [rdx + 0x20], r13
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1400dc280
mov rcx, rdi
mov rdx, rbx
mov r8, rdi
call fcn.140088030
mov rcx, rsi
mov rdx, rdi
call fcn.1400d6d00
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400ecd30
nop
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400df6f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
cmp qword [0x1402211c0], 0
jne 0x1400df725
lea rcx, str.advapi32.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1402211c0], rax
test rsi, rsi
je 0x1400df752
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400df75c
add rdi, rbx
sub rsi, rbx
jne 0x1400df730
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x1400df880
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x14021e988], 0
jne 0x1400df8bd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400df8b0
mov dword [rdi], eax
mov dword [0x14021e990], eax
mov qword [0x14021e988], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x1400e2e80
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400e2f1a
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400e2f04
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400e2ee1
mov qword [rsi], rdi
call fcn.140077980
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 0
inc rax
cmp rax, 1
jbe 0x1400e2f1e
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140077980
mov rcx, qword [rsi]
call fcn.140069370
mov qword [rsi], 0
jmp 0x1400e2ecf
mov byte [rsi + 8], 0
int3
Function at 0x1400e5500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x40], r15
movaps xmm6, xmmword [0x1401d39f0]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.CreateDirectoryAndGetError
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x36e
call fcn.140077960
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14006d330
cmp byte [rdi + 0x17], 0
mov rbx, rdi
jns 0x1400e5593
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e55f3
mov bl, 1
test al, 0x10
jne 0x1400e55bf
test rsi, rsi
je 0x1400e55b2
mov dword [rsi], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rcx, [rsp + 0x60]
call fcn.14006e440
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x30], r15
movaps xmmword [rsp + 0x20], xmm6
mov rcx, rdi
mov rdx, r14
call fcn.1400e4490
movzx r8d, byte [rdi + 0x17]
mov rdx, rdi
test r8b, r8b
jns 0x1400e561c
mov r8, qword [rdi + 8]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x50]
call fcn.140143e6e
movzx r8d, byte [rsp + 0x37]
test r8b, r8b
jns 0x1400e563b
mov r8, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
lea r15, [rsp + 0x40]
mov rcx, r15
mov rdx, r14
call fcn.140143e6e
mov rax, qword [r15 + 8]
cmp rax, qword [rsp + 0x58]
jne 0x1400e56a6
test rax, rax
je 0x1400e567c
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
xor r8d, r8d
movzx r9d, word [rcx + r8*2]
cmp r9w, word [rdx + r8*2]
jne 0x1400e56a6
inc r8
cmp rax, r8
jne 0x1400e5668
mov eax, 0xfffffffc
mov ebp, 2
test rsi, rsi
je 0x1400e568d
mov dword [rsi], eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.140077ee0
jmp 0x1400e55bf
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400e5500
test al, al
je 0x1400e5695
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1400e5697
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0xb7
je 0x1400e56e5
test rsi, rsi
je 0x1400e568d
mov ecx, ebp
call fcn.1400ab320
jmp 0x1400e568b
mov rcx, rdi
call fcn.1400ab990
test al, al
jne 0x1400e5697
jmp 0x1400e56d7