joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
movaps xmmword [rsp + 0x100], xmm6
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0xf8], rax
cmp byte [0x14019b884], 0
jne 0x140038ffc
mov rsi, rcx
movaps xmm6, xmmword [0x14015feb0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.GetSecureSystemTemp
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov r9d, 0x2bc
call fcn.14008b1e0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140091510
test rsi, rsi
je 0x140039000
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], r15
movaps xmmword [rdi], xmm6
mov rcx, rdi
call fcn.14008b210
mov ecx, 0x65
mov rdx, rdi
call fcn.14003ad10
test al, al
je 0x140039003
lea rax, str.SystemTemp
lea r8, [rsp + 0x20]
mov qword [r8], rax
mov qword [r8 + 8], 0xa
lea rbx, [rsp + 0xb0]
mov rcx, rdi
mov rdx, rbx
call fcn.14003e700
mov rcx, rdi
mov rdx, rbx
call fcn.14003d700
mov rcx, rbx
call fcn.14008b3b0
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x90]
mov rcx, r14
mov r9d, 0x20e
call fcn.14008b1e0
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140091510
cmp byte [rsp + 0x47], 0
jns 0x140038f73
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, rbx
call fcn.1400915a0
cmp edi, 0xffffffff
je 0x140039003
lea rcx, [rsp + 0x30]
mov edx, 2
mov r8d, 0x40000000
call fcn.140038a30
test al, al
je 0x140039003
lea rdi, [rsp + 0x30]
mov rcx, rsi
mov rdx, rdi
call fcn.14008b3c0
mov rcx, rdi
call fcn.14008b3b0
mov sil, 1
lea rcx, [rsp + 0x50]
call fcn.1400915a0
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x140038fe3
call fcn.1400b64a0
int3
mov eax, esi
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor esi, esi
jmp 0x140038fc9
int3
lea rcx, [rsp + 0x30]
call fcn.14008b3b0
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], r15
movaps xmmword [rdi], xmm6
mov rcx, rdi
call fcn.14008b210
mov ecx, 0x67
mov rdx, rdi
call fcn.14003ad10
test al, al
je 0x1400390c0
lea rbx, [rsp + 0xb0]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x90]
mov rcx, r14
mov r9d, 0x20e
call fcn.14008b1e0
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140091510
cmp byte [rsp + 0x47], 0
jns 0x14003908b
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, rbx
call fcn.1400915a0
cmp edi, 0xffffffff
je 0x1400390c0
lea rcx, [rsp + 0x30]
mov edx, 2
mov r8d, 0x40000000
call fcn.140038a30
test al, al
jne 0x140038fa4
lea rcx, [rsp + 0x30]
call fcn.14008b3b0
xor esi, esi
jmp 0x140038fbf
Function at 0x140039ac0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov byte [rsp + 0x2f], r8b
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea r14, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1400e6fe0
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.140039f80
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14015feb0]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14003a170
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x140039b5a
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140039c2e
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r12d, r12d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1400e6fe0
mov rcx, r15
mov rdx, r14
call fcn.14003a120
mov edx, dword [rsp + 0x48]
test dl, 1
jne 0x140039cbd
mov rcx, r14
call fcn.140039e90
test al, al
jne 0x140039c7c
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x140039bc8
mov rcx, qword [rsp + 0x30]
call rbx
test eax, eax
jne 0x140039c75
call r13
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
call fcn.140024880
mov rcx, r15
mov rdx, r14
call fcn.14003a170
mov rcx, rdi
mov rdx, r14
call fcn.14003d700
mov rcx, r14
call fcn.14008b3b0
movsx rax, byte [rsp + 0x47]
test rax, rax
jns 0x140039c22
mov rax, qword [rsp + 0x38]
mov r12d, ebp
test rax, rax
jne 0x140039b81
lea rcx, [rsp + 0x30]
call fcn.14008b3b0
lea rcx, [rsp + 0x298]
call fcn.14003a0b0
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x140039c5f
call fcn.1400b64a0
int3
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x140039be5
xor ebp, ebp
cmp byte [rsp + 0x2f], 0
je 0x140039be5
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.140039ac0
test eax, eax
jne 0x140039d10
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x140039caa
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140039be5
jmp 0x140039bd2
cmp byte [rsp + 0x2f], 0
je 0x140039ce5
cmp byte [rsp + 0x47], 0
js 0x140039cd2
lea rcx, [rsp + 0x30]
jmp 0x140039cd7
mov rcx, qword [rsp + 0x30]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140039ba9
lea rcx, [rsp + 0x48]
call fcn.140039e90
test al, al
jne 0x140039cf9
mov edx, dword [rsp + 0x48]
jmp 0x140039cc4
lea rcx, [rsp + 0x48]
call fcn.140039e90
test al, al
je 0x140039bb9
jmp 0x140039c75
mov ebp, eax
jmp 0x140039be5
Function at 0x14003c0c0
Capabilities:
Delete file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.14003c290
mov eax, dword [rsi]
mov dword [0x14018c144], eax
mov bl, 1
test al, 1
jne 0x14003c111
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14003c105
call fcn.1400b64a0
int3
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x14019b8c8]
test rcx, rcx
je 0x14003c13f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14019b8c8], 0
cmp qword [0x14019b8d0], 0
jne 0x14003c13f
and byte [0x14018c144], 0xfe
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x14003c168
movsx rcx, byte [rsi + 0x1f]
test rcx, rcx
jns 0x14003c156
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x14003c1e1
mov qword [0x14019b8c8], rax
jmp 0x14003c0ee
movsx rax, byte [rsi + 0x1f]
test rax, rax
jns 0x14003c176
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14003c230
lea rdi, [rsi + 8]
mov rcx, qword [0x14019b8d0]
test rcx, rcx
jne 0x14003c1b1
mov ecx, 0x18
call fcn.1400b5178
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x14019b8d0], rax
mov rdx, rdi
call fcn.140080030
cmp dword [rsi + 0x24], 0
jne 0x14003c1d5
mov rcx, qword [0x14019b8d0]
cmp byte [rcx + 0x17], 0
jns 0x14003c1cf
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1401040c0
mov ebx, eax
jmp 0x14003c0ee
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x232
call fcn.14008b1e0
lea rdx, str.settings.log_file_path.empty__
lea r14, [rsp + 0x48]
mov rcx, r14
mov r8d, 0x7f
mov r9, rdi
call fcn.14010c370
mov rcx, r14
call fcn.14010c580
mov rax, qword [rsi + 0x28]
jmp 0x14003c15f
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x238
call fcn.14008b1e0
lea rdx, str._settings.log_file_path.empty__
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r8d, 0x7f
mov r9, rdi
call fcn.14010c370
lea rdx, str.LOG_TO_FILE_set_but_no_log_file_path_
mov rcx, rbx
call fcn.140104090
mov rcx, rbx
call fcn.14010c580
jmp 0x14003c17f
Function at 0x14003d740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
cmp r9, 2
jb 0x14003d870
cmp word [r8 + 2], 0x3a
jne 0x14003d870
movzx eax, word [r8]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x14003d870
mov ebx, 2
xor eax, eax
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, 2
jb 0x14003d879
cmp word [rcx + 2], 0x3a
jne 0x14003d879
movzx r10d, word [rcx]
and r10d, 0xffffffdf
add r10d, 0xffffffa5
cmp r10w, 0xffe6
setae r10b
not al
test al, r10b
je 0x14003d879
cmp r9, rbx
cmovae r9, rbx
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], 2
lea rcx, [rsp + 0x28]
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov r8d, 1
call fcn.140086ba0
test al, al
je 0x14003d826
mov rcx, qword [rdi + 8]
sub rcx, rbx
jb 0x14003d89d
mov rax, qword [rsi + 8]
cmp rax, 1
jbe 0x14003d89d
add rax, 0xfffffffffffffffe
cmp rcx, rax
je 0x14003d847
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14003d83f
call fcn.1400b64a0
int3
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov al, 1
test rcx, rcx
je 0x14003d828
add ebx, ebx
add rbx, qword [rdi]
mov rdx, qword [rsi]
xor r8d, r8d
movzx r9d, word [rbx + r8*2]
cmp r9w, word [rdx + r8*2 + 4]
jne 0x14003d826
inc r8
cmp rcx, r8
jne 0x14003d859
jmp 0x14003d828
mov al, 1
xor ebx, ebx
jmp 0x14003d794
cmp r9, rdx
jne 0x14003d826
mov al, 1
test r9, r9
je 0x14003d828
xor edx, edx
movzx r10d, word [r8 + rdx*2]
cmp r10w, word [rcx + rdx*2]
jne 0x14003d826
inc rdx
cmp r9, rdx
jne 0x14003d887
jmp 0x14003d828
lea rcx, [0x140162faf]
call fcn.1400e7e70
int3

Function at 0x14003f250
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14019b938]
test rdi, rdi
jne 0x14003f302
mov ecx, 0x50
call fcn.1400b5178
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1400b5178
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14003f32b
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x14019b938], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14003f32b
mov rcx, rax
call fcn.1400d1ba8
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14003f330
test rdi, rdi
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14003f31f
call fcn.1400b64a0
int3
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rdi
pop rsi
ret
ud2
Function at 0x1400424b0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400e6fe0
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140042537
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x14004269e
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140042524
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400cd140
test eax, eax
je 0x140042632
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14004258c
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400426ac
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140042579
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400cd140
test eax, eax
je 0x140042666
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400425dd
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400426ba
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400425ce
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400cd140
test eax, eax
je 0x140042604
xor eax, eax
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x1400425f9
call fcn.1400b64a0
int3
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x140042615
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x1400425df
jb 0x1400426c8
test cl, cl
jns 0x140042629
mov rsi, qword [rsi]
cmp word [rsi + rbx*2], 0x5c
jne 0x1400425dd
jmp 0x1400425df
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x140042643
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x1400425df
jb 0x1400426c8
mov rdx, rsi
test cl, cl
jns 0x140042656
mov rdx, qword [rsi]
cmp word [rdx + rbx*2], 0x5c
jne 0x140042537
jmp 0x1400425df
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x140042677
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x1400425df
jb 0x1400426c8
mov rdx, rsi
test cl, cl
jns 0x14004268e
mov rdx, qword [rsi]
cmp word [rdx + rbx*2], 0x5c
jne 0x14004258c
jmp 0x1400425df
dec rbx
jne 0x14004250c
jmp 0x140042537
dec rbx
jne 0x140042561
jmp 0x14004258c
dec rbx
jne 0x1400425b6
jmp 0x1400425dd
ud2

Function at 0x1400438d0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x1400438ea
test r8d, r8d
jne 0x1400438e3
call fcn.140093f30
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.14008ee10
Function at 0x140044160
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14019ba08]
mov ecx, dword [0x140198758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400441c7
lea rax, [0x14019ba00]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x1400441bd
call fcn.1400b64a0
int3
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14019ba08]
call fcn.1400b51fc
cmp dword [0x14019ba08], 0xffffffff
jne 0x14004419c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400e6fe0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.1400b5178
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14019ba50]
mov ecx, dword [0x140198758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140044287
lea r8, [0x14019ba20]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140044380
mov qword [0x14019ba00], rsi
lea rcx, [0x14019ba08]
call fcn.1400b52b0
jmp 0x14004419c
lea rcx, [0x14019ba50]
call fcn.1400b51fc
cmp dword [0x14019ba50], 0xffffffff
jne 0x140044258
xorps xmm0, xmm0
movups xmmword [0x14019ba40], xmm0
movups xmmword [0x14019ba30], xmm0
movups xmmword [0x14019ba20], xmm0
lea rcx, [0x14019ba20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14019ba50]
call fcn.1400b52b0
jmp 0x140044258

Function at 0x1400442d0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14019ba50]
mov ecx, dword [0x140198758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004430b
movzx eax, word [0x14019ba20]
cmp eax, 9
jne 0x140044353
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14019ba50]
call fcn.1400b51fc
cmp dword [0x14019ba50], 0xffffffff
jne 0x1400442f5
xorps xmm0, xmm0
movups xmmword [0x14019ba40], xmm0
movups xmmword [0x14019ba30], xmm0
movups xmmword [0x14019ba20], xmm0
lea rcx, [0x14019ba20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14019ba50]
call fcn.1400b52b0
jmp 0x1400442f5
test eax, eax
je 0x140044306
cmp eax, 6
jne 0x140044363
mov eax, 2
jmp 0x140044306
cmp eax, 0xc
jne 0x14004436f
mov eax, 3
jmp 0x140044306
mov eax, 4
jmp 0x140044306
Function at 0x140045d60
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140045e4e
cmp qword [rsi], 0
jne 0x140045e4e
cmp dword [rsi + 0x14], 0
jne 0x140045e4e
cmp qword [rsi + 8], 0
jne 0x140045e4e
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x140045dd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140045e20
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140045dc8
mov qword [rsi], r14
call fcn.14008b200
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x140045e0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140045e36
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140045e02
mov qword [rsi + 8], r14
call fcn.14008b200
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14008b200
mov rcx, qword [rsi]
call fcn.1400866e0
mov qword [rsi], 0
jmp 0x140045db6
call fcn.14008b200
mov rcx, qword [rsi + 8]
call fcn.1400866e0
mov qword [rsi + 8], 0
jmp 0x140045def
mov rcx, rsi
call fcn.14010ce60
mov rax, qword [rsi]
jmp 0x140045d9a
Function at 0x1400495f0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x14015feb0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x14004976c
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x14019c0b0]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1400d1ffc
mov rcx, rbx
call fcn.1400d1ba8
sub r14, rax
lea rdx, [0x1401647be]
mov rcx, rbx
mov r8, r14
call fcn.1400d1ffc
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1400e6fe0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400496cc
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d2044
test eax, eax
je 0x140049798
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140049707
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d2044
test eax, eax
je 0x140049798
xor eax, eax
mov byte [0x14019bca9], al
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140171954]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004979f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14017da68]
test eax, eax
je 0x14004979f
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x14019c2b0], al
mov byte [0x14019bca8], 1
test esi, esi
setns al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14004978b
call fcn.1400b64a0
int3
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x140049709
xor eax, eax
jmp 0x14004975f
Function at 0x1400499d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x140049a04
mov rax, qword [rsi + 8]
test rax, rax
je 0x140049b0a
bt ebx, 8
jae 0x140049a20
mov eax, ebx
and eax, 0x200
jne 0x140049b0a
cmp edi, 2
lea rax, [0x14019bcb0]
lea rcx, [0x14019beb0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x140049b0a
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x140049b0a
bt ebx, 8
jb 0x140049b0a
shr ebx, 9
and ebx, 1
or bl, byte [0x14019c2b0]
test bl, 1
je 0x140049b0a
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movsx r13, byte [rsi + 0x17]
test r13, r13
jns 0x140049b32
mov r14, qword [rsi]
mov r13, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov rbp, r13
sub rbp, r15
jb 0x140049af3
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.1400cd140
test eax, eax
je 0x140049b3a
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x140049ad3
cmp dword [rsp + 0x2c], 0
jne 0x140049bb5
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x140049b21
call fcn.1400b64a0
int3
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rsi
jmp 0x140049ab2
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x140049b48
test ecx, ecx
jne 0x140049af3
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x140049b74
cmp dword [rsp + 0x2c], 2
jne 0x140049b85
lea rdx, str.WOW6432Node
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
jmp 0x140049b85
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r14
cmp cx, 0x5c
jne 0x140049b9e
lea r14, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x140049b8b
jmp 0x140049ba1
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov r13, rbp
jmp 0x140049afa
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x140049bc1
mov rax, qword [rsi]
cmp qword [rsp + 0x30], 0
je 0x140049bf7
mov rbx, qword [rsp + 0x38]
sub rbx, rax
sar rbx, 1
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400d1ba8
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9, rax
call fcn.140035ef0
jmp 0x140049b0a
ud2