joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017d220
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x30], 0
xor eax, eax
and qword [rbp - 0x60], 0
mov rdi, rcx
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov r15d, r9d
mov qword [rbp - 0x48], rax
mov rsi, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x1a8]
mov rcx, rbx
call qword [0x1403b8660]
lea r8, [rbp + 0x30]
mov rdx, rsi
mov rcx, rdi
call rbx
mov ebx, eax
mov r13d, 3
test eax, eax
js 0x14017d31f
movsd xmm1, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov dword [rbp - 0x50], r15d
mov word [rbp - 0x58], r13w
movups xmm0, xmmword [rbp - 0x58]
mov rax, qword [rbx]
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403b8660]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rdi
mov ebx, eax
test eax, eax
js 0x14017d31f
mov rax, qword [r14]
mov rbx, qword [rax + 0x88]
mov rcx, rbx
call qword [0x1403b8660]
lea rdx, [rbp - 0x60]
mov rcx, r14
call rbx
mov ebx, eax
test eax, eax
js 0x14017d31f
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1403b8660]
mov rdx, qword [rbp + 0x30]
xor r8d, r8d
mov rcx, rbx
call rdi
mov ebx, eax
test eax, eax
jns 0x14017d326
mov ecx, eax
call fcn.14007ab24
mov ecx, ebx
call fcn.14007ab44
and qword [rbp - 0x10], 0
lea rax, [0x14002c5b8]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r13
mov edi, 0xb9
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x20]
mov ecx, edi
lea esi, [r9 + 0x20]
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x10], 0
lea rax, [0x14002c278]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x20], r13
xor r9d, r9d
mov qword [rbp - 8], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x14017d7a4
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14042eb28]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rbx, r8
xor edx, edx
mov rdi, rcx
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
and dword [rbp - 0x18], 0
lea r8, [rbp - 0x60]
and dword [rbp - 0x14], 0
mov rdx, rsi
and qword [rbp - 0x10], 0
mov rcx, rdi
call fcn.1401784ec
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
test al, al
je 0x14017d82b
movsxd rcx, dword [rbp - 0x60]
shl rcx, 5
add rcx, 0x10
add rcx, qword [rdi + 8]
call fcn.1400e28d8
mov ebx, eax
test eax, eax
jns 0x14017d8d0
mov ecx, eax
jmp 0x14017d8cb
movups xmm0, xmmword [rsi]
lea rcx, [rbp - 0x18]
movdqu xmmword [rbp - 0x28], xmm0
call fcn.1400e28d8
mov ebx, eax
test eax, eax
js 0x14017d824
lea r8, [rbp - 0x60]
mov rcx, rdi
lea rdx, [rbp - 0x28]
call fcn.1401784ec
test al, al
je 0x14017d8a2
movsxd rax, dword [rbp - 0x60]
lea rcx, [0x140044878]
shl rax, 5
lea rdx, [rbp - 0x58]
add rax, qword [rdi + 8]
xor r9d, r9d
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x48], rcx
mov ecx, 0xb9
lea r8d, [r9 + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x58], 3
call sub.ntdll.dll_NtQuerySystemInformation
xor ebx, ebx
jmp 0x14017d8be
mov edx, dword [rbp - 0x60]
lea r8, [rbp - 0x28]
mov rcx, rdi
call fcn.14017de24
mov ebx, eax
test eax, eax
jns 0x14017d8be
mov ecx, eax
call fcn.14007ab24
mov ecx, ebx
call fcn.14007ab44
test ebx, ebx
jns 0x14017d8d0
mov ecx, ebx
call fcn.14007ab24
mov ecx, ebx
call fcn.14007ab44
lea rcx, [rbp - 0x18]
call fcn.14006944c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14036e5e0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017dcf4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
movsxd rsi, edx
mov ecx, dword [rcx + 4]
mov rbp, r8
test ecx, ecx
jns 0x14017dd19
mov ebx, 0x8000ffff
mov ecx, ebx
jmp 0x14017dd30
lea r8, [rsp + 0x70]
mov edx, 1
call fcn.14007a14c
mov ebx, eax
test eax, eax
jns 0x14017dd3a
mov ecx, eax
call fcn.14007ab24
jmp 0x14017de06
mov edx, dword [rsp + 0x70]
mov rcx, rdi
call fcn.14017e1ac
mov ebx, eax
test eax, eax
js 0x14017dd2e
mov r8d, dword [rdi + 4]
mov rbx, rsi
cmp esi, r8d
jge 0x14017dd7b
mov rcx, qword [rdi + 8]
lea rax, [rsi + rsi*8]
sub r8d, esi
lea rdx, [rcx + rax*8]
movsxd rax, r8d
lea rcx, [rdx + 0x48]
lea r8, [rax + rax*8]
shl r8, 3
call sub.msvcrt.dll_memmove
mov rax, qword [rdi + 8]
lea rsi, [rbx + rbx*8]
xor edx, edx
lea rbx, [rax + rsi*8]
mov rcx, rbx
lea r8d, [rdx + 0x48]
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x14017ddb7
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x48]
call sub.msvcrt.dll_memset
and qword [rbx + 0x30], 0
and qword [rbx + 0x38], 0
and qword [rbx + 0x40], 0
mov rax, qword [rdi + 8]
lea rcx, [0x140044538]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x30], rcx
lea rax, [rax + rsi*8]
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rdi + 4]
xor ebx, ebx
mov ecx, ebx
call fcn.14007ab44
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017de24
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, rcx
movsxd rsi, edx
mov ecx, dword [rcx + 4]
mov rbp, r8
test ecx, ecx
jns 0x14017de4f
mov ebx, 0x8000ffff
mov ecx, ebx
jmp 0x14017de66
lea r8, [rsp + 0x70]
mov edx, 1
call fcn.14007a14c
mov ebx, eax
test eax, eax
jns 0x14017de70
mov ecx, eax
call fcn.14007ab24
jmp 0x14017df36
mov edx, dword [rsp + 0x70]
mov rcx, rdi
call fcn.14017e2b4
mov ebx, eax
test eax, eax
js 0x14017de64
mov r8d, dword [rdi + 4]
mov r14, rsi
cmp esi, r8d
jge 0x14017deac
sub r8d, esi
mov rdx, rsi
shl rdx, 5
add rdx, qword [rdi + 8]
movsxd r8, r8d
shl r8, 5
lea rcx, [rdx + 0x20]
call sub.msvcrt.dll_memmove
mov rbx, qword [rdi + 8]
mov esi, 0x20
shl r14, 5
mov r8d, esi
add rbx, r14
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x14017dee8
mov r8d, esi
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
and dword [rbx + 0x10], 0
and dword [rbx + 0x14], 0
and qword [rbx + 0x18], 0
mov rax, qword [rdi + 8]
lea rcx, [0x140044878]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x30], rcx
add rax, r14
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rdi + 4]
xor ebx, ebx
mov ecx, ebx
call fcn.14007ab44
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14017fd94
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
cmp dword [0x140438650], ebx
jne 0x14017fdd0
lea rcx, [0x140437c50]
call fcn.140070544
mov ebx, eax
test eax, eax
jns 0x14017fdbf
mov ecx, eax
call fcn.14007ab24
jmp 0x14017fdd0
xor edx, edx
call fcn.1401809d0
mov dword [0x140438650], 1
mov ecx, ebx
call fcn.14007ab44
test ebx, ebx
jns 0x14017fddf
mov ecx, ebx
jmp 0x14017fe42
mov rbx, qword [0x140438648]
test rbx, rbx
je 0x14017fe35
and qword [rsp + 0x30], 0
lea rax, [0x14002e978]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, 0xb9
mov qword [rsp + 0x38], rbx
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.140183bb8
mov ebx, eax
test eax, eax
jns 0x14017fe47
mov ecx, eax
call fcn.14007ab24
mov ecx, ebx
call fcn.14007ab44
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x14017fe5c
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [0x140438650], 1
jne 0x14017fee9
lea rcx, [0x140437c50]
call fcn.1400703bc
or dword [0x140438650], 0xffffffff
xor edx, edx
call fcn.1401809d0
lea rcx, [0x140437c50]
call fcn.14007329c
cmp dword [0x140437c50], 0
je 0x14017feae
lea rcx, [0x140437c58]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [0x140437c50], 0
mov rcx, qword [0x140437c88]
test rcx, rcx
je 0x14017fec8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x140437c88], 0
mov rcx, qword [0x140437c80]
test rcx, rcx
je 0x14017fee2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x140437c80], 0
and dword [0x140438650], 0
mov rbx, qword [0x140438648]
test rbx, rbx
je 0x14017ff3f
and qword [rsp + 0x30], 0
lea rax, [0x14002e978]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, 0xb9
mov qword [rsp + 0x38], rbx
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [0x140438648], 0
add rsp, 0x40
pop rbx
ret
Function at 0x1401837fc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
movsxd rbp, edx
xor ebx, ebx
mov rsi, rcx
cmp dword [rcx], ebp
je 0x140183964
mov r15d, dword [rcx + 4]
cmp ebp, r15d
cmovl r15d, ebp
test edx, edx
jle 0x1401838cc
xor edi, edi
test edx, edx
je 0x140183873
lea r14, [rbp*2]
movabs rax, 0xaaaaaaaaaaaaaaab
add r14, rbp
shl r14, 3
mul r14
shr rdx, 4
cmp rdx, rbp
je 0x140183876
mov edi, 0x80070216
mov ecx, edi
call fcn.14007ab24
mov r14, qword [rsp + 0x70]
jmp 0x140183876
xor r14d, r14d
mov ecx, edi
call fcn.14007ab44
test edi, edi
jns 0x14018388d
mov ecx, edi
call fcn.14007ab24
jmp 0x140183966
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1401838b0
mov edi, 0x8007000e
jmp 0x140183881
test r15d, r15d
je 0x1401838cc
mov rdx, qword [rsi + 8]
mov rcx, rbx
movsxd rax, r15d
lea r8, [rax + rax*2]
shl r8, 3
call sub.msvcrt.dll_memcpy
mov r12, rbx
cmp ebp, dword [rsi + 4]
jge 0x14018392b
mov edi, ebp
mov rdx, qword [rsi + 8]
movsxd rax, edi
lea rcx, [rax + rax*2]
lea rax, [rdx + rcx*8]
test rax, rax
je 0x140183924
and qword [rsp + 0x30], 0
lea rcx, [0x1400371f8]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
add rax, 8
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc edi
cmp edi, dword [rsi + 4]
jl 0x1401838d6
mov rdi, qword [rsi + 8]
mov r14, rbx
xor ebx, ebx
test rdi, rdi
je 0x140183951
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsi + 8], rbx
xor eax, eax
test r14, r14
cmovne rax, r12
mov qword [rsi + 8], rax
mov dword [rsi + 4], r15d
mov dword [rsi], ebp
xor edi, edi
mov ecx, edi
call fcn.14007ab44
test rbx, rbx
je 0x140183986
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401843e4
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
cmp qword [r8], 0
mov r15, r9
mov rdi, r8
mov r14d, edx
je 0x1401845e6
test r9, r9
je 0x1401845e6
test edx, edx
je 0x1401845e6
mov rbx, qword [rbp + 0x60]
cmp qword [rbx], 0
je 0x140184435
mov eax, dword [r9]
mov dword [rbp + 0x50], eax
jmp 0x140184439
and dword [rbp + 0x50], 0
movaps xmm0, xmmword [r8]
xor dl, dl
and word [rbp + 0x40], 0
xor cl, cl
movaps xmmword [rbp - 0x10], xmm0
xor r13d, r13d
psrldq xmm0, 8
mov r12d, r14d
movd esi, xmm0
lea eax, [rsi + r14]
cmp esi, eax
jae 0x140184492
mov ebx, eax
mov rcx, qword [rbp - 0x10]
mov edx, esi
call fcn.1401842a8
mov cl, al
cmp al, 0x20
ja 0x140184479
dec r12d
jmp 0x140184482
mov byte [rbp + r13 + 0x40], cl
xor r13d, 1
inc esi
cmp esi, ebx
jb 0x140184463
mov cl, byte [rbp + 0x41]
mov dl, byte [rbp + 0x40]
mov rbx, qword [rbp + 0x60]
xor eax, eax
cmp cl, 0x3d
lea ecx, [r12 + r12*2]
sete al
shr ecx, 2
sub ecx, eax
xor eax, eax
cmp dl, 0x3d
sete al
sub ecx, eax
mov dword [r15], ecx
cmp ecx, dword [rbp + 0x50]
jbe 0x1401844c7
mov rax, qword [rbx]
neg rax
sbb eax, eax
and eax, 0xc004d107
jmp 0x1401845eb
mov eax, dword [rdi + 8]
movaps xmm0, xmmword [rbx]
movdqu xmmword [rbp - 0x10], xmm0
lea r13d, [rax + r14]
xor esi, esi
cmp eax, r13d
jae 0x140184509
mov rcx, qword [rdi]
mov edx, eax
call fcn.1401842a8
cmp al, 0x20
jbe 0x1401844fe
movzx eax, al
lea rdx, [0x1403d3c10]
mov al, byte [rax + rdx]
mov byte [rbp + rsi + 0x40], al
inc esi
inc dword [rdi + 8]
mov eax, dword [rdi + 8]
cmp esi, 4
jb 0x1401844d8
test esi, esi
je 0x1401845d9
cmp esi, 4
jne 0x1401845e6
mov eax, dword [rbp + 0x40]
mov cl, al
mov r12b, byte [rbp + 0x41]
mov r14b, byte [rbp + 0x42]
or cl, r12b
mov sil, byte [rbp + 0x43]
or cl, r14b
or cl, sil
cmp cl, 0xff
je 0x1401845e6
movaps xmm1, xmmword [rbx]
mov r8b, r12b
inc dword [rbx + 8]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm1
shl al, 2
shr r8b, 4
movd edx, xmm0
or r8b, al
call fcn.1401842f0
cmp r14b, 0x40
jae 0x1401845cd
movaps xmm1, xmmword [rbx]
mov r8b, r14b
inc dword [rbx + 8]
movdqa xmm0, xmm1
shr r8b, 2
movq rcx, xmm1
psrldq xmm0, 8
and r8b, 0xf
movd edx, xmm0
shl r12b, 4
or r8b, r12b
call fcn.1401842f0
cmp sil, 0x40
jae 0x1401845cd
movaps xmm1, xmmword [rbx]
and sil, 0x3f
inc dword [rbx + 8]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm1
shl r14b, 6
or sil, r14b
movd edx, xmm0
mov r8b, sil
call fcn.1401842f0
mov eax, dword [rdi + 8]
cmp eax, r13d
jb 0x1401844d6
mov eax, dword [rbx + 8]
sub eax, dword [rbp - 8]
mov dword [r15], eax
xor eax, eax
jmp 0x1401845eb
mov eax, 0x80070057
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140184d50
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x14042eb28]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edi, edx
mov rbx, rcx
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140184da2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x140184dcc
cmp dword [rsp + 0x24], 5
jb 0x140184dbc
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x140184d8b
xor eax, eax
jmp 0x140184dcc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x140184db8
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14036e5e0
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x140188648
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov rax, qword [0x14042eb28]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor r14d, r14d
mov qword [rsp + 0x64], 2
mov qword [rsp + 0x70], r14
mov r12d, edx
mov byte [rsp + 0x60], r14b
mov r13, rcx
test edx, edx
je 0x1401887bf
cmp qword [rcx], r14
jne 0x1401886b3
mov r14d, 0xc004d104
jmp 0x1401887bf
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov r15d, dword [rsp + 0x34]
lea r8, [rsp + 0x40]
xor r15d, eax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x34], r15d
lea rax, [rsp + 0x30]
xor r15d, dword [rsp + 0x30]
mov r9d, 8
mov qword [rsp + 0x50], rax
mov dl, 1
mov rax, qword [0x140438658]
mov dword [rsp + 0x58], r14d
mov ecx, dword [rax]
lea rax, [rsp + 0x50]
add rax, rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.14018d654
test r12d, r12d
je 0x1401887bf
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x30]
mov ecx, r15d
mov edi, dword [r13 + 8]
xor eax, r15d
mov rsi, qword [r13]
mov r15d, eax
mov al, byte [rbp + 0x78]
add edi, r14d
inc al
rol r15d, cl
mov byte [rbp + 0x78], al
movzx r8d, al
mov al, byte [rbp + 0x79]
add al, byte [rsp + r8 + 0x78]
mov byte [rbp + 0x79], al
mov cl, byte [rsp + r8 + 0x78]
movzx edx, al
mov al, byte [rsp + rdx + 0x78]
mov byte [rsp + r8 + 0x78], al
mov byte [rsp + rdx + 0x78], cl
mov edx, edi
movzx ecx, byte [rbp + 0x79]
movzx eax, byte [rbp + 0x78]
mov cl, byte [rsp + rcx + 0x78]
add cl, byte [rsp + rax + 0x78]
movzx eax, cl
mov rcx, rsi
mov bl, byte [rsp + rax + 0x78]
call fcn.1401842a8
xor al, r15b
mov edx, edi
xor al, bl
mov rcx, rsi
mov r8b, al
call fcn.1401842f0
inc r14d
cmp r14d, r12d
jb 0x14018872b
xor r14d, r14d
lea rcx, [rsp + 0x60]
call fcn.14018d5c8
mov eax, r14d
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14036e5e0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140188fdc
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [rbp + 0x30]
movaps xmm0, xmmword [r9]
movaps xmm1, xmmword [rdx]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x60], xmm1
test rax, rax
jne 0x140189019
mov ebx, 0x80070057
mov ecx, ebx
call fcn.14007ab24
call fcn.14007ab44
jmp 0x14018906e
mov qword [rbp - 0x28], rcx
lea rdx, [0x140048ff8]
mov qword [rbp - 0x38], rdx
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x1c], rcx
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x14], r8d
xor r9d, r9d
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x30], rdx
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x40], 3
mov dword [rbp - 0x20], 0x80
lea r8d, [r9 + 0x40]
mov qword [rbp - 8], rax
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x140189088
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [rbp + 0x30]
movaps xmm0, xmmword [r9]
movaps xmm1, xmmword [rdx]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x60], xmm1
test rax, rax
jne 0x1401890c5
mov ebx, 0x80070057
mov ecx, ebx
call fcn.14007ab24
call fcn.14007ab44
jmp 0x14018911a
mov qword [rbp - 0x28], rcx
lea rdx, [0x140048ff8]
mov qword [rbp - 0x38], rdx
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x1c], rcx
lea rdx, [rbp + 0x30]
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x50]
mov edx, 0x40
mov dword [rbp - 0x14], r8d
mov r8d, edx
mov dword [rbp - 0x20], edx
mov qword [rbp - 0x10], rcx
lea rdx, [rbp - 0x40]
xor r9d, r9d
mov qword [rbp - 0x40], 3
mov qword [rbp - 8], rax
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x14018d654
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x90
cmp qword [r8], 0
mov r14d, r9d
movaps xmmword [rax - 0x48], xmm6
mov r15, r8
mov r12b, dl
mov rsi, rcx
je 0x14018d7e3
test r9d, r9d
je 0x14018d7e3
mov rdi, qword [rcx + 0x10]
test rdi, rdi
jne 0x14018d739
cmp dword [rcx + 8], 2
jne 0x14018d739
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 0xd0
xor edx, edx
mov rcx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14018d71d
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov byte [rdi + 0x37], 0
lea r8d, [rbx - 0x68]
xor edx, edx
mov byte [rdi + 0x57], 0
lea rcx, [rdi + 0x60]
call sub.msvcrt.dll_memset
and qword [rdi + 0x90], 0
xor eax, eax
and qword [rdi + 0x98], 0
mov qword [rdi + 0xb0], rax
and qword [rdi + 0xb8], rax
and dword [rdi + 0x58], eax
and dword [rdi + 0x38], eax
mov qword [rdi], rsi
mov dword [rdi + 8], 1
jmp 0x14018d71f
xor edi, edi
mov qword [rsi + 0x10], rdi
test rdi, rdi
jne 0x14018d739
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.14007ab24
jmp 0x14018d7f3
movaps xmm6, xmmword [r15]
test rdi, rdi
je 0x14018d766
mov rcx, rdi
call fcn.14019a394
mov ebx, eax
test eax, eax
jns 0x14018d757
mov ecx, eax
call fcn.14007ab24
mov ecx, ebx
call fcn.14007ab44
test ebx, ebx
js 0x14018d7e8
mov ecx, dword [rsi + 4]
sub ecx, 1
je 0x14018d792
cmp ecx, 1
je 0x14018d77a
mov ebx, 0xc004d203
jmp 0x14018d7e8
mov r8d, r14d
movdqa xmmword [rbp - 0x11], xmm6
lea rdx, [rbp - 0x11]
mov rcx, rsi
call fcn.1401962e0
mov ebx, eax
jmp 0x14018d7da
lea rax, [0x140049cf8]
movdqa xmmword [rbp - 1], xmm6
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x49]
xor r9d, r9d
mov qword [rbp - 0x49], 3
lea rax, [rbp - 0x51]
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x39], rax
mov ecx, 0xb9
lea rax, [rbp - 1]
mov dword [rbp - 0x21], r14d
lea r8d, [r9 + 0x2c]
mov qword [rbp - 0x29], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp - 0x51]
test ebx, ebx
js 0x14018d7e8
mov byte [rsi], 1
jmp 0x14018d7ef
mov ebx, 0x80070057
mov ecx, ebx
call fcn.14007ab24
test ebx, ebx
jns 0x14018d7f6
mov byte [rsi], 0
mov ecx, ebx
call fcn.14007ab44
movaps xmm6, xmmword [rsp + 0x80]
mov eax, ebx
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14018d820
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [rbp + 0x77]
mov r10d, r9d
movaps xmm1, xmmword [r8]
mov r9, rcx
mov rcx, qword [rcx + 0x10]
movaps xmm0, xmmword [rax]
test rcx, rcx
je 0x14018d8b8
mov rax, qword [rbp + 0x7f]
test dl, dl
je 0x14018d884
lea r9, [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
mov r8d, r10d
movdqa xmmword [rbp - 9], xmm1
lea rdx, [rbp - 9]
mov qword [rsp + 0x20], rax
call fcn.14019a49c
mov ebx, eax
test eax, eax
jns 0x14018d92a
mov ecx, eax
jmp 0x14018d925
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp - 0x19], xmm1
test rax, rax
jne 0x14018d89d
mov ebx, 0x80070057
jmp 0x14018d923
lea r9, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r8d, r10d
lea rdx, [rbp - 0x19]
call fcn.14019ab60
mov ebx, eax
test eax, eax
jmp 0x14018d921
lea rax, [0x14004a6b8]
mov qword [rbp + 0x1f], r9
mov qword [rbp + 0xf], rax
xor r9d, r9d
lea rax, [rbp + 0x57]
movdqa xmmword [rbp - 0x19], xmm0
mov qword [rbp + 0x17], rax
movzx eax, dl
lea rdx, [rbp + 7]
inc eax
movdqa xmmword [rbp - 9], xmm1
shl eax, 6
lea r8d, [r9 + 0x40]
mov dword [rbp + 0x27], eax
lea ecx, [r8 + 0x79]
lea rax, [rbp - 9]
mov qword [rbp + 7], 3
mov qword [rbp + 0x2b], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x37], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x33], r10d
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x57]
test ebx, ebx
jns 0x14018d92a
mov ecx, ebx
call fcn.14007ab24
mov ecx, ebx
call fcn.14007ab44
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret