joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ab00
Capabilities:
Delete registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
call fcn.140009f60
cmp byte [rsp + 0x38], 0
jne 0x14000ab3d
cmp dword [rsp + 0x28], 2
je 0x14000ac2d
movzx ecx, byte [rdi + 0x70]
mov eax, ecx
and al, 1
je 0x14000ab4d
mov rcx, qword [rdi + 0x78]
jmp 0x14000ab50
shr rcx, 1
lea rbx, [rdi + 0x70]
test rcx, rcx
jne 0x14000ab7f
lea rdx, [rdi + 0x28]
mov rcx, rbx
call fcn.14007c6e0
lea rdx, str.Launcher
mov r8d, 9
mov rcx, rbx
call fcn.14007b270
mov al, byte [rdi + 0x70]
and al, 1
mov rcx, qword [rdi + 0x20]
test al, al
je 0x14000ab90
mov rbx, qword [rdi + 0x80]
jmp 0x14000ab94
add rbx, 2
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x14000ac33
movzx ecx, byte [rdi + 0x58]
mov eax, ecx
and al, 1
je 0x14000abb8
mov rcx, qword [rdi + 0x60]
jmp 0x14000abbb
shr rcx, 1
lea rbx, [rdi + 0x58]
test rcx, rcx
jne 0x14000abea
lea rdx, [rdi + 0x28]
mov rcx, rbx
call fcn.14007c6e0
lea rdx, str.Browser
mov r8d, 8
mov rcx, rbx
call fcn.14007b270
mov al, byte [rdi + 0x58]
and al, 1
mov rcx, qword [rdi + 0x20]
test al, al
je 0x14000abf8
mov rbx, qword [rdi + 0x68]
jmp 0x14000abfc
add rbx, 2
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x14000ac33
lea rax, [rdi + 0x10]
cmp byte [rdi + 0x18], 0
je 0x14000ac1a
mov byte [rdi + 0x18], 0
mov cl, byte [rax + 8]
mov byte [rdi + 8], cl
mov rax, qword [rax]
mov qword [rdi], rax
mov byte [0x14014f010], 1
mov byte [rsi + 0x10], 0
jmp 0x14000ac59
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x5c
mov dword [rsi + 0xc], ecx
mov rax, qword [rsp + 0x40]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x14000ac76
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400763e0
int3
Function at 0x14000ad80
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x40], rax
movzx ecx, byte [rdx + 0x70]
mov eax, ecx
and al, 1
je 0x14000adb1
mov rcx, qword [rdi + 0x78]
jmp 0x14000adb4
shr rcx, 1
lea rbx, [rdi + 0x70]
test rcx, rcx
jne 0x14000ade3
lea rdx, [rdi + 0x28]
mov rcx, rbx
call fcn.14007c6e0
lea rdx, str.Launcher
mov r8d, 9
mov rcx, rbx
call fcn.14007b270
mov al, byte [rdi + 0x70]
and al, 1
mov dword [rsp + 0x34], 8
mov rcx, qword [rdi + 0x20]
test al, al
je 0x14000adfc
mov rbx, qword [rdi + 0x80]
jmp 0x14000ae00
add rbx, 2
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000ae3f
cmp eax, 2
jne 0x14000ae58
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
mov byte [rsi + 8], 0
jmp 0x14000ae9c
cmp dword [rsp + 0x30], 0xb
jne 0x14000ae80
mov rax, qword [rsp + 0x38]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
jmp 0x14000ae9c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3b
mov dword [rsi + 0xc], ecx
jmp 0x14000ae9c
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d0000003f
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x40]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x14000aeb9
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400763e0
int3
Function at 0x14000aec0
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x40], rax
movzx ecx, byte [rdx + 0x58]
mov eax, ecx
and al, 1
je 0x14000aef1
mov rcx, qword [rdi + 0x60]
jmp 0x14000aef4
shr rcx, 1
lea rbx, [rdi + 0x58]
test rcx, rcx
jne 0x14000af23
lea rdx, [rdi + 0x28]
mov rcx, rbx
call fcn.14007c6e0
lea rdx, str.Browser
mov r8d, 8
mov rcx, rbx
call fcn.14007b270
mov al, byte [rdi + 0x58]
and al, 1
mov dword [rsp + 0x34], 8
mov rcx, qword [rdi + 0x20]
test al, al
je 0x14000af39
mov rbx, qword [rdi + 0x68]
jmp 0x14000af3d
add rbx, 2
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000af7c
cmp eax, 2
jne 0x14000af95
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
mov byte [rsi + 8], 0
jmp 0x14000afd9
cmp dword [rsp + 0x30], 0xb
jne 0x14000afbd
mov rax, qword [rsp + 0x38]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
jmp 0x14000afd9
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3b
mov dword [rsi + 0xc], ecx
jmp 0x14000afd9
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d0000003f
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x40]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x14000aff6
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400763e0
int3
Function at 0x14000cf90
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, qword [0x1400f7448]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rcx], 0
je 0x14000d04c
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r13, rcx
mov al, byte [0x1401502f0]
test al, al
je 0x14000d082
add rdi, rsi
cmp rdi, rsi
jbe 0x14000d04c
mov ebx, dword [0x140152800]
lea r12d, [rbx - 1]
mov rbp, r12
not rbp
mov r15, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop word cs:[rax + rax]
nop
mov qword [rsp + 0x30], 0
mov rcx, qword [r13]
mov r9, rdi
sub r9, rsi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov r8, r14
call r15
test eax, eax
jne 0x14000d06f
mov rax, rdi
and rax, rbp
mov rcx, rdi
sub rcx, rbx
test edi, r12d
cmovne rcx, rax
mov rdi, rcx
cmp rcx, rsi
ja 0x14000d000
mov rbx, qword [0x1400f7448]
xor eax, eax
mov rdx, qword [rsp + 0x60]
xor rdx, rsp
mov rcx, qword [rbx]
cmp rcx, rdx
jne 0x14000d07d
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x30]
mov rbx, qword [0x1400f7448]
jmp 0x14000d04e
call fcn.1400763e0
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x14000cfd6
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x14000cfd6
Function at 0x14000d340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xc8], rax
cmp byte [rcx + 0x34], 0
je 0x14000d553
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test byte [rcx + 0x30], 4
jne 0x14000d394
lea rcx, [rsp + 0xb0]
mov rdx, rbx
mov r8, rsi
call fcn.14000d570
jmp 0x14000d3eb
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov qword [rax + 8], 0
lea rcx, [0x1400f7aa8]
mov qword [rax], rcx
lea rcx, [rax + 0x10]
mov qword [rax + 0x10], rbx
movaps xmm0, xmmword [0x1400f7570]
movups xmmword [rax + 0x20], xmm0
lea rdx, [rax + 0x30]
mov qword [rax + 0x18], rdx
mov qword [rax + 0x50], rsi
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], 0
xor esi, esi
lea rcx, [rsp + 0xa0]
mov rdx, rbx
xor r8d, r8d
call fcn.14000d930
cmp byte [rsp + 0xa8], 0
je 0x14000d503
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.140011300
cmp byte [rsp + 0x98], 0
je 0x14000d501
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsp + 0x48], xmm0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x8c]
mov qword [rsp + 0x5c], rax
mov al, byte [rsp + 0x94]
mov byte [rsp + 0x64], al
mov dword [rsp + 0x70], 0
mov byte [rsp + 0x94], 0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0x38]
mov rcx, rbx
call fcn.14000da40
cmp qword [rdi], 0
setne sil
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000d4cf
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x14000d4cf
lea r9, [rsp + 0x40]
mov edx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [rsp + 0x98], 0
je 0x14000d503
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000d503
mov r8d, dword [rsp + 0x70]
test r8d, r8d
je 0x14000d503
lea r9, [rsp + 0x70]
mov edx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x14000d503
xor esi, esi
mov rdi, qword [rsp + 0xb8]
test rdi, rdi
je 0x14000d52f
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
test eax, eax
jne 0x14000d52f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, rdi
call fcn.1400775b0
mov rax, qword [rsp + 0xc8]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x14000d563
mov eax, esi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
call fcn.1400763e0
int3
Function at 0x14000d930
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, rdx
mov rsi, rcx
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x60], rax
test r8, r8
je 0x14000d966
mov rcx, rsi
mov rdx, rdi
call fcn.1400107c0
jmp 0x14000d9c5
cmp byte [rdi + 0x34], 0
je 0x14000d9e5
mov ebx, dword [rdi + 0x30]
and ebx, 1
shl rbx, 0x1e
mov al, byte [0x1401502f8]
test al, al
je 0x14000d9fa
mov ebp, dword [0x140152804]
mov dword [rsp + 0x20], ebx
lea r14, [rsp + 0x30]
mov rcx, r14
mov rdx, rdi
mov r8d, ebp
mov r9, rbx
call fcn.140010a60
mov rcx, rdi
mov edx, ebp
mov r8, r14
call fcn.140010c30
test eax, eax
je 0x14000d9ba
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x14000d9c5
mov qword [rsi], 0
mov byte [rsi + 8], 0
mov rax, qword [rsp + 0x60]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x14000d9f5
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
call fcn.1400763e0
lea rcx, [0x1401502f8]
call fcn.1400c0fd4
test eax, eax
je 0x14000d980
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c10ab
jmp 0x14000d980
Function at 0x140010240
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15b, 1
test dl, dl
je 0x140010331
mov rdi, rcx
mov rsi, qword [rcx + 0x40]
movsx rbx, dl
mov al, byte [0x1401502f0]
test al, al
je 0x140010356
add rbx, rsi
mov ebp, dword [0x140152800]
mov rax, rsi
shr rax, 0x20
je 0x1400102a1
mov rax, rsi
xor edx, edx
div rbp
mov rcx, rax
jmp 0x1400102a9
mov eax, esi
xor edx, edx
div ebp
mov ecx, eax
mov rax, rbx
shr rax, 0x20
je 0x1400102c1
mov rax, rbx
xor edx, edx
div rbp
cmp rcx, rax
jne 0x1400102cc
jmp 0x140010331
mov eax, ebx
xor edx, edx
div ebp
cmp rcx, rax
je 0x140010331
mov rax, qword [rdi]
mov rcx, qword [rax]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140010320
xor r15d, r15d
cmp qword [rsp + 0x68], 0
je 0x140010331
cmp dword [rsp + 0x48], 0
je 0x140010331
cmp dword [rsp + 0x58], 0x1000
jne 0x140010331
cmp dword [rsp + 0x5c], 1
setne r15b
jmp 0x140010331
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
xor r15d, r15d
mov rax, qword [rsp + 0x70]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140010351
mov eax, r15d
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400763e0
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x140010282
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x3c]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x140010282
Function at 0x1400107c0
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rbp, qword [0x1400f7448]
mov rax, qword [rbp]
xor rax, rsp
mov qword [rsp + 0x90], rax
and r8, 0xfffffffffffffffc
mov qword [rsp + 0x40], r8
mov byte [rsp + 0x58], 0
je 0x1400108e1
movzx eax, word [r8]
cmp eax, 0x5a4d
jne 0x1400108e1
movsxd rcx, dword [r8 + 0x3c]
lea rax, [r8 + rcx]
mov qword [rsp + 0x48], rax
cmp dword [r8 + rcx], 0x4550
jne 0x1400108e1
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
jne 0x1400108e1
mov ecx, dword [rax + 0x50]
cmp ecx, 0x148
jb 0x1400108e1
mov rdi, rdx
lea edx, [rcx - 1]
add r8, rdx
mov qword [rsp + 0x50], r8
cmp dword [rax + 0x84], 2
jb 0x140010867
cmp dword [rax + 0x90], ecx
setae byte [rsp + 0x58]
lea r8, str..text
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov r9d, 0x60000020
call fcn.140010960
cmp byte [rsp + 0x38], 0
je 0x1400108e1
mov rbx, qword [rsp + 0x28]
shr rbx, 1
add rbx, qword [rsp + 0x30]
mov al, byte [0x1401502f8]
test al, al
je 0x140010920
mov r15d, dword [0x140152804]
mov dword [rsp + 0x20], 0x80000000
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
mov r8d, r15d
mov r9, rbx
call fcn.140010a60
mov rcx, rdi
mov edx, r15d
mov r8, r14
call fcn.140010c30
test eax, eax
je 0x14001090e
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x1400108e7
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x90]
xor rax, rsp
mov rcx, qword [rbp]
cmp rcx, rax
jne 0x14001091b
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsi], 0
mov byte [rsi + 8], 0
jmp 0x1400108e7
call fcn.1400763e0
lea rcx, [0x1401502f8]
call fcn.1400c0fd4
test eax, eax
je 0x1400108a1
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x88]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c10ab
jmp 0x1400108a1
Function at 0x140010a60
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r12, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x58], rax
test r9, r9
je 0x140010b6e
mov esi, dword [rsp + 0xc0]
test esi, esi
je 0x140010b6e
mov rbx, r9
mov r15d, r8d
mov al, byte [0x1401502f8]
test al, al
je 0x140010bb6
mov esi, esi
xor ebp, ebp
mov rax, rbx
sub rax, rsi
cmovae rbp, rax
cmp rbp, 0x100001
mov eax, 0x100000
cmovb rbp, rax
cmp rbx, rsi
mov edi, dword [0x140152804]
cmovb rbp, rax
mov al, byte [0x140150300]
test al, al
je 0x140010bf0
mov rax, qword [0x140152808]
xor ecx, ecx
mov rdx, rbx
add rdx, rsi
cmovae rcx, rdx
cmp rax, rcx
cmovb rcx, rax
add rbx, rsi
cmovb rcx, rax
mov edx, r15d
cmp rcx, rdx
jb 0x140010b6e
mov rbx, rbp
neg rbx
lea rax, [rdi - 1]
and rax, rbx
add rax, rbp
xor ebp, ebp
sub rcx, rdx
cmovae rbp, rcx
neg rdi
and rdi, rbp
sub rdi, rax
jbe 0x140010b6e
test rax, rax
setne cl
cmp rdi, 0xffffffffffffffff
setne dl
and dl, cl
mov rcx, rdi
or rcx, rax
setne cl
cmp dl, cl
jne 0x140010ba1
test rax, rax
mov ecx, 1
cmovne rcx, rax
mov qword [r12], rdi
mov qword [r12 + 8], rcx
mov byte [r12 + 0x10], 1
jmp 0x140010b7f
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], 0
mov rax, qword [rsp + 0x58]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140010bb1
mov rax, r12
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dword [0], 0x321
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
call fcn.1400763e0
lea rcx, [0x1401502f8]
call fcn.1400c0fd4
test eax, eax
je 0x140010aaf
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c10ab
jmp 0x140010aaf
lea rcx, [0x140150300]
call fcn.1400c0fd4
test eax, eax
je 0x140010ae8
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
mov qword [0x140152808], rax
lea rcx, [0x140150300]
call fcn.1400c10ab
jmp 0x140010ae8
Function at 0x140010c30
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, qword [0x1400f7448]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebx, ebx
test edx, edx
je 0x140010c65
mov rsi, rcx
cmp qword [rcx], 0
je 0x140010c65
cmp qword [rsi + 0x18], 0
je 0x140010c86
mov ebx, dword [rsi + 0x20]
mov rax, qword [rsp + 0x68]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x140010d64
mov eax, ebx
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov r14, r8
mov ebp, edx
mov al, byte [0x1401502f8]
test al, al
je 0x140010d69
mov ecx, dword [0x140152804]
xor ebx, ebx
mov eax, ebp
xor edx, edx
div ecx
sub ecx, edx
test edx, edx
cmove ecx, edx
add ecx, ebp
mov dword [rsi + 0x20], ecx
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x4000040
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsi + 8], rax
test rax, rax
je 0x140010d4c
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov rcx, rax
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x10], rax
test rax, rax
je 0x140010d57
mov rax, qword [rsi + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov rdx, qword [rsi]
mov r8d, dword [rsi + 0x20]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, rsi
call fcn.140010db0
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x140010c62
jmp 0x140010c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140010c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x140010c65
call fcn.1400763e0
lea rcx, [0x1401502f8]
call fcn.1400c0fd4
test eax, eax
je 0x140010c99
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c10ab
jmp 0x140010c99
Function at 0x140011010
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, r9
mov r14, r8
mov r13, rdx
mov rsi, qword [0x1400f7448]
mov rax, qword [rsi]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov al, byte [0x1401502f8]
test al, al
je 0x14001125b
xor eax, eax
test r14, r14
je 0x140011234
mov r15, qword [rsp + 0xf0]
cmp r15, rbx
jbe 0x140011234
mov esi, dword [0x140152804]
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x44]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand_s
mov rax, r15
sub rax, rbx
sub rax, r14
mov rcx, rax
shr rcx, 0x20
je 0x14001109f
xor edx, edx
div rsi
mov rcx, rax
jmp 0x1400110a5
xor edx, edx
div esi
mov ecx, eax
mov r12d, dword [rsp + 0x44]
add rcx, 1
cmp r12, rcx
jb 0x1400110bd
mov eax, r12d
xor edx, edx
div ecx
mov r12d, edx
imul r12, rsi
add r12, rbx
sub r15, r14
cmp r12, r15
jbe 0x140011171
cmp r12, rbx
jbe 0x140011225
add rsi, 0xffffffffffffffff
lea rbp, [rsp + 0x78]
lea r15, [rsp + 0x48]
jmp 0x1400110fc
add rbx, rcx
cmp rbx, r12
jae 0x140011225
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0x30
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9, r15
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140011217
cmp qword [rsp + 0x78], 0x30
jne 0x140011225
cmp dword [rsp + 0x68], 0x10000
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
jne 0x1400110f0
mov rdx, rcx
neg rdx
and rdx, rsi
lea rdi, [rdx + rcx]
mov rax, rbx
sub rax, rdx
cmp rax, r14
mov eax, 0
cmovae rax, rdi
cmp rbx, rdx
jb 0x1400110f0
test rax, rax
je 0x1400110f0
jmp 0x14001122d
lea rax, [rsi - 1]
mov qword [rsp + 0x38], rax
lea rbp, [rsp + 0x78]
mov rdx, r12
jmp 0x14001119c
add rdx, rdi
cmp rdx, r15
ja 0x1400110d0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0x30
mov rcx, r13
xor r8d, r8d
lea r9, [rsp + 0x48]
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140011217
cmp qword [rsp + 0x78], 0x30
jne 0x140011225
cmp dword [rsp + 0x68], 0x10000
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
jne 0x140011190
mov rcx, rdi
neg rcx
and rcx, qword [rsp + 0x38]
mov r8, rbp
mov rbp, rsi
lea rsi, [rcx + rdi]
mov rax, rdx
sub rax, rcx
cmp rax, r14
mov eax, 0
cmovae rax, rsi
mov rsi, rbp
mov rbp, r8
cmp rdx, rcx
jb 0x140011190
test rax, rax
je 0x140011190
jmp 0x14001122d
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov rsi, qword [0x1400f7448]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
mov rdx, qword [rsi]
cmp rdx, rcx
jne 0x140011295
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1401502f8]
call fcn.1400c0fd4
test eax, eax
je 0x14001104f
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x70]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c10ab
jmp 0x14001104f
call fcn.1400763e0
int3
Function at 0x140011450
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, qword [0x1400f7448]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
cmp qword [rcx], 0
je 0x14001154c
mov rsi, rcx
cmp qword [rcx + 8], 0
je 0x14001154c
mov rdi, qword [rsi + 0x10]
test rdi, rdi
je 0x14001154c
cmp qword [rsi + 0x18], 0
je 0x14001154c
add edx, r8d
add edx, 0xffffffff
mov ecx, dword [rsi + 0x24]
mov al, 1
cmp edx, ecx
jb 0x14001154c
cmp ecx, dword [rsi + 0x20]
jae 0x14001154a
add rdi, rcx
mov al, byte [0x1401502f0]
test al, al
je 0x14001156b
mov edx, dword [0x140152800]
mov rcx, rdi
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14001154a
mov r14, qword [rsi]
mov edi, dword [rsi + 0x24]
add rdi, qword [rsi + 0x18]
mov al, byte [0x1401502f0]
test al, al
je 0x1400115a5
mov r8d, dword [0x140152800]
mov dword [rsp + 0x20], 0x20
mov rcx, r14
mov rdx, rdi
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140011542
mov al, byte [0x1401502f0]
test al, al
je 0x1400115df
mov eax, dword [0x140152800]
add dword [rsi + 0x24], eax
test rdi, rdi
setne al
jmp 0x14001154c
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
mov rdx, qword [rbx]
cmp rdx, rcx
jne 0x140011566
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400763e0
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x1400114ca
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x1400114ca
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x140011502
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x140011502
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x140011539
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x140011539