joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140185328
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rsi, rcx
xorps xmm0, xmm0
xor eax, eax
lea rcx, [rbp - 0x21]
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rax
mov r15, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
xorps xmm0, xmm0
lea rcx, [rbp - 0x39]
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov r12d, 3
movsd xmm1, qword [rbp - 0x29]
xor edi, edi
and qword [rbp + 0x67], 0
cmp dword [0x140452a98], 1
mov rbx, qword [rax + 0x1c0]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
cmove rdi, qword [0x1404521a8]
mov word [rbp - 0x39], r12w
mov dword [rbp - 0x31], r12d
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp + 7], xmm1
movaps xmmword [rbp - 9], xmm0
call rax
lea rcx, [rbp + 0x67]
mov rax, rbx
mov qword [rsp + 0x20], rcx
lea rdx, [rbp - 9]
mov rcx, rsi
xor r9d, r9d
mov r8, rdi
call rax
mov ebx, eax
test eax, eax
js 0x14018545e
movsd xmm1, qword [rbp - 0x11]
lea eax, [r12 + 5]
mov rbx, qword [rbp + 0x67]
mov word [rbp - 0x21], ax
mov qword [rbp - 0x19], r15
movups xmm0, xmmword [rbp - 0x21]
mov rax, qword [rbx]
movsd qword [rbp + 7], xmm1
movaps xmmword [rbp - 9], xmm0
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 9]
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14018545e
mov rax, qword [r14]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rdx, qword [rbp + 0x67]
mov rax, rbx
xor r8d, r8d
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
jns 0x140185465
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp + 0x27], 0
lea rax, [0x14003189c]
xor r9d, r9d
mov qword [rbp + 0x1f], rax
lea rax, [rbp + 0x67]
mov qword [rbp + 0x17], r12
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x2f], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140186d64
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x38], 0
lea rax, [0x14004641c]
mov qword [rbp - 0x28], rax
mov r15d, r9d
lea rax, [rbp + 0x38]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rbp - 0x30], 3
mov r14, r8
mov qword [rbp - 0x10], rax
mov r13, rcx
xor ebx, ebx
xor r9d, r9d
mov ecx, 0xb9
xor edi, edi
lea r8d, [rbx + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x38]
test esi, esi
jns 0x140186dd9
mov ecx, esi
jmp 0x140186f24
mov ecx, dword [rbp + 0x50]
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x40]
call fcn.1401881ec
mov esi, eax
test eax, eax
js 0x140186f22
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
test rax, rax
je 0x140186e0c
mov rbx, rax
test rax, rax
jne 0x140186e18
mov ecx, 0x8007000e
mov esi, ecx
jmp 0x140186f24
mov rbx, qword [rbp + 0x58]
xor r8d, r8d
cmp dword [0x140452c58], 1
mov r9, r14
mov rcx, qword [r13 + 0x18]
mov rdx, rbx
cmove r8, qword [0x140452380]
call fcn.140169600
mov esi, eax
test eax, eax
jns 0x140186e52
mov ecx, eax
call fcn.140082a8c
mov rbx, r14
jmp 0x140186f29
mov rcx, qword [r13 + 0x18]
xor r8d, r8d
cmp dword [0x140452c58], 1
mov r9d, r15d
mov rdx, rbx
cmove r8, qword [0x140452388]
call fcn.140187418
mov esi, eax
test eax, eax
js 0x140186e43
mov r9d, dword [rbp + 0x50]
xor r8d, r8d
cmp dword [0x140452c58], 1
mov rdx, rbx
mov rcx, qword [r13 + 0x18]
cmove r8, qword [0x140452390]
call fcn.140187418
mov esi, eax
test eax, eax
js 0x140186e43
cmp dword [rbp - 0x40], edi
je 0x140186ef7
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
test rax, rax
je 0x140186ec0
mov rdi, rax
test rax, rax
jne 0x140186ecc
mov ecx, 0x8007000e
mov esi, ecx
jmp 0x140186e45
mov rcx, qword [r13 + 0x18]
xor r8d, r8d
cmp dword [0x140452c58], 1
mov r9, r15
mov rdx, rbx
cmove r8, qword [0x140452398]
call fcn.140169600
mov esi, eax
test eax, eax
js 0x140186e43
mov r9d, dword [rbp - 0x3c]
xor r8d, r8d
cmp dword [0x140452c58], 1
mov rdx, rbx
mov rcx, qword [r13 + 0x18]
cmove r8, qword [0x1404523a0]
call fcn.140187418
mov esi, eax
mov rbx, r14
test eax, eax
jns 0x140186f29
mov ecx, eax
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
test rdi, rdi
je 0x140186f3e
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x140186f4c
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140186f74
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x1401870b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x20], 0
mov rdi, rcx
and qword [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
mov r15, r9
mov rsi, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x1a8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp + 0x20]
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
test eax, eax
js 0x1401871c6
movsd xmm1, qword [rbp - 0x48]
mov eax, SafeArrayGetElement
mov rbx, qword [rbp + 0x20]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x50], r15
movups xmm0, xmmword [rbp - 0x58]
mov rax, qword [rbx]
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x1401871c6
mov rax, qword [r14]
mov rbx, qword [rax + 0x88]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x60]
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
js 0x1401871c6
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp + 0x20]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
jns 0x1401871cd
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x14003531c]
mov r14d, 3
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r14
mov edi, 0xb9
mov qword [rbp - 8], rax
xor r9d, r9d
lea rdx, [rbp - 0x20]
lea esi, [r14 + 0x1d]
mov ecx, edi
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x10], 0
lea rax, [0x140034fdc]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], r14
xor r9d, r9d
mov qword [rbp - 8], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140187264
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x20], 0
mov rdi, rcx
and qword [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
mov r15, r9
mov rsi, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x1a8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp + 0x20]
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
test eax, eax
js 0x14018737a
movsd xmm1, qword [rbp - 0x48]
mov eax, SafeArrayGetElement
mov rbx, qword [rbp + 0x20]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x50], r15
movups xmm0, xmmword [rbp - 0x58]
mov rax, qword [rbx]
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14018737a
mov rax, qword [r14]
mov rbx, qword [rax + 0x88]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x60]
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
js 0x14018737a
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp + 0x20]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
jns 0x140187381
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x14003531c]
mov r14d, 3
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r14
mov edi, 0xb9
mov qword [rbp - 8], rax
xor r9d, r9d
lea rdx, [rbp - 0x20]
lea esi, [r14 + 0x1d]
mov ecx, edi
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x10], 0
lea rax, [0x140034fdc]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], r14
xor r9d, r9d
mov qword [rbp - 8], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140187418
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x30], 0
mov rdi, rcx
and qword [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
mov r15d, r9d
mov rsi, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x1a8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp + 0x30]
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov r13d, 3
test eax, eax
js 0x14018752e
movsd xmm1, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov dword [rbp - 0x50], r15d
mov word [rbp - 0x58], r13w
movups xmm0, xmmword [rbp - 0x58]
mov rax, qword [rbx]
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
js 0x14018752e
mov rax, qword [r14]
mov rbx, qword [rax + 0x88]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x60]
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
js 0x14018752e
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp + 0x30]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
jns 0x140187535
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x10], 0
lea rax, [0x14003531c]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r13
mov edi, 0xb9
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x20]
mov ecx, edi
lea esi, [r9 + 0x20]
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x10], 0
lea rax, [0x140034fdc]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x20], r13
xor r9d, r9d
mov qword [rbp - 8], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x1401879a8
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x28], 0
mov rsi, r8
and qword [rbp - 0x20], 0
lea r8, [rbp - 0x60]
and dword [rbp - 0x18], 0
mov rbx, rdx
and dword [rbp - 0x14], 0
mov rdi, rcx
and qword [rbp - 0x10], 0
call fcn.140183c0c
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
test al, al
je 0x140187a24
movsxd rcx, dword [rbp - 0x60]
shl rcx, 5
add rcx, 0x10
add rcx, qword [rdi + 8]
call fcn.1400ed12c
mov ebx, eax
test eax, eax
jns 0x140187ac9
mov ecx, eax
jmp 0x140187ac4
movups xmm0, xmmword [rbx]
lea rcx, [rbp - 0x18]
movdqu xmmword [rbp - 0x28], xmm0
call fcn.1400ed12c
mov ebx, eax
test eax, eax
js 0x140187a1d
lea r8, [rbp - 0x60]
mov rcx, rdi
lea rdx, [rbp - 0x28]
call fcn.140183c0c
test al, al
je 0x140187a9b
movsxd rax, dword [rbp - 0x60]
lea rcx, [0x14004ab9c]
shl rax, 5
lea rdx, [rbp - 0x58]
add rax, qword [rdi + 8]
xor r9d, r9d
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x48], rcx
mov ecx, 0xb9
lea r8d, [r9 + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x58], 3
call sub.ntdll.dll_NtQuerySystemInformation
xor ebx, ebx
jmp 0x140187ab7
mov edx, dword [rbp - 0x60]
lea r8, [rbp - 0x28]
mov rcx, rdi
call fcn.140189220
mov ebx, eax
test eax, eax
jns 0x140187ab7
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x140187ac9
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x48], 0
lea rax, [0x14004a51c]
xor r9d, r9d
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x58], 3
lea rdx, [rbp - 0x58]
mov qword [rbp - 0x40], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140389660
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140188c18
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
and qword [rax + 0x10], 0
mov rdi, rcx
mov rax, qword [rdx]
mov r14, r8
mov rsi, rdx
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rsp + 0x58]
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
test eax, eax
js 0x140188c93
mov rax, qword [r14]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rdx, qword [rsp + 0x58]
mov rax, rbx
xor r8d, r8d
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
jns 0x140188c9a
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rsp + 0x30], 0
lea rax, [0x140028cdc]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140189040
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
movsxd r14, edx
mov ecx, dword [rcx + 4]
mov r12, r8
test ecx, ecx
jns 0x14018906a
mov edi, 0x8000ffff
mov ecx, edi
jmp 0x140189084
lea r8, [rsp + 0x80]
mov edx, 1
call fcn.1400821a4
mov edi, eax
test eax, eax
jns 0x14018908e
mov ecx, eax
call fcn.140082a8c
jmp 0x1401891f9
mov edi, dword [rsi]
test edi, edi
jns 0x1401890a2
mov edi, 0x8000ffff
mov ebx, edi
mov ecx, edi
jmp 0x140189147
cmp dword [rsp + 0x80], edi
jg 0x1401890b2
xor ebx, ebx
jmp 0x14018914c
mov r15d, dword [rsp + 0x80]
test edi, edi
jne 0x1401890c7
mov edi, 0x20
xor ebx, ebx
jmp 0x140189121
js 0x140189103
lea ecx, [rdi + rdi]
xor ebx, ebx
mov eax, ecx
shr eax, 1
cmp eax, edi
je 0x1401890e4
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140082a8c
jmp 0x1401890e7
mov r15d, ecx
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x140189108
test r15d, r15d
jns 0x1401890fe
mov ebx, 0x80070216
jmp 0x140189108
mov edi, r15d
jmp 0x14018910f
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x140189121
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x140189160
cmp edi, dword [rsp + 0x80]
jl 0x1401890ba
mov edx, edi
mov rcx, rsi
call fcn.140184b08
mov ebx, eax
test eax, eax
jns 0x14018914c
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
mov edi, ebx
test ebx, ebx
jns 0x140189164
mov ecx, ebx
jmp 0x140189084
mov ecx, ebx
jmp 0x140189147
mov r8d, dword [rsi + 4]
mov rbx, r14
cmp r14d, r8d
jge 0x140189193
mov rcx, qword [rsi + 8]
lea rax, [r14 + r14*8]
sub r8d, r14d
lea rdx, [rcx + rax*8]
movsxd rax, r8d
lea rcx, [rdx + 0x48]
lea r8, [rax + rax*8]
shl r8, 3
call sub.msvcrt.dll_memmove
mov rax, qword [rsi + 8]
lea rbx, [rbx + rbx*8]
xor edx, edx
lea rcx, [rax + rbx*8]
lea r8d, [rdx + 0x48]
call sub.msvcrt.dll_memset
mov rax, qword [rsi + 8]
lea rcx, [0x14004a85c]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], rcx
lea rax, [rax + rbx*8]
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rsi + 4]
xor edi, edi
mov ecx, edi
call fcn.140082b34
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140189220
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
movsxd r15, edx
mov ecx, dword [rcx + 4]
mov r12, r8
test ecx, ecx
jns 0x14018924a
mov edi, 0x8000ffff
mov ecx, edi
jmp 0x140189264
lea r8, [rsp + 0x80]
mov edx, 1
call fcn.1400821a4
mov edi, eax
test eax, eax
jns 0x14018926e
mov ecx, eax
call fcn.140082a8c
jmp 0x1401893dc
mov edi, dword [rsi]
test edi, edi
jns 0x140189282
mov edi, 0x8000ffff
mov ebx, edi
mov ecx, edi
jmp 0x140189327
cmp dword [rsp + 0x80], edi
jg 0x140189292
xor ebx, ebx
jmp 0x14018932c
mov r14d, dword [rsp + 0x80]
test edi, edi
jne 0x1401892a7
mov edi, 0x20
xor ebx, ebx
jmp 0x140189301
js 0x1401892e3
lea ecx, [rdi + rdi]
xor ebx, ebx
mov eax, ecx
shr eax, 1
cmp eax, edi
je 0x1401892c4
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140082a8c
jmp 0x1401892c7
mov r14d, ecx
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x1401892e8
test r14d, r14d
jns 0x1401892de
mov ebx, 0x80070216
jmp 0x1401892e8
mov edi, r14d
jmp 0x1401892ef
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x140189301
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x140189340
cmp edi, dword [rsp + 0x80]
jl 0x14018929a
mov edx, edi
mov rcx, rsi
call fcn.140184e28
mov ebx, eax
test eax, eax
jns 0x14018932c
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
mov edi, ebx
test ebx, ebx
jns 0x140189344
mov ecx, ebx
jmp 0x140189264
mov ecx, ebx
jmp 0x140189327
mov r8d, dword [rsi + 4]
mov rbx, r15
cmp r15d, r8d
jge 0x14018936e
sub r8d, r15d
mov rdx, r15
shl rdx, 5
add rdx, qword [rsi + 8]
movsxd r8, r8d
shl r8, 5
lea rcx, [rdx + 0x20]
call sub.msvcrt.dll_memmove
mov rcx, qword [rsi + 8]
xorps xmm0, xmm0
shl rbx, 5
add rcx, rbx
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
je 0x14018938e
and dword [rcx + 0x14], 0
and qword [rcx + 0x18], 0
mov rax, qword [rsi + 8]
lea rcx, [0x14004ab9c]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], rcx
add rax, rbx
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rsi + 4]
xor edi, edi
mov ecx, edi
call fcn.140082b34
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14018a494
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r12, r8
mov r15, rdx
mov rbp, rcx
test r8, r8
jne 0x14018a4c9
mov edi, 0x80070057
mov ecx, edi
call fcn.140082a8c
jmp 0x14018a5d0
mov ecx, dword [rcx + 8]
lea r8, [rsp + 0x88]
and dword [rsp + 0x88], ebx
mov edx, 2
call fcn.140080130
mov edi, eax
test eax, eax
jns 0x14018a4ef
mov ecx, eax
jmp 0x14018a4bf
mov r14d, dword [rsp + 0x88]
test r15, r15
je 0x14018a5ca
test r14d, r14d
je 0x14018a5c7
mov ebx, dword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14018a52c
xor ebx, ebx
jmp 0x14018a534
mov rbx, rsi
test rsi, rsi
jne 0x14018a53b
mov edi, 0x8007000e
jmp 0x14018a4bd
mov r13d, dword [rbp + 8]
lea rax, [rsp + 0x20]
xor ecx, ecx
cmp qword [rbp + 0x10], rcx
jne 0x14018a557
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], ecx
jmp 0x14018a561
movups xmm0, xmmword [rbp + 0x10]
movdqu xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax]
movq qword [rsp + 0x20], xmm0
psrldq xmm0, 8
movd ebp, xmm0
mov dword [rsp + 0x28], ebp
test r13d, r13d
je 0x14018a5c7
mov r14d, ecx
movaps xmm1, xmmword [rsp + 0x20]
lea r8, [rsp + 0x80]
movdqa xmm0, xmm1
inc ebp
psrldq xmm0, 8
movq rcx, xmm1
movd edx, xmm0
mov dword [rsp + 0x28], ebp
call fcn.14018f20c
mov cl, byte [rsp + 0x80]
inc r14d
xor cl, byte [rax]
mov byte [rsi], cl
inc rsi
cmp r14d, r13d
jb 0x14018a57f
mov r14d, dword [rsp + 0x88]
mov qword [r15], rbx
mov dword [r12], r14d
xor ebx, ebx
mov ecx, edi
call fcn.140082b34
test rbx, rbx
je 0x14018a5f0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret