joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75b8547c8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x75b921a88]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x248
call fcn.75b8becf0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.75b854d40
xor esi, esi
mov ebx, eax
test eax, eax
js 0x75b8548a5
mov rdx, rdi
mov word [rsp + 0x30], si
lea rcx, [rsp + 0x30]
call fcn.75b854e70
mov ebx, eax
test eax, eax
js 0x75b8548a5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x75b8548d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x75b854880
cmp eax, 3
jne 0x75b854897
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call fcn.75b85466c
mov ebx, eax
test eax, eax
jne 0x75b854880
lea rcx, [rsp + 0x20]
call fcn.75b8547c8
mov ebx, eax
test eax, eax
js 0x75b8548a5
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x75b8548a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rcx, [rsp + 0x30]
call fcn.75b85500c
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.75b8bc9d0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test al, 0x10
je 0x75b854855
mov ebx, esi
jmp 0x75b8548a5
Function at 0x75b87ae38
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x75b87afc9
cmp ecx, 0x7c
je 0x75b87afc9
cmp ecx, 0x29
jne 0x75b87ae83
cmp dword [rbx + 0x1c], 0
jne 0x75b87afc9
lea rdi, [rbx + 0x80]
test dword [rdi], 0x10000000
je 0x75b87afdf
jmp 0x75b87af7e
lea rdi, [rbx + 0x80]
cmp ecx, 0x2e
jne 0x75b87aeaa
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.75b87b10c
mov rcx, rbx
call fcn.75b87adfc
jmp 0x75b87afb7
cmp ecx, 0x5c
jne 0x75b87af0a
mov rcx, rbx
call fcn.75b87adfc
test byte [rdi], 0x80
je 0x75b87aefd
cmp word [rbx + 0x78], 0x62
jne 0x75b87aede
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.75b87b10c
mov rcx, rbx
call fcn.75b87adfc
jmp 0x75b87afbf
cmp word [rbx + 0x78], 0x42
jne 0x75b87aefd
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.75b87b10c
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x75b87aed1
mov rcx, rbx
call fcn.75b87b6a8
jmp 0x75b87afb7
cmp ecx, 0x5b
jne 0x75b87af2e
mov rcx, rbx
call fcn.75b87adfc
mov rcx, rbx
call fcn.75b87b558
cmp dword [rbx + 0x7c], 0x5d
jne 0x75b87afea
jmp 0x75b87ae9d
cmp ecx, 0x28
jne 0x75b87af52
mov rcx, rbx
call fcn.75b87adfc
mov rcx, rbx
call fcn.75b87b7ec
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x75b87aff5
jmp 0x75b87afaa
cmp ecx, 0x5e
jne 0x75b87af5f
lea edx, [rcx - 0x5c]
jmp 0x75b87aec8
cmp ecx, 0x24
jne 0x75b87af6c
lea edx, [rcx - 0x21]
jmp 0x75b87aec8
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x75b87afd4
cmp ecx, 0x3f
je 0x75b87afd4
cmp ecx, 0x7b
je 0x75b87afd4
cmp ecx, 0x7d
jne 0x75b87af8d
test dword [rdi], 0x10000000
je 0x75b87b000
jmp 0x75b87af9a
cmp ecx, 0x5d
jne 0x75b87af9a
test dword [rdi], 0x10000000
je 0x75b87b00b
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.75b87ba20
mov dil, 1
mov rcx, rbx
call fcn.75b87adfc
test dil, dil
je 0x75b87afbf
mov rcx, rbx
call fcn.75b87b8e8
mov ecx, dword [rbx + 0x7c]
mov al, 1
jmp 0x75b87ae4a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
call fcn.75b87a5ec
int3
mov edx, 5
call fcn.75b87a5ec
int3
mov edx, 4
call fcn.75b87a5ec
int3
mov edx, 5
call fcn.75b87a5ec
int3
mov edx, 6
call fcn.75b87a5ec
int3
mov edx, 4
call fcn.75b87a5ec
int3
Function at 0x75b88a46c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r9d
mov rcx, qword [0x75b91a090]
lea rbx, [0x75b91a090]
cmp rcx, rbx
je 0x75b88a4ae
test byte [rcx + 0x1c], 4
je 0x75b88a4ae
mov rcx, qword [rcx + 0x10]
mov dword [rax - 0x28], r9d
call fcn.75b88a370
mov ecx, esi
call fcn.75b88bf2c
xor r14d, r14d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r14
mov edi, eax
call fcn.75b88d254
test eax, eax
js 0x75b88a5b3
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x80], edi
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movabs rcx, 0xcbf29ce484222325
mov edx, r14d
movzx eax, byte [rsp + rdx + 0x80]
movabs r8, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r8
cmp rdx, 4
jb 0x75b88a4f4
mov rdx, qword [rbx + 0xb8]
mov r8, qword [rbx + 0xa0]
and rdx, rcx
mov rax, rdx
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
mov rax, qword [rbx + 0x90]
cmp rcx, rax
je 0x75b88a557
add rdx, rdx
mov r8, qword [r8 + rdx*8]
jmp 0x75b88a550
cmp rcx, r8
je 0x75b88a557
mov rcx, qword [rcx + 8]
cmp edi, dword [rcx + 0x10]
jne 0x75b88a547
jmp 0x75b88a55a
mov rcx, r14
test rcx, rcx
je 0x75b88a568
lea rdi, [rcx + 0x14]
cmp rcx, rax
jne 0x75b88a56b
mov rdi, r14
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x75b88a5a7
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jg 0x75b88a5a7
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov rax, qword [rax]
mov edx, 1
call qword [0x75b8df5b0]
test rdi, rdi
je 0x75b88a614
call fcn.75b88d11c
jmp 0x75b88a614
mov rcx, qword [0x75b91a090]
cmp rcx, rbx
je 0x75b88a5dd
test byte [rcx + 0x1c], 4
je 0x75b88a5dd
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f4610]
mov edx, 0x11
mov r9d, eax
call fcn.75b803acc
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x75b88a614
or ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
sub ecx, 1
jg 0x75b88a614
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov rax, qword [rax]
mov edx, 1
call qword [0x75b8df5b0]
mov rax, qword [0x75b923608]
test rax, rax
jne 0x75b88a62c
call fcn.75b88a2f0
mov qword [0x75b923608], rax
movabs r10, 0xc68c266878d3e870
mov rcx, qword [rsp + 0x88]
xor edx, edx
mov rax, qword [rax + 0x10]
mov r9d, esi
mov qword [rsp + 0x28], rcx
mov word [rsp + 0x20], r14w
lea ecx, [rdx + 2]
lea r8d, [rdx + 3]
call qword [0x75b8df5b0]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x75b88ba1c
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x70
mov ebp, r9d
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [0x75b91a090]
lea r12, [0x75b91a090]
cmp rcx, r12
je 0x75b88ba70
test byte [rcx + 0x1c], 8
je 0x75b88ba70
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f4538]
mov edx, 0xf
mov r9, rsi
call fcn.75b839168
mov rdx, qword [rsp + 0xb8]
movzx eax, dx
cmp rdx, rax
jne 0x75b88bb3e
xor r14d, r14d
mov r8d, 2
test edi, edi
je 0x75b88baa0
cmp edi, r8d
jne 0x75b88bb5f
lea ecx, [r8 + 0x5e]
jmp 0x75b88baa5
mov ecx, 0x50
xor eax, eax
lock cmpxchg qword [rcx + rsi], r14
mov r10, rax
je 0x75b88bb80
mov edi, 1
test ebx, ebx
je 0x75b88badf
sub ebx, edi
je 0x75b88bada
sub ebx, edi
je 0x75b88bad4
cmp ebx, edi
jne 0x75b88bbcb
lea ecx, [rdi + 3]
jmp 0x75b88bae3
movzx ecx, r8w
jmp 0x75b88bae3
movzx ecx, di
jmp 0x75b88bae3
movzx ecx, r14w
mov rax, qword [rsp + 0xc0]
mov r9d, ebp
movzx r8d, word [rsp + 0xb0]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], dx
movzx edx, cx
mov rcx, r10
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
je 0x75b88bbec
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
mov edx, 0x80070057
lea rcx, [rsp + 0x50]
call fcn.75b88d884
lea rdx, [0x75b914fd8]
lea rcx, [rsp + 0x50]
call fcn.75b8bee80
int3
mov edx, 0x8000ffff
lea rcx, [rsp + 0x50]
call fcn.75b88d884
lea rdx, [0x75b914fd8]
lea rcx, [rsp + 0x50]
call fcn.75b8bee80
int3
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b88bbaa
test byte [rcx + 0x1c], r8b
je 0x75b88bbaa
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f4538]
mov edx, 0x10
mov r9d, edi
call fcn.75b803acc
mov edx, 0x8007139f
lea rcx, [rsp + 0x50]
call fcn.75b88d884
lea rdx, [0x75b914fd8]
lea rcx, [rsp + 0x50]
call fcn.75b8bee80
int3
mov edx, 0x8000ffff
lea rcx, [rsp + 0x50]
call fcn.75b88d884
lea rdx, [0x75b914fd8]
lea rcx, [rsp + 0x50]
call fcn.75b8bee80
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b88bc2a
test byte [rcx + 0x1c], dil
je 0x75b88bc2a
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f4538]
mov edx, 0x11
mov r9d, ebx
call fcn.75b803acc
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.75b88d884
lea rdx, [0x75b914fd8]
lea rcx, [rsp + 0x50]
call fcn.75b8bee80
int3
Function at 0x75b8992d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x60
mov r14b, r8b
mov rsi, rdx
mov rdi, rcx
or qword [rbp - 0x20], 0xffffffffffffffff
and dword [rax - 0x50], 0
mov dword [rax - 0x58], 3
mov r9d, 5
mov r8d, 0x80000000
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.75b89bb14
mov ebx, eax
test eax, eax
js 0x75b899436
or qword [rbp - 0x18], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov r9d, 1
mov r8d, 0x40000000
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.75b89bb14
mov ebx, eax
test eax, eax
js 0x75b899473
mov r12d, 0x1000
mov ecx, r12d
call fcn.75b8caa24
mov rsi, rax
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x38], r12
mov r8, rax
lea rdx, [rbp + 0x38]
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.75b89bd08
test eax, eax
js 0x75b89942e
mov rdi, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x75b8993e4
xor ecx, ecx
test rdx, rdx
je 0x75b8993bc
xor eax, eax
xor byte [rax + rsi], r14b
inc ecx
mov eax, ecx
cmp rax, rdx
jb 0x75b8993af
mov r8, rsi
mov rcx, rdi
call fcn.75b89bbd8
test eax, eax
js 0x75b899426
mov qword [rbp + 0x38], r12
mov r8, rsi
lea rdx, [rbp + 0x38]
mov rcx, rbx
call fcn.75b89bd08
test eax, eax
js 0x75b89942e
jmp 0x75b89939d
mov rcx, rsi
call fcn.75b8bc9f0
nop
cmp rdi, 0xffffffffffffffff
je 0x75b8993fd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbx, 0xffffffffffffffff
je 0x75b89940c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
mov ecx, eax
call fcn.75b89b774
int3
mov ecx, eax
call fcn.75b89b774
nop
lea rax, [0x75b91a090]
mov rcx, qword [0x75b91a090]
cmp rcx, rax
je 0x75b89946b
test byte [rcx + 0x1c], 1
je 0x75b89946b
mov edx, 0xe
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, str.HC_bE_6aV_
mov rcx, qword [rcx + 0x10]
call fcn.75b81bf90
mov ecx, ebx
call fcn.75b89b774
nop
lea rax, [0x75b91a090]
mov rcx, qword [0x75b91a090]
cmp rcx, rax
je 0x75b8994a8
test byte [rcx + 0x1c], 1
je 0x75b8994a8
mov edx, 0xf
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, str.HC_bE_6aV_
mov rcx, qword [rcx + 0x10]
call fcn.75b81bf90
mov ecx, ebx
call fcn.75b89b774
int3

Function at 0x75b8994e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x75b899537
call fcn.75b8998c4
mov ebx, eax
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b899533
test byte [rcx + 0x1c], 1
je 0x75b899533
mov rcx, qword [rcx + 0x10]
lea r8, str.HC_bE_6aV_
mov edx, 0x10
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81bf90
mov eax, ebx
jmp 0x75b899539
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x75b899740
Capabilities:
Parse pe header

Disassembly:
test cx, cx
jne 0x75b899824
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
mov rdi, rcx
cmp word [rcx], ax
jne 0x75b89981a
test byte [rcx + 0x3c], 3
jne 0x75b89981a
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x75b89981a
cmp dword [rdx + 0x84], 6
jb 0x75b89981a
mov r8d, dword [rdx + 0x50]
mov r9d, dword [rdx + 0xb8]
lea eax, [r8 - 1]
lea ecx, [r9 - 1]
cmp ecx, eax
jae 0x75b89981a
mov ecx, dword [rdx + 0xbc]
mov eax, r8d
sub eax, r9d
cmp ecx, eax
ja 0x75b89981a
movabs rax, 0x2492492492492493
lea r10, [rdi + r9]
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 4
test ecx, ecx
je 0x75b89981a
dec ecx
mov eax, ecx
imul rbx, rax, 0x1c
add rbx, r10
cmp dword [rbx + 0xc], 2
jne 0x75b8997d3
cmp dword [rbx + 0x14], r8d
jae 0x75b8997d3
mov eax, r8d
sub eax, dword [rbx + 0x14]
cmp dword [rbx + 0x10], eax
ja 0x75b8997d3
mov edx, 0x1c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x75b89981a
mov ecx, dword [rbx + 0x14]
mov edx, dword [rbx + 0x10]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x75b89a7f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x2f]
sub rsp, 0xe0
and qword [rbp - 0x69], 0
mov r14d, r8d
mov r8, qword [rbp + 0x57]
mov rdi, rcx
lea rcx, [rbp - 0x69]
mov rsi, r9
call fcn.75b89a6fc
mov ebx, eax
test eax, eax
jns 0x75b89a845
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x75b89a83e
call fcn.75b8bc9f0
mov eax, ebx
jmp 0x75b89a92e
xor eax, eax
lea rcx, [rbp - 0x45]
xorps xmm0, xmm0
mov qword [rbp - 0x51], rax
xor edx, edx
movups xmmword [rbp - 0x61], xmm0
lea r8d, [rax + 0x64]
call fcn.75b8becf0
movzx edx, byte [rbp + 0x6f]
lea rcx, [rbp - 0x61]
mov rbx, qword [rbp - 0x69]
lea rax, [rbp - 0x49]
mov r9, qword [rbp + 0x67]
test rsi, rsi
mov r8, qword [rbp + 0x5f]
mov qword [rsp + 0x48], rcx
cmovne rax, rsi
mov rcx, qword [rbp + 0x57]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edx
mov rdx, rbx
mov dword [rbp - 0x49], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x75b89a90a
call fcn.75b8998c4
mov edi, eax
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b89a8f9
test byte [rcx + 0x1c], 1
je 0x75b89a8f9
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f54e0]
mov edx, 0x1a
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.75b81bf90
test rbx, rbx
je 0x75b89a906
mov rcx, rbx
call fcn.75b8bc9f0
mov eax, edi
jmp 0x75b89a92e
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x75b89a918
call fcn.75b89bac8
mov rax, qword [rbp - 0x61]
mov qword [rdi], rax
test rbx, rbx
je 0x75b89a92c
mov rcx, rbx
call fcn.75b8bc9f0
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x75b89adb4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov esi, dword [rdx]
mov rbp, rcx
xor ecx, ecx
mov r14, r8
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r12d, r12d
mov ebx, eax
test eax, eax
jne 0x75b89ae56
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x75b89ae56
mov eax, 0x800700cb
cmp edi, eax
je 0x75b89ae7d
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b89ae52
test byte [rcx + 0x1c], 1
je 0x75b89ae52
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x1d]
mov r9, rbp
mov dword [rsp + 0x20], edi
lea r8, [0x75b8f54e0]
call fcn.75b81bf90
mov eax, edi
jmp 0x75b89ae7d
cmp ebx, esi
jae 0x75b89ae68
cmp word [r14 + rbx*2], r12w
je 0x75b89ae68
mov eax, 0x8000ffff
jmp 0x75b89ae7d
inc ebx
cmp ebx, esi
jbe 0x75b89ae76
test esi, esi
je 0x75b89ae76
mov word [r14], r12w
mov eax, ebx
mov qword [r15], rax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x75b89b0ac
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov eax, dword [0x75b92390c]
xor esi, esi
test eax, eax
je 0x75b89b0d7
cmp eax, 1
setne al
mov byte [rcx], al
jmp 0x75b89b259
mov qword [rbp + 0x28], rsi
lea rdx, str.IsWow64Process2
lea rcx, [rbp + 0x28]
call fcn.75b89afcc
cmp eax, 0x8007007f
jne 0x75b89b0f7
mov rbx, rsi
jmp 0x75b89b103
test eax, eax
js 0x75b89b25b
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x75b89b183
mov word [rbp + 0x28], si
mov word [rbp + 0x30], si
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0xbd24a77672d3d270
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x75b8df5b0]
test eax, eax
jne 0x75b89b177
call fcn.75b8998c4
mov ebx, eax
lea rdx, [0x75b91a090]
mov rcx, qword [0x75b91a090]
cmp rcx, rdx
je 0x75b89b170
test byte [rcx + 0x1c], 1
je 0x75b89b170
mov edx, 0x1e
mov r9d, ebx
lea r8, [0x75b8f54e0]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov eax, ebx
jmp 0x75b89b25b
movzx eax, word [rbp + 0x28]
neg ax
jmp 0x75b89b236
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x30], 0xc
je 0x75b89b24c
mov qword [rbp + 0x30], rsi
lea rdx, str.IsWow64Process
lea rcx, [rbp + 0x30]
call fcn.75b89afcc
cmp eax, 0x8007007f
jne 0x75b89b1c7
mov rbx, rsi
jmp 0x75b89b1d3
test eax, eax
js 0x75b89b25b
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x75b89b24c
mov dword [rbp + 0x28], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0x9c44073830d36370
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x75b8df5b0]
test eax, eax
jne 0x75b89b231
call fcn.75b8998c4
mov ebx, eax
lea rdx, [0x75b91a090]
mov rcx, qword [0x75b91a090]
cmp rcx, rdx
je 0x75b89b170
test byte [rcx + 0x1c], 1
je 0x75b89b170
mov edx, 0x1f
jmp 0x75b89b15d
mov eax, dword [rbp + 0x28]
neg eax
sbb ecx, ecx
neg ecx
inc ecx
mov dword [0x75b92390c], ecx
cmp ecx, 1
setne al
mov byte [rdi], al
jmp 0x75b89b259
mov dword [0x75b92390c], 1
mov byte [rdi], sil
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x75b89bbd8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x75b89bc01
mov eax, 0x80070057
jmp 0x75b89bc87
mov r8d, edx
jmp 0x75b89bc21
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x75b89bc85
test eax, eax
je 0x75b89bc7e
cmp eax, ebx
ja 0x75b89bc7e
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x75b89bc06
call fcn.75b8998c4
mov ebx, eax
test eax, eax
jns 0x75b89bc85
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b89bc7a
test byte [rcx + 0x1c], 1
je 0x75b89bc7a
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f55c8]
mov edx, 0x13
mov r9d, ebx
call fcn.75b803acc
mov eax, ebx
jmp 0x75b89bc87
mov ebx, 0x8000ffff
jmp 0x75b89bc49
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x75b89bc98
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x75b89bcf8
call fcn.75b8998c4
mov ebx, eax
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b89bcf4
test byte [rcx + 0x1c], 1
je 0x75b89bcf4
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f55c8]
mov edx, 0x15
mov r9d, ebx
call fcn.75b803acc
mov eax, ebx
jmp 0x75b89bd02
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x75b89bd08
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x75b89bd29
mov eax, 0x80070057
jmp 0x75b89bdac
and qword [rdx], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, r10
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x75b89bd96
call fcn.75b8998c4
mov edi, eax
cmp eax, 0x80070026
jne 0x75b89bd61
and qword [rbx], 0
jmp 0x75b89bdaa
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b89bd92
test byte [rcx + 0x1c], 1
je 0x75b89bd92
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f55c8]
mov edx, 0x16
mov r9d, edi
call fcn.75b803acc
mov eax, edi
jmp 0x75b89bdac
cmp dword [rsp + 0x48], edi
jbe 0x75b89bda3
mov eax, 0x8000ffff
jmp 0x75b89bdac
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret