joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
cmp r9, 2
jb 0x140035080
cmp word [r8 + 2], 0x3a
jne 0x140035080
movzx eax, word [r8]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x140035080
mov ebx, 2
xor eax, eax
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, 2
jb 0x140035089
cmp word [rcx + 2], 0x3a
jne 0x140035089
movzx r10d, word [rcx]
and r10d, 0xffffffdf
add r10d, 0xffffffa5
cmp r10w, 0xffe6
setae r10b
not al
test al, r10b
je 0x140035089
cmp r9, rbx
cmovae r9, rbx
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], 2
lea rcx, [rsp + 0x28]
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov r8d, 1
call fcn.1400773b0
test al, al
je 0x140035036
mov rcx, qword [rdi + 8]
sub rcx, rbx
jb 0x1400350ad
mov rax, qword [rsi + 8]
cmp rax, 1
jbe 0x1400350ad
add rax, 0xfffffffffffffffe
cmp rcx, rax
je 0x140035057
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x14003504f
call fcn.140094250
int3
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov al, 1
test rcx, rcx
je 0x140035038
add ebx, ebx
add rbx, qword [rdi]
mov rdx, qword [rsi]
xor r8d, r8d
movzx r9d, word [rbx + r8*2]
cmp r9w, word [rdx + r8*2 + 4]
jne 0x140035036
inc r8
cmp rcx, r8
jne 0x140035069
jmp 0x140035038
mov al, 1
xor ebx, ebx
jmp 0x140034fa4
cmp r9, rdx
jne 0x140035036
mov al, 1
test r9, r9
je 0x140035038
xor edx, edx
movzx r10d, word [r8 + rdx*2]
cmp r10w, word [rcx + rdx*2]
jne 0x140035036
inc rdx
cmp r9, rdx
jne 0x140035097
jmp 0x140035038
lea rcx, [0x140115d1d]
call fcn.14001d340
int3

Function at 0x140036b60
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14014c0b8]
test rdi, rdi
jne 0x140036c12
mov ecx, 0x50
call fcn.140092cc0
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.140092cc0
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x140036c3b
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x14014c0b8], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140036c3b
mov rcx, rax
call fcn.1400b3c98
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140036c40
test rdi, rdi
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x140036c2f
call fcn.140094250
int3
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rdi
pop rsi
ret
ud2
Function at 0x1400393f0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400d2610
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140039477
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400395de
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140039464
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400ae83c
test eax, eax
je 0x140039572
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400394cc
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400395ec
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400394b9
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400ae83c
test eax, eax
je 0x1400395a6
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14003951d
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400395fa
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14003950e
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400ae83c
test eax, eax
je 0x140039544
xor eax, eax
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x140039539
call fcn.140094250
int3
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x140039555
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x14003951f
jb 0x140039608
test cl, cl
jns 0x140039569
mov rsi, qword [rsi]
cmp word [rsi + rbx*2], 0x5c
jne 0x14003951d
jmp 0x14003951f
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x140039583
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x14003951f
jb 0x140039608
mov rdx, rsi
test cl, cl
jns 0x140039596
mov rdx, qword [rsi]
cmp word [rdx + rbx*2], 0x5c
jne 0x140039477
jmp 0x14003951f
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x1400395b7
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x14003951f
jb 0x140039608
mov rdx, rsi
test cl, cl
jns 0x1400395ce
mov rdx, qword [rsi]
cmp word [rdx + rbx*2], 0x5c
jne 0x1400394cc
jmp 0x14003951f
dec rbx
jne 0x14003944c
jmp 0x140039477
dec rbx
jne 0x1400394a1
jmp 0x1400394cc
dec rbx
jne 0x1400394f6
jmp 0x14003951d
ud2
Function at 0x14003a4f0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14003a6ad
mov ebx, eax
mov r15d, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [0x1401131b0]
movaps xmmword [rsp + 0x20], xmm0
cmp ebx, 0xb
jae 0x14003a64d
lea r14, [rsp + 0x20]
mov byte [r14 + 0x17], bl
lea r8, [r15 + r15]
mov rcx, r14
xor edx, edx
call fcn.1400d2610
mov word [r14 + r15*2], 0
cmp byte [rsp + 0x37], 0
js 0x14003a593
lea rdx, [rsp + 0x20]
jmp 0x14003a598
mov rcx, r8
cmp r8, rdx
jb 0x14003a63b
lea rcx, [rsp + 0x20]
mov byte [rcx + 0x17], al
jmp 0x14003a5e0
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14003a68b
mov edx, eax
movsx r8, byte [rsp + 0x37]
test r8, r8
mov rcx, qword [rsp + 0x28]
mov r9, r8
cmovs r9, rcx
cmp r9, rdx
jbe 0x14003a68b
test r8b, r8b
jns 0x14003a57d
cmp rcx, rdx
jb 0x14003a63b
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rdx
mov word [rcx + rdx*2], 0
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
cmp byte [rsp + 0x37], 0
js 0x14003a69e
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x14003a62a
call fcn.140094250
int3
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
sub rdx, rcx
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.140076be0
jmp 0x14003a5e6
mov rax, r15
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r12d, 0xd
cmovne r12, rcx
lea rcx, [r12 + r12]
call fcn.140092cc0
mov r14, rax
mov qword [rsp + 0x20], rax
bts r12, 0x3f
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r15
jmp 0x14003a55a
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x14003a608
mov rcx, qword [rsp + 0x20]
call fcn.140092d00
jmp 0x14003a613
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140094250
jmp 0x14003a62a
Function at 0x14003aa50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, rcx
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x17], 0
mov rsi, rcx
jns 0x14003aa78
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003aacb
test al, 0x10
je 0x14003abf7
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14003ac20
mov dil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x14003aabe
call fcn.140094250
int3
mov eax, edi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
movsx r9, byte [rdi + 0x17]
mov rax, rdi
test r9, r9
jns 0x14003aaf0
mov rax, qword [rdi]
mov r9, qword [rdi + 8]
add r9, r9
test r9, r9
je 0x14003ab5c
movzx ecx, word [rax + r9 - 2]
add r9, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x14003ab0c
cmp ecx, 0x2f
jne 0x14003aaf3
cmp r9, 0xfffffffffffffffe
je 0x14003ab5c
sar r9, 1
lea rax, [rsp + 0x67]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.140076990
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
call fcn.14003aa50
test al, al
jne 0x14003ab5c
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.14003ac20
jmp 0x14003abdb
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14003abdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x14003abc9
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rsi
call fcn.14001ad00
cmp byte [r14 + 0x17], 0
jns 0x14003ab99
mov r14, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
setne al
and ebp, 0x10
shr ebp, 4
and bpl, al
cmp byte [rsp + 0x3f], 0
jns 0x14003abc4
mov rcx, qword [rsp + 0x28]
call fcn.140092d00
test bpl, bpl
jne 0x14003abdd
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.14003ac20
xor edi, edi
cmp byte [rsp + 0x57], 0
jns 0x14003aaa7
mov rcx, qword [rsp + 0x40]
call fcn.140092d00
jmp 0x14003aaa7
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14003ac20
xor edi, edi
jmp 0x14003aaa7
Function at 0x14003ac20
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.140068fc0
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x14014c110]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.140096ce4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x14003ac9b
call fcn.140094250
int3
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140040c80
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14014c9c8]
mov ecx, dword [0x140148ee0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140040ce7
lea rax, [0x14014c9c0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x140040cdd
call fcn.140094250
int3
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14014c9c8]
call fcn.140092d5c
cmp dword [0x14014c9c8], 0xffffffff
jne 0x140040cbc
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400d2610
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.140092cc0
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14014ca10]
mov ecx, dword [0x140148ee0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140040da7
lea r8, [0x14014c9e0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140040ea0
mov qword [0x14014c9c0], rsi
lea rcx, [0x14014c9c8]
call fcn.140092e10
jmp 0x140040cbc
lea rcx, [0x14014ca10]
call fcn.140092d5c
cmp dword [0x14014ca10], 0xffffffff
jne 0x140040d78
xorps xmm0, xmm0
movups xmmword [0x14014ca00], xmm0
movups xmmword [0x14014c9f0], xmm0
movups xmmword [0x14014c9e0], xmm0
lea rcx, [0x14014c9e0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14014ca10]
call fcn.140092e10
jmp 0x140040d78

Function at 0x140040df0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14014ca10]
mov ecx, dword [0x140148ee0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140040e2b
movzx eax, word [0x14014c9e0]
cmp eax, 9
jne 0x140040e73
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14014ca10]
call fcn.140092d5c
cmp dword [0x14014ca10], 0xffffffff
jne 0x140040e15
xorps xmm0, xmm0
movups xmmword [0x14014ca00], xmm0
movups xmmword [0x14014c9f0], xmm0
movups xmmword [0x14014c9e0], xmm0
lea rcx, [0x14014c9e0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14014ca10]
call fcn.140092e10
jmp 0x140040e15
test eax, eax
je 0x140040e26
cmp eax, 6
jne 0x140040e83
mov eax, 2
jmp 0x140040e26
cmp eax, 0xc
jne 0x140040e8f
mov eax, 3
jmp 0x140040e26
mov eax, 4
jmp 0x140040e26
Function at 0x140043650
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x1400437aa
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x1401131b0]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [0x14012df88]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [0x14012df88]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x14012df88]
test r14, r14
je 0x140043733
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x140043723
mov ecx, 1
call fcn.14008ec80
bt eax, 0x19
jae 0x1400437b5
not eax
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
test eax, 0x12000000
jne 0x1400437ae
call fcn.1400032c0
lea rax, [0x140001d60]
lea rcx, section..text
mov qword [rsi + 0xf8], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x14004379c
call fcn.140094250
int3
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor eax, eax
jmp 0x140043785
call fcn.140002fd0
jmp 0x14004375e
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 9
jae 0x1400437dd
call fcn.1400040d0
lea rax, [0x1400045a0]
lea rcx, [0x1400042a0]
jmp 0x14004376c
call fcn.1400f4c00
lea rax, [0x1400f5840]
lea rcx, [0x1400f4ad0]
jmp 0x14004376c
Function at 0x140049bc0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1401131b0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x140049d3c
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x14014d100]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1400b40ec
mov rcx, rbx
call fcn.1400b3c98
sub r14, rax
lea rdx, [0x14011667e]
mov rcx, rbx
mov r8, r14
call fcn.1400b40ec
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1400d2610
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140049c9c
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400b4134
test eax, eax
je 0x140049d68
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140049cd7
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400b4134
test eax, eax
je 0x140049d68
xor eax, eax
mov byte [0x14014ccfd], al
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14012482b]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049d6f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14012df88]
test eax, eax
je 0x140049d6f
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x14014d300], al
mov byte [0x14014ccfc], 1
test esi, esi
setns al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x140049d5b
call fcn.140094250
int3
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x140049cd9
xor eax, eax
jmp 0x140049d2f
Function at 0x140049fa0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x140049fd4
mov rax, qword [rsi + 8]
test rax, rax
je 0x14004a0da
bt ebx, 8
jae 0x140049ff0
mov eax, ebx
and eax, 0x200
jne 0x14004a0da
cmp edi, 2
lea rax, [0x14014cd00]
lea rcx, [0x14014cf00]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14004a0da
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x14004a0da
bt ebx, 8
jb 0x14004a0da
shr ebx, 9
and ebx, 1
or bl, byte [0x14014d300]
test bl, 1
je 0x14004a0da
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movsx r13, byte [rsi + 0x17]
test r13, r13
jns 0x14004a102
mov r14, qword [rsi]
mov r13, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov rbp, r13
sub rbp, r15
jb 0x14004a0c3
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.1400ae83c
test eax, eax
je 0x14004a10a
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x14004a0a3
cmp dword [rsp + 0x2c], 0
jne 0x14004a185
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x14004a0f1
call fcn.140094250
int3
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rsi
jmp 0x14004a082
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x14004a118
test ecx, ecx
jne 0x14004a0c3
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x14004a144
cmp dword [rsp + 0x2c], 2
jne 0x14004a155
lea rdx, str.WOW6432Node
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
jmp 0x14004a155
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r14
cmp cx, 0x5c
jne 0x14004a16e
lea r14, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x14004a15b
jmp 0x14004a171
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov r13, rbp
jmp 0x14004a0ca
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x14004a191
mov rax, qword [rsi]
cmp qword [rsp + 0x30], 0
je 0x14004a1c7
mov rbx, qword [rsp + 0x38]
sub rbx, rax
sar rbx, 1
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400b3c98
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9, rax
call fcn.14002b450
jmp 0x14004a0da
ud2
Function at 0x14004c060
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x14004c0d7
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x14013cd40], rax
jne 0x14004c0da
mov rsi, rcx
call fcn.140057700
mov edx, 0x570
mov rcx, rax
xor r8d, r8d
call fcn.140042fa0
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.14004c0f0
mov ecx, dword [0x14014d30c]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140148ee0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x148], rdi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
int3
int3
Function at 0x140053a10
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1401131b0]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x140053afc
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1400d2610
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x140053b03
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.140053b70
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140053b03
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x140053b0c
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x140053b57
call fcn.140094250
int3
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400547b0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x1400547e4
mov rax, qword [r8 + 8]
mov r8, qword [r8]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rax
test rax, rax
js 0x1400548a3
sete al
test r8, r8
setne cl
or cl, al
je 0x1400548a3
lea rsi, [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.14007ad20
cmp byte [rsi + 0x17], 0
jns 0x140054825
mov rsi, qword [rsp + 0x68]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14007ad20
cmp byte [rdi + 0x17], 0
jns 0x14005484a
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x57], 0
jns 0x140054869
mov rcx, qword [rsp + 0x40]
call fcn.140092d00
cmp byte [rsp + 0x7f], 0
jns 0x14005487a
mov rcx, qword [rsp + 0x68]
call fcn.140092d00
test esi, esi
setne al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x140054899
call fcn.140094250
int3
add rsp, 0x88
pop rdi
pop rsi
ret
ud2