joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5590
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400b55c9
cvtsi2ss xmm0, rdx
jmp 0x1400b55de
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x14031bb90]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1400b560c
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400b560c
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400b563a
cmp rbx, 0x200
jae 0x1400b5637
shl rbx, 3
cmp rbx, rcx
jae 0x1400b563a
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
jbe 0x1400b5663
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400b57b4
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400b5776
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x1400b56bc
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1400b56fb
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1400b576a
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x1400b573f
mov r10, qword [r10]
cmp r10, rax
je 0x1400b56f4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400b56f4
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x1400b578c
cmp qword [rdi + r11*8], r10
jne 0x1400b5735
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400b56ac
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400b576a
Function at 0x1400b9d44
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x58
call fcn.14024eae0
sub rsp, rax
mov rdi, rcx
test rcx, rcx
jne 0x1400b9d70
xor eax, eax
jmp 0x1400b9f06
and dword [rbp + 0x50], 0
lea rsi, [0x1402c4388]
xor r9d, r9d
mov qword [rbp + 0x60], rsi
mov dword [rbp + 0x48], r9d
mov cl, byte [rsi]
mov rdx, rdi
or ebx, 0xffffffff
call fcn.1400b9cb8
mov r13d, eax
cmp eax, 0xffffffff
je 0x1400b9ea5
lea rdx, [0x140377bd0]
lea rcx, [rbp - 0x18]
call fcn.1400b5034
xor r14d, r14d
lea esi, [rbx + 3]
cmp r14d, 4
jge 0x1400b9e90
mov al, byte [rdi + 0x18]
lea rcx, [rbp - 0x28]
and qword [rsp + 0x28], 0
mov r9d, r13d
mov rdx, qword [rdi + 0x10]
xor r8d, r8d
mov byte [rsp + 0x20], al
xor r12b, r12b
call fcn.1400b8ff0
mov ebx, dword [rax]
mov r15, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400b9e08
and qword [rbp - 0x20], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
test ebx, ebx
jne 0x1400b9e6f
mov rdx, qword [rdi]
lea rax, [rbp + 0x48]
mov rcx, qword [r15 + 0x10]
lea r9, [rbp + 0x50]
mov qword [rsp + 0x28], rax
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp dword [rbp + 0x48], esi
jae 0x1400b9e41
mov eax, dword [rbp + 0x50]
dec eax
cmp eax, 1
cmovbe ebx, esi
cmp ebx, 0x3f2
je 0x1400b9e5a
cmp ebx, 0x3fa
je 0x1400b9e5a
cmp ebx, 6
je 0x1400b9e5a
xor eax, eax
jmp 0x1400b9e5f
mov eax, 1
test eax, eax
je 0x1400b9e6f
mov rcx, qword [rdi + 0x10]
call fcn.1400b8df8
mov r12b, 1
test r15, r15
je 0x1400b9e84
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
inc r14d
test r12b, r12b
jne 0x1400b9db5
mov rsi, qword [rbp + 0x60]
lea rcx, [rbp - 0x18]
test ebx, ebx
je 0x1400b9ebd
call fcn.1400b4fc0
mov r9d, dword [rbp + 0x48]
inc rsi
lea rax, [0x1402c438b]
mov qword [rbp + 0x60], rsi
cmp rsi, rax
je 0x1400b9ec6
jmp 0x1400b9d86
call fcn.1400b4fc0
mov r9d, dword [rbp + 0x48]
test ebx, ebx
jne 0x1400b9ef8
lea r15d, [rbx + 2]
cmp dword [rbp + 0x50], r15d
je 0x1400b9ede
mov al, byte [rdi + 0x1c]
and al, 0xf
cmp al, r15b
jne 0x1400b9f03
cmp r9d, 0x82
jae 0x1400b9eef
mov r9d, 0x208
jmp 0x1400b9f03
add r9d, 0x104
jmp 0x1400b9f03
mov rcx, rdi
call fcn.1400b4194
mov r9d, eax
mov eax, r9d
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400ba650
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.14024eae0
sub rsp, rax
and dword [rsp + 0x30], 0
lea rsi, [0x1402c4388]
mov r15, r9
mov r14, rcx
mov cl, byte [rsi]
mov rdx, r14
or ebx, 0xffffffff
call fcn.1400b9cb8
mov r13d, eax
cmp eax, 0xffffffff
je 0x1400ba7cc
lea rdx, [0x140377bd0]
lea rcx, [rsp + 0x48]
call fcn.1400b5034
xor ebp, ebp
cmp ebp, 4
jge 0x1400ba7c2
mov al, byte [r14 + 0x18]
lea rcx, [rsp + 0x38]
and qword [rsp + 0x28], 0
mov r9d, r13d
mov rdx, qword [r14 + 0x10]
xor r8d, r8d
mov byte [rsp + 0x20], al
xor r12b, r12b
call fcn.1400b8ff0
mov ebx, dword [rax]
mov rdi, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400ba70b
and qword [rsp + 0x40], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
test ebx, ebx
jne 0x1400ba7a2
mov eax, dword [rsp + 0xb0]
lea r9, [rsp + 0x30]
mov dword [r15], eax
xor r8d, r8d
mov rax, qword [rsp + 0xa8]
mov rdx, qword [r14]
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0x3f2
je 0x1400ba75d
cmp eax, 0x3fa
je 0x1400ba75d
cmp eax, 6
je 0x1400ba75d
xor ecx, ecx
jmp 0x1400ba762
mov ecx, 1
test ecx, ecx
je 0x1400ba774
mov rcx, qword [r14 + 0x10]
call fcn.1400b8df8
mov r12b, 1
jmp 0x1400ba7a2
test eax, eax
jne 0x1400ba7a2
movzx ecx, word [r14 + 0x1c]
mov eax, ecx
and eax, 0xf
cmp dword [rsp + 0x30], eax
je 0x1400ba7f9
cmp dword [rsp + 0x30], 3
jne 0x1400ba79d
cmp dword [r15], 4
jne 0x1400ba79d
and cl, 0xf
cmp cl, 4
je 0x1400ba7f9
mov ebx, 2
test rdi, rdi
je 0x1400ba7b7
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
inc ebp
test r12b, r12b
jne 0x1400ba6b5
lea rcx, [rsp + 0x48]
call fcn.1400b4fc0
inc rsi
lea rax, [0x1402c438b]
cmp rsi, rax
jne 0x1400ba689
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
je 0x1400ba80e
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
lea rcx, [rsp + 0x48]
call fcn.1400b4fc0
xor eax, eax
jmp 0x1400ba7e1
Function at 0x1400baa80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.14024eae0
sub rsp, rax
mov r15b, dl
mov rdi, rcx
test rcx, rcx
je 0x1400bac46
test dl, dl
je 0x1400baace
cmp dword [0x14037cb84], 0
je 0x1400baac7
test byte [rcx + 0x1c], 0x40
je 0x1400bab02
mov eax, 1
jmp 0x1400bab04
mov eax, dword [0x14037ceb0]
test eax, eax
je 0x1400baae0
cmp eax, 2
sete al
jmp 0x1400baaea
cmp byte [0x14037cf31], 0
setne al
test al, al
je 0x1400bab02
movzx eax, word [rcx + 0x1c]
and ax, 0x30
cmp ax, 0x10
je 0x1400bab02
cmp ax, 0x20
jmp 0x1400baac5
xor eax, eax
test eax, eax
jne 0x1400bac46
lea rdx, [0x140377bd0]
lea rcx, [rsp + 0x40]
call fcn.1400b5034
lea rsi, [0x1402c4388]
movzx r8d, byte [rsi]
test r8d, r8d
je 0x1400bab37
cmp r8d, 1
je 0x1400bab37
xor al, al
jmp 0x1400bab39
mov al, 1
cmp r15b, al
jne 0x1400bac29
mov rdx, rdi
mov cl, r8b
call fcn.1400b9cb8
mov r13d, eax
cmp eax, 0xffffffff
je 0x1400bac29
xor ebp, ebp
cmp ebp, 4
jge 0x1400bac29
mov al, byte [rdi + 0x18]
lea rcx, [rsp + 0x30]
and qword [rsp + 0x28], 0
mov r9d, r13d
mov rdx, qword [rdi + 0x10]
xor r8d, r8d
mov byte [rsp + 0x20], al
xor r12b, r12b
call fcn.1400b8ff0
mov r14d, dword [rax]
mov rbx, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400babb1
and qword [rsp + 0x38], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
test r14d, r14d
jne 0x1400bac09
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rdx, qword [rdi]
xor r8d, r8d
mov rcx, qword [rbx + 0x10]
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400bac66
cmp eax, 0x3f2
je 0x1400babf4
cmp eax, 0x3fa
je 0x1400babf4
cmp eax, 6
je 0x1400babf4
xor eax, eax
jmp 0x1400babf9
mov eax, 1
test eax, eax
je 0x1400bac09
mov rcx, qword [rdi + 0x10]
call fcn.1400b8df8
mov r12b, 1
test rbx, rbx
je 0x1400bac1e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
inc ebp
test r12b, r12b
jne 0x1400bab5b
inc rsi
lea rax, [0x1402c438b]
cmp rsi, rax
jne 0x1400bab24
lea rcx, [rsp + 0x40]
call fcn.1400b4fc0
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test rbx, rbx
je 0x1400bac7b
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 8]
call qword [case.0x14004a846.0]
lea rcx, [rsp + 0x40]
call fcn.1400b4fc0
mov al, 1
jmp 0x1400bac48
Function at 0x1400bb0dc
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x50
call fcn.14024eae0
sub rsp, rax
mov r14, rcx
lea rdx, [0x140377bd0]
lea rcx, [rsp + 0x40]
call fcn.1400b5034
xor ebx, ebx
xor esi, esi
cmp esi, 4
jge 0x1400bb1db
mov al, byte [r14 + 0x18]
lea rcx, [rsp + 0x30]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rdx, qword [r14 + 0x10]
xor r8d, r8d
mov byte [rsp + 0x20], al
xor bpl, bpl
call fcn.1400b8ff0
mov ebx, dword [rax]
mov rdi, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400bb165
and qword [rsp + 0x38], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
test ebx, ebx
jne 0x1400bb1c6
mov rdx, qword [r14]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp eax, 0x3f2
je 0x1400bb18f
cmp eax, 0x3fa
je 0x1400bb18f
cmp eax, 6
je 0x1400bb18f
xor eax, eax
jmp 0x1400bb194
mov eax, 1
test eax, eax
je 0x1400bb1a4
mov rcx, qword [r14 + 0x10]
call fcn.1400b8df8
mov bpl, 1
test rdi, rdi
je 0x1400bb1b9
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
inc esi
test bpl, bpl
jne 0x1400bb10f
jmp 0x1400bb1db
test rdi, rdi
je 0x1400bb1db
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
lea rcx, [rsp + 0x40]
call fcn.1400b4fc0
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400bb1fc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x50
call fcn.14024eae0
sub rsp, rax
mov rax, qword [rcx + 0x10]
xor ebx, ebx
mov rdi, rcx
test byte [rax + 0xa], 0x1f
je 0x1400bb230
mov eax, QueryPathOfRegTypeLib
jmp 0x1400bb314
lea rdx, [0x140377bd0]
lea rcx, [rsp + 0x40]
call fcn.1400b5034
xor esi, esi
cmp esi, 4
jge 0x1400bb308
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0x30]
mov al, byte [rdi + 0x18]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
xor bpl, bpl
mov byte [rsp + 0x20], al
mov rdx, qword [rdx + 0x10]
call fcn.1400b8ff0
mov ebx, dword [rax]
mov r14, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400bb29c
and qword [rsp + 0x38], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
test ebx, ebx
jne 0x1400bb2e8
mov rax, qword [rdi + 0x10]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
cmp eax, 0x3f2
je 0x1400bb2ca
cmp eax, 0x3fa
je 0x1400bb2ca
cmp eax, 6
je 0x1400bb2ca
xor eax, eax
jmp 0x1400bb2cf
mov eax, 1
test eax, eax
je 0x1400bb2df
mov rcx, qword [rdi + 0x10]
call fcn.1400b8df8
mov bpl, 1
mov rcx, qword [rdi + 0x10]
call fcn.1400b4cfc
test r14, r14
je 0x1400bb2fd
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
inc esi
test bpl, bpl
jne 0x1400bb243
lea rcx, [rsp + 0x40]
call fcn.1400b4fc0
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400bb32c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov rbx, rcx
test rcx, rcx
je 0x1400bb3dd
lea rdx, [0x140377bd0]
lea rcx, [rsp + 0x30]
call fcn.1400b5034
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400baec0
mov edi, dword [rax]
mov rbx, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400bb391
and qword [rsp + 0x28], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
test edi, edi
je 0x1400bb3a3
test rbx, rbx
je 0x1400bb3c6
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
jmp 0x1400bb3bd
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov edi, eax
test rbx, rbx
je 0x1400bb3c6
mov rdx, qword [rbx]
mov rax, qword [rdx + 8]
mov rcx, rbx
call qword [case.0x14004a846.0]
lea rcx, [rsp + 0x30]
call fcn.1400b4fc0
mov rbx, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret
xor edx, edx
mov ecx, 0x230239f
call fcn.1400b3928
int3
Function at 0x1400bce78
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
lea edx, [rax - 0x1f]
mov rbx, rcx
lea r8d, [rax - 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x1400bcee0
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x1400bcee0
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400bcee0
cmp word [rax + 2], si
je 0x1400bcee0
cmp dword [rax + 0x28], 0xfeef04bd
jne 0x1400bcee0
add rax, 0x30
jmp 0x1400bcee7
lea rax, [0x1402c7e18]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bdc20
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x70], ebp
lea r8, [rsp + 0x70]
lea rdx, [0x14037cf40]
lea ecx, [rax - 0x3d]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov esi, eax
test eax, eax
jne 0x1400bdc65
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
jmp 0x1400bdcfc
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400bdfc4
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov r9d, esi
xor r8d, r8d
lea rdx, [0x14037cf40]
lea ecx, [r8 + 3]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
jne 0x1400bdca0
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
jmp 0x1400bdcee
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x68], ebp
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x78]
lea rdx, [0x14027370c]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400bdc97
cmp dword [rsp + 0x68], 0x34
jne 0x1400bdc97
mov rcx, qword [rsp + 0x78]
movzx eax, word [rcx + 0xa]
mov dword [rdi], eax
movzx eax, word [rcx + 8]
mov dword [rdi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rdi + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rdi + 0xc], eax
test rbx, rbx
je 0x1400bdcfc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400be0dc
Capabilities:
Check os version

Disassembly:
push rbx
mov eax, 0x150
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, pe_nt_image_headers64
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1400be130
mov ecx, 0x323658
jmp 0x1400be14d
cmp dword [rsp + 0x24], 6
jae 0x1400be141
mov ecx, 0x323659
call fcn.1400bc714
cmp dword [rsp + 0x30], 2
je 0x1400be152
mov ecx, 0x32365a
call fcn.1400bc714
mov eax, dword [rsp + 0x24]
movzx ecx, word [rsp + 0x134]
movzx edx, word [rsp + 0x138]
mov dword [rbx], eax
mov eax, dword [rsp + 0x28]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 8], eax
mov eax, 0x110
test ax, dx
mov dword [rbx + 0xc], ecx
mov cl, byte [rsp + 0x13a]
mov rax, rbx
mov byte [rbx + 0x10], cl
setne cl
shr dx, 8
and dl, 1
mov byte [rbx + 0x11], cl
mov byte [rbx + 0x12], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0x150
pop rbx
ret

Function at 0x1400becdc
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov rbx, rdx
lea r9, [rbp + 0x28]
lea rdx, [rbp - 0x38]
lea r8, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1400beda8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x20], eax
lea rcx, str.LastError
mov ebx, 2
mov qword [rbp - 0x28], rcx
mov eax, 4
mov r9d, ebx
mov word [rbp - 0x1c], ax
mov edx, 0x55f
lea rax, [0x140279460]
mov ecx, 0x8ca512
lea r8d, [rbx + 0xd]
mov qword [rbp - 0x30], rax
call fcn.140239eb0
test al, al
je 0x1400beda4
lea rax, [rbp - 0x30]
mov r9d, ebx
mov qword [rbp + 0x20], rax
lea r8d, [rbx + 0xd]
lea rax, vtable.Mso::Logging::CompositeStructuredTrace.0
mov edx, 0x55f
mov qword [rbp - 0x18], rax
mov ecx, 0x8ca512
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, str.GetDiskFreeSpaceExW_failed
mov qword [rsp + 0x20], rax
call fcn.14023a300
xor al, al
jmp 0x1400bedbf
mov rax, qword [rbp + 0x28]
shr rax, 0x14
mov dword [rbx + 4], eax
mov rax, qword [rbp - 0x40]
shr rax, 0x14
mov dword [rbx], eax
mov al, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1400c0084
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
mov eax, 0x80
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
and qword [rbp - 0x30], 0
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 7
mov byte [rbp - 0x58], 0
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbp - 0x40], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x60], 0x10
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400c00fc
mov cl, byte [rbp - 0x58]
mov byte [rbx], cl
jmp 0x1400c010c
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000ae4c
mov byte [rbx], 1
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbx + 8], xmm0
movups xmm1, xmmword [rbp - 0x40]
mov rax, rbx
movups xmmword [rbx + 0x18], xmm1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
Function at 0x1400c142c
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov r15d, edx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp + 0x40], 0x40
lea ecx, [rax + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, ebx
test rax, rax
cmovne rdi, rax
je 0x1400c161b
mov word [rdi], bx
lea r8, [rbp + 0x40]
mov rdx, rdi
mov ecx, r15d
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x1400c15e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1400c152b
cmp eax, 0x534
je 0x1400c151a
cmp eax, 0x54b
je 0x1400c151a
lea rcx, [0x140279460]
mov qword [rbp - 0x30], rcx
lea rcx, str.EXTENDED_NAME_FORMAT
mov qword [rbp - 0x28], rcx
mov dword [rbp - 0x20], r15d
lea r15d, [rbx + 4]
mov word [rbp - 0x1c], r15w
lea rcx, str.LastError
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], eax
mov word [rbp - 4], r15w
lea rax, [0x140279460]
mov qword [rbp - 0x18], rax
lea rax, str.GetUserNameExW_failed_1
mov qword [rbp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 0x11ce1a1
call fcn.1400c1720
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rbx
jmp 0x1400c161e
mov ecx, dword [rbp + 0x40]
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
mov rcx, rdi
test rax, rax
je 0x1400c151d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, r14
lea r8, [rbp + 0x40]
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x1400c161b
lea rcx, [0x140279460]
mov qword [rbp - 0x18], rcx
lea rcx, str.EXTENDED_NAME_FORMAT
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], r15d
mov r15d, 4
mov word [rbp - 4], r15w
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LastError
mov qword [rbp - 0x28], rcx
mov dword [rbp - 0x20], eax
mov word [rbp - 0x1c], r15w
lea rax, [0x140279460]
mov qword [rbp - 0x30], rax
lea rax, str.GetUserNameExW_failed_2
mov qword [rbp + 0x48], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 0x11ce1a2
call fcn.1400c1720
mov rcx, r14
jmp 0x1400c151d
mov eax, dword [rbp + 0x40]
lea rdx, [rax*2 + 2]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1400c1604
mov rdi, rax
mov al, 1
jmp 0x1400c1606
mov al, bl
test al, al
jne 0x1400c161b
test rdi, rdi
je 0x1400c161b
mov rcx, rdi
mov rdi, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rdi
mov rax, rsi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret