joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r15, qword [rsp + 0x180]
mov rsi, r8
mov rdi, qword [rsp + 0x188]
mov r14d, edx
mov r12d, ecx
mov ebx, r9d
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xb0
call sub.VCRUNTIME140.dll_memset
test r15, r15
je 0x140045dce
test rdi, rdi
je 0x140045dce
cmp ebx, 0x50
ja 0x140045dce
cmp dword [rsp + 0x190], 0x50
jb 0x140045dce
mov qword [rsp + 0x160], rbp
test ebx, ebx
jne 0x140045d7d
lea rsi, [rsp + 0xd0]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rbp, [rdi + 0x10]
mov edx, 0x2c
mov rcx, rbp
call fcn.14004e230
mov edx, 2
mov byte [rdi + 0xc], bl
lea rcx, [rdi + 0xe]
mov byte [rdi + 0xd], r14b
call fcn.14004e230
movzx eax, byte [rdi + 0xe]
lea rcx, [rsp + 0x20]
not al
shr r14d, 8
mov byte [rdi + 0x3e], al
mov rdx, r15
movzx eax, byte [rdi + 0xf]
not al
mov byte [rdi + 0x3c], r14b
mov byte [rdi + 0x3f], al
mov byte [rdi + 0x3d], r12b
call fcn.140054780
lea rbx, [rdi + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140054400
mov esi, 4
mov ecx, esi
nop dword [rax]
movzx eax, byte [rbx - 0x10]
xor byte [rbx], al
movzx eax, byte [rbx - 0xf]
xor byte [rbx + 1], al
movzx eax, byte [rbx - 0xe]
xor byte [rbx + 2], al
movzx eax, byte [rbx - 0xd]
xor byte [rbx + 3], al
lea rbx, [rbx + 4]
sub rcx, 1
jne 0x140045c90
lea rbx, [rdi + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140054400
mov rcx, rsi
nop dword [rax]
movzx eax, byte [rbx - 0x10]
xor byte [rbx], al
movzx eax, byte [rbx - 0xf]
xor byte [rbx + 1], al
movzx eax, byte [rbx - 0xe]
xor byte [rbx + 2], al
movzx eax, byte [rbx - 0xd]
xor byte [rbx + 3], al
lea rbx, [rbx + 4]
sub rcx, 1
jne 0x140045cd0
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140054400
lea r8, [rdi + 1]
lea rcx, [rdi + 0x11]
nop word [rax + rax]
movzx eax, byte [r8 - 1]
lea r8, [r8 + 4]
xor byte [rcx - 1], al
lea rcx, [rcx + 4]
movzx eax, byte [r8 - 4]
xor byte [rcx - 4], al
movzx eax, byte [r8 - 3]
xor byte [rcx - 3], al
movzx eax, byte [r8 - 2]
xor byte [rcx - 2], al
sub rsi, 1
jne 0x140045d10
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140054400
xor eax, eax
mov rbp, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140077b10
mov rbx, qword [rsp + 0x168]
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0xc
jbe 0x140045c15
movsd xmm0, qword [rsi]
movsd qword [rdi], xmm0
mov eax, dword [rsi + 8]
mov dword [rdi + 8], eax
cmp ebx, 0x4c
jbe 0x140045da0
mov eax, reloc.WSOCK32.dll_recv
jmp 0x140045d4d
lea rbp, [rdi + 0x10]
mov rcx, rbp
lea r8d, [rbx - 0xc]
lea rdx, [rsi + 0xc]
call sub.VCRUNTIME140.dll_memcpy
mov edx, gethostname
sub edx, ebx
test edx, edx
jle 0x140045c34
lea ecx, [rbx + 4]
add rcx, rdi
jmp 0x140045c2f
mov eax, reloc.WSOCK32.dll_recv
jmp 0x140045d55
Function at 0x140049930
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov ecx, 0x400
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x1400a7f78], rax
mov rdx, rax
test rax, rax
jne 0x140049956
or eax, 0xffffffff
add rsp, 0x28
ret
xor ecx, ecx
nop dword [rax + rax]
mov eax, ecx
shr eax, 1
test cl, 1
je 0x14004996e
xor eax, 0xedb88320
test al, 1
je 0x14004997b
shr eax, 1
xor eax, 0xedb88320
jmp 0x14004997d
shr eax, 1
test al, 1
je 0x14004998a
shr eax, 1
xor eax, 0xedb88320
jmp 0x14004998c
shr eax, 1
test al, 1
je 0x140049999
shr eax, 1
xor eax, 0xedb88320
jmp 0x14004999b
shr eax, 1
test al, 1
je 0x1400499a8
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400499aa
shr eax, 1
test al, 1
je 0x1400499b7
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400499b9
shr eax, 1
test al, 1
je 0x1400499c6
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400499c8
shr eax, 1
test al, 1
je 0x1400499d5
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400499d7
shr eax, 1
mov dword [rdx], eax
inc ecx
add rdx, 4
cmp ecx, 0xff
jle 0x140049960
xor eax, eax
add rsp, 0x28
ret

Function at 0x140049c80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, r8
mov rdx, qword [0x1400a7f78]
mov rdi, rcx
test rdx, rdx
jne 0x140049cd5
call fcn.140049930
test eax, eax
je 0x140049cbf
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [0x1400a7f78]
mov dword [0x1400a36d8], 0
test rdx, rdx
je 0x140049cac
test ebx, ebx
je 0x140049cfc
nop dword [rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
mov ecx, dword [rsi]
xor rax, rcx
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov dword [rsi], ecx
sub ebx, 1
jne 0x140049ce0
mov eax, dword [rsi]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140049d80
Capabilities:
Get common file path
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x488
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x260]
mov edi, r9d
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, Ordinal_265
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, Ordinal_265
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140049e00
cmp eax, 1
jge 0x140049e18
mov eax, 1
jmp 0x140049f41
dec eax
movsxd rcx, eax
cmp rcx, 0x104
jae 0x140049fcc
mov qword [rsp + Ordinal_1155], r14
mov byte [rsp + rcx + 0x40], 0
cmp edi, 1
jne 0x140049e45
lea r14, str.spnserv.dat
jmp 0x140049e51
cmp edi, 2
jne 0x140049e90
lea r14, str.spserv.dat
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
lea r8, str._s_s
mov edx, 0x20a
lea rcx, [rsp + 0x260]
call fcn.1400292e0
mov r9, r14
lea r8, [0x1400872d4]
mov edx, 0x104
lea rcx, [rsp + 0x150]
call fcn.1400292e0
xor r14d, r14d
cmp ebp, 2
jne 0x140049f78
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 3]
mov dword [rsp + 0x28], ebp
lea rcx, [rsp + 0x260]
mov r9, rsi
mov dword [rsp + 0x20], ebp
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x10], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140049f5d
lea rdx, [rbx + 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbx + 0x10]
mov dword [rbx + 8], eax
cmp eax, 0xffffffff
je 0x140049f2e
lea rax, [rsp + 0x150]
mov qword [rbx + 8], 0x400
mov qword [rsp + 0x28], rax
lea r8d, [r14 + 4]
xor r9d, r9d
mov dword [rsp + 0x20], 0x400
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140049f94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov r14, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140077b10
add rsp, 0x488
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp edi, 1
jne 0x140049f70
lea rdx, str.Unable_to_service_standalone_clients._Please_restart_the_server_and_try_again._n
xor ecx, ecx
call fcn.140027b00
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140049f34
xor edx, edx
lea r8, [rsp + 0x150]
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x140049f70
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov edx, 0xf001f
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx], rax
test rax, rax
jne 0x140049fc5
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049f2a
xor eax, eax
jmp 0x140049f39
call fcn.1400780b4
int3
Function at 0x140049fe0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
call fcn.140028c00
xor edx, edx
mov r8, rbx
test eax, eax
jne 0x14004a02a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
jne 0x14004a02e
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
jmp 0x14004a009
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14004a051
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, reloc.WSOCK32.dll_WSAStartup
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14004a220
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r9d
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
call fcn.140028c00
xor edx, edx
mov r8, rdi
test eax, eax
jne 0x14004a26c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
test rax, rax
jne 0x14004a270
lea eax, [rdi + 1]
jmp 0x14004a2a4
xor ecx, ecx
jmp 0x14004a259
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14004a29f
mov esi, dword [rsp + 0x50]
cmp eax, 0x102
jne 0x14004a2d5
inc ebx
mov rcx, rdi
cmp ebx, esi
jg 0x14004a2bf
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14004a283
mov qword [r14], rdi
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14004a2a4
mov eax, reloc.WSOCK32.dll_WSAStartup
jmp 0x14004a2a4
Function at 0x140054400
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov esi, 4
sub r14, rdx
mov r8d, esi
mov rbx, rdx
nop
movzx eax, byte [rdx + r14 + 0xa0]
xor byte [rdx], al
movzx eax, byte [rdx + r14 + 0xa1]
xor byte [rdx + 1], al
movzx eax, byte [rdx + r14 + 0xa2]
xor byte [rdx + 2], al
movzx eax, byte [rdx + r14 + 0xa3]
xor byte [rdx + 3], al
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140054430
lea rcx, [rbx + 1]
mov rdx, rsi
lea r12, [0x1400a41b0]
nop word [rax + rax]
movzx eax, byte [rcx - 1]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r12]
mov byte [rcx - 5], al
movzx eax, byte [rcx - 4]
movzx eax, byte [rax + r12]
mov byte [rcx - 4], al
movzx eax, byte [rcx - 3]
movzx eax, byte [rax + r12]
mov byte [rcx - 3], al
movzx eax, byte [rcx - 2]
movzx eax, byte [rax + r12]
mov byte [rcx - 2], al
sub rdx, 1
jne 0x140054480
mov edx, reloc.WSOCK32.dll_recv
mov rcx, rbx
call fcn.140054350
mov ebp, 9
lea rdi, [r14 + 0x92]
mov rax, rbx
mov rdx, rsi
nop dword [rax]
movzx ecx, byte [rdi + rax - 2]
xor byte [rax], cl
movzx ecx, byte [rdi + rax - 1]
xor byte [rax + 1], cl
movzx ecx, byte [rdi + rax]
xor byte [rax + 2], cl
movzx ecx, byte [rdi + rax + 1]
xor byte [rax + 3], cl
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400544e0
mov rcx, rbx
call fcn.1400548e0
lea rcx, [rbx + 1]
mov rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx - 1]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r12]
mov byte [rcx - 5], al
movzx eax, byte [rcx - 4]
movzx eax, byte [rax + r12]
mov byte [rcx - 4], al
movzx eax, byte [rcx - 3]
movzx eax, byte [rax + r12]
mov byte [rcx - 3], al
movzx eax, byte [rcx - 2]
movzx eax, byte [rax + r12]
mov byte [rcx - 2], al
sub rdx, 1
jne 0x140054520
mov edx, reloc.WSOCK32.dll_recv
mov rcx, rbx
call fcn.140054350
dec rbp
sub rdi, 0x10
test rbp, rbp
jg 0x1400544d3
nop word [rax + rax]
movzx eax, byte [rbx + r14]
xor byte [rbx], al
movzx eax, byte [r14 + rbx + 1]
xor byte [rbx + 1], al
movzx eax, byte [r14 + rbx + 2]
xor byte [rbx + 2], al
movzx eax, byte [r14 + rbx + 3]
xor byte [rbx + 3], al
lea rbx, [rbx + 4]
sub rsi, 1
jne 0x140054580
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400545d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov ebp, 4
sub r14, rdx
mov r8d, ebp
mov rbx, rdx
nop
movzx eax, byte [r14 + rdx]
xor byte [rdx], al
movzx eax, byte [r14 + rdx + 1]
xor byte [rdx + 1], al
movzx eax, byte [r14 + rdx + 2]
xor byte [rdx + 2], al
movzx eax, byte [r14 + rdx + 3]
xor byte [rdx + 3], al
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140054600
lea rsi, [rbx + 1]
lea rdi, [r14 + 0x12]
lea r15d, [r8 + 9]
lea r12, str.cw
nop
mov rcx, rsi
mov rdx, rbp
nop word [rax + rax]
movzx eax, byte [rcx - 1]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r12]
mov byte [rcx - 5], al
movzx eax, byte [rcx - 4]
movzx eax, byte [rax + r12]
mov byte [rcx - 4], al
movzx eax, byte [rcx - 3]
movzx eax, byte [rax + r12]
mov byte [rcx - 3], al
movzx eax, byte [rcx - 2]
movzx eax, byte [rax + r12]
mov byte [rcx - 2], al
sub rdx, 1
jne 0x140054650
mov rcx, rbx
call fcn.140054350
mov rcx, rbx
call fcn.140054b30
mov rax, rbx
mov rdx, rbp
movzx ecx, byte [rdi + rax - 2]
xor byte [rax], cl
movzx ecx, byte [rdi + rax - 1]
xor byte [rax + 1], cl
movzx ecx, byte [rdi + rax]
xor byte [rax + 2], cl
movzx ecx, byte [rdi + rax + 1]
xor byte [rax + 3], cl
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400546a0
add rdi, 0x10
sub r15, 1
jne 0x140054640
mov rcx, rbp
nop dword [rax]
movzx eax, byte [rsi - 1]
lea rsi, [rsi + 4]
movzx eax, byte [rax + r12]
mov byte [rsi - 5], al
movzx eax, byte [rsi - 4]
movzx eax, byte [rax + r12]
mov byte [rsi - 4], al
movzx eax, byte [rsi - 3]
movzx eax, byte [rax + r12]
mov byte [rsi - 3], al
movzx eax, byte [rsi - 2]
movzx eax, byte [rax + r12]
mov byte [rsi - 2], al
sub rcx, 1
jne 0x1400546e0
xor edx, edx
mov rcx, rbx
call fcn.140054350
movzx eax, byte [r14 + rbx + 0xa0]
xor byte [rbx], al
movzx eax, byte [r14 + rbx + 0xa1]
xor byte [rbx + 1], al
movzx eax, byte [r14 + rbx + 0xa2]
xor byte [rbx + 2], al
movzx eax, byte [rbx + r14 + 0xa3]
xor byte [rbx + 3], al
lea rbx, [rbx + 4]
sub rbp, 1
jne 0x140054724
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140054780
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r9d, r9d
mov r10, rcx
sub rdx, rcx
mov r8, rcx
nop
movzx eax, byte [rdx + r8]
mov byte [r8], al
lea r8, [r8 + 4]
mov byte [rsp + r9], al
movzx eax, byte [rdx + r8 - 3]
mov byte [r8 - 3], al
mov byte [rsp + r9 + 4], al
movzx eax, byte [rdx + r8 - 2]
mov byte [r8 - 2], al
mov byte [rsp + r9 + 8], al
movzx eax, byte [rdx + r8 - 1]
mov byte [rsp + r9 + 0xc], al
inc r9
mov byte [r8 - 1], al
cmp r9, 4
jl 0x1400547a0
mov eax, reloc.WSOCK32.dll_recv
lea r8, [0x1400a42b0]
lea r9, str.cw
nop dword [rax]
movzx edx, byte [rsp]
lea r8, [r8 + 4]
movzx ecx, byte [rsp + 7]
xor dl, byte [rcx + r9]
xor dl, byte [r8 - 4]
movzx ecx, byte [rsp + 0xb]
mov byte [rsp], dl
movzx ecx, byte [rcx + r9]
xor byte [rsp + 4], cl
movzx ecx, byte [rsp + 0xf]
movzx ecx, byte [rcx + r9]
xor byte [rsp + 8], cl
movzx ecx, byte [rsp + 3]
movzx ecx, byte [rcx + r9]
xor byte [rsp + 0xc], cl
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rsp + rdx*4]
xor byte [rsp + rdx*4 + 1], cl
movzx ecx, byte [rsp + rdx*4 + 1]
xor byte [rsp + rdx*4 + 2], cl
movzx ecx, byte [rsp + rdx*4 + 2]
xor byte [rsp + rdx*4 + 3], cl
inc rdx
cmp rdx, 4
jl 0x140054850
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [rsp + rdx]
mov byte [r10 + rax], cl
movzx ecx, byte [rsp + rdx + 4]
mov byte [rax + r10 + 1], cl
movzx ecx, byte [rsp + rdx + 8]
mov byte [r10 + rax + 2], cl
movzx ecx, byte [rsp + rdx + 0xc]
inc rdx
mov byte [r10 + rax + 3], cl
add rax, 4
cmp rdx, 4
jl 0x140054880
cmp rax, 0xb0
jl 0x140054800
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.140077b10
add rsp, 0x28
ret
Function at 0x140056360
Capabilities:
Check os version

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x160
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov qword [r11 + 0x10], rbx
mov rsi, rcx
mov qword [r11 + 0x18], rdi
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x58]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsi + 0x2c]
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0xb0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0xc0], 2
jne 0x1400563dd
cmp dword [rsp + 0xb4], 5
jne 0x1400563dd
cmp dword [rsp + 0xb8], 0
lea rcx, str..GlobalSNTNLUSB
je 0x1400563e4
lea rcx, str..SNTNLUSB
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call fcn.140065100
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140056418
mov eax, Ordinal_7430
jmp 0x14005648a
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 0x58
mov qword [rsp + 0x20], rax
mov edx, 0x220008
mov rcx, rdi
call fcn.140065a30
test eax, eax
jne 0x14005647f
call fcn.1400660f0
cmp eax, 6
jne 0x140056469
mov eax, 0x1d43
movzx ebx, ax
jmp 0x14005647f
call fcn.1400660f0
cmp eax, 0x39
mov ebx, 0x1d0d
mov edx, 0x1d6d
cmove bx, dx
mov rcx, rdi
call fcn.140065350
movzx eax, bx
mov rdi, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x178]
test al, al
jne 0x1400564a5
mov ecx, dword [rsp + 0x50]
mov dword [rsi + 0x2c], ecx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140077b10
add rsp, 0x160
pop rsi
ret

Function at 0x1400564c0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
mov ebx, ecx
xor edx, edx
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x50]
lea r8d, [rdi + 0x58]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0xb0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0xc0], 2
jne 0x140056538
cmp dword [rsp + 0xb4], 5
jne 0x140056538
lea rcx, str..GlobalSNTNLUSB
cmp dword [rsp + 0xb8], edi
je 0x14005653f
lea rcx, str..SNTNLUSB
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call fcn.140065100
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140056571
mov eax, Ordinal_7430
jmp 0x1400565df
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov r9d, 0x58
mov qword [rsp + 0x20], rax
mov edx, 0x220014
mov rcx, rbx
call fcn.140065a30
test eax, eax
jne 0x1400565d4
call fcn.1400660f0
cmp eax, 6
jne 0x1400565be
mov eax, 0x1d43
movzx edi, ax
jmp 0x1400565d4
call fcn.1400660f0
cmp eax, 0x39
mov edi, 0x1d0d
mov edx, 0x1d6d
cmove di, dx
mov rcx, rbx
call fcn.140065350
movzx eax, di
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140077b10
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x140056a90
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov ebx, ecx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x58]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0xb0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0xc0], 2
jne 0x140056b03
cmp dword [rsp + 0xb4], 5
jne 0x140056b03
cmp dword [rsp + 0xb8], 0
lea rcx, str..GlobalSNTNLUSB
je 0x140056b0a
lea rcx, str..SNTNLUSB
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call fcn.140065100
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140056b3e
mov eax, Ordinal_7430
jmp 0x140056bac
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
mov r9d, 0x58
mov qword [rsp + 0x20], rax
mov edx, 0x220018
mov rcx, rdi
call fcn.140065a30
test eax, eax
jne 0x140056ba1
call fcn.1400660f0
cmp eax, 6
jne 0x140056b8b
mov eax, 0x1d43
movzx ebx, ax
jmp 0x140056ba1
call fcn.1400660f0
cmp eax, 0x39
mov ebx, 0x1d0d
mov edx, 0x1d6d
cmove bx, dx
mov rcx, rdi
call fcn.140065350
movzx eax, bx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140077b10
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret

Function at 0x140057140
Capabilities:
Check os version

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r12, qword [rsp + 0x158]
mov esi, ecx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x94
mov r15, r9
mov r14d, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x50], 2
jne 0x1400571a6
cmp dword [rsp + 0x44], 5
jne 0x1400571a6
cmp dword [rsp + 0x48], 0
lea rcx, str..GlobalSNTNLUSB
je 0x1400571ad
lea rcx, str..SNTNLUSB
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call fcn.140065100
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400571e1
mov eax, Ordinal_7430
jmp 0x140057244
mov eax, dword [rsp + 0x150]
mov r9d, r14d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], r12
mov edx, esi
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.140065a30
test eax, eax
jne 0x140057239
call fcn.1400660f0
cmp eax, 6
jne 0x140057223
mov eax, 0x1d43
movzx ebx, ax
jmp 0x140057239
call fcn.1400660f0
cmp eax, 0x39
mov ebx, 0x1d0d
mov edx, 0x1d6d
cmove bx, dx
mov rcx, rdi
call fcn.140065350
movzx eax, bx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140077b10
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret