joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f930
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, r8
and qword [rsp + 0x68], rbx
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea edx, [rbx + 8]
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14000f987
xor edi, edi
lea ebx, [rax + 8]
jmp 0x14000fa4a
test edi, edi
jne 0x14000f9b2
lea rcx, [rsp + 0x68]
call fcn.14000fa90
mov edi, eax
test eax, eax
jne 0x14000f9ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14000fa2a
mov r9, qword [rsp + 0x68]
jmp 0x14000f9b9
lea r9, str.S_1_5_80_956008885_3418522649_1831038044_1853292631_2271478464
mov qword [rsp + 0x28], r9
mov r8, r14
mov edx, 0x200
mov qword [rsp + 0x20], r9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rbp
call fcn.14000fcd0
mov edi, eax
test eax, eax
jne 0x14000fa2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
je 0x14000fa2a
cmp eax, 5
je 0x14000fa0b
add eax, 0xffffffe0
cmp eax, 1
ja 0x14000fa13
mov rcx, rbp
call fcn.140005634
mov r9d, ebx
lea rdx, str.BfspSetSecurityDescriptor__s__failed__Last_Error___x
mov r8, rbp
mov ecx, 4
call fcn.14000f424
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000fa60
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test edi, edi
jne 0x14000fa72
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140010f7c
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14003f0b8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor ebx, ebx
mov r14, r8
mov qword [rbp - 1], rbx
mov r15, rdx
mov dword [rbp - 0x19], ebx
mov qword [rbp + 7], rbx
mov dword [rbp - 0x11], ebx
mov dword [r8], ebx
test ecx, ecx
je 0x140010fed
cmp ecx, 1
je 0x140010fd2
mov eax, 0xc000000d
jmp 0x140011021
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
lea rcx, [0x1400346a0]
lea rax, [rbp + 0xf]
mov qword [rsp + 0x30], rax
jmp 0x140010ffe
mov qword [rsp + 0x38], rbx
lea rcx, [0x140034694]
mov qword [rsp + 0x30], rbx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x11]
lea rax, [rbp - 1]
lea r8, [rbp + 7]
mov qword [rsp + 0x20], rax
call fcn.140012590
test eax, eax
jns 0x140011036
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14001114c
mov edi, ebx
cmp dword [rbp - 0x19], ebx
jbe 0x14001114c
mov rcx, qword [rbp - 1]
lea rdx, str.SHA1
mov eax, edi
xor r9d, r9d
add rax, rax
mov qword [rbp - 9], rbx
xor r8d, r8d
mov qword [rbp - 0x11], rbx
mov r12d, dword [rcx + rax*8]
mov r13, qword [rcx + rax*8 + 8]
lea rcx, [rbp - 0x11]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 9]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1400110e1
mov rcx, qword [rbp - 9]
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1400110e1
mov rcx, qword [rbp - 9]
lea rdx, [rbp + 0x17]
xor r9d, r9d
lea r8d, [r9 + 0x14]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400110f6
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14001110d
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14001114c
mov r8d, dword [r15 + 4]
lea rcx, [rbp + 0x17]
mov rdx, qword [r15 + 8]
call sub.msvcrt.dll_memcmp
xor ebx, ebx
test eax, eax
je 0x140011145
inc edi
cmp edi, dword [rbp - 0x19]
jb 0x140011041
jmp 0x14001114c
mov dword [r14], 1
mov rdi, qword [rbp + 7]
test rdi, rdi
je 0x140011175
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140026f10
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140011254
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
mov ebp, r8d
mov rbx, rcx
test rcx, rcx
je 0x1400112ec
test edx, edx
je 0x1400112ec
lea rax, [rcx + 0x10040]
mov edi, edx
lea rsi, [rdi + rcx]
mov ecx, 0x10040
cmp rax, rsi
lea rax, [rbx + 0x40]
cmovbe edi, ecx
add rdi, rbx
cmp rax, rdi
jae 0x1400112ec
movsxd rcx, dword [rbx + 0x3c]
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400112e0
lea rax, [rbx + 0xf8]
add rax, rcx
cmp rax, rsi
jae 0x1400112e0
cmp dword [rcx + rbx], 0x4550
jne 0x1400112e0
mov eax, 0x14c
cmp word [rcx + rbx + 4], ax
jne 0x1400112e0
mov rcx, rbx
call fcn.14001130c
mov r9, rax
test rax, rax
jne 0x1400112ec
add rbx, rbp
lea rcx, [rbx + 0x40]
cmp rcx, rdi
jb 0x14001129e
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001130c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
mov rax, qword [0x14003f0b8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
and qword [r11 - 0x48], 0
and qword [r11 - 0x40], 0
and dword [rsp + 0x24], 0
and qword [r11 - 0x50], 0
or rbx, 1
mov qword [rsp + 0x40], rbx
mov qword [r11 - 0x30], 0x10
mov qword [r11 - 0x28], 1
mov qword [r11 - 0x20], 0
lea r9, [r11 - 0x40]
mov r8d, 3
lea rdx, [r11 - 0x30]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
jmp 0x14001138c
test eax, eax
js 0x1400113fd
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrAccessResource]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
jmp 0x1400113bd
test eax, eax
js 0x1400113fd
cmp dword [rsp + 0x24], 0x5c
jb 0x1400113fb
mov rcx, qword [rsp + 0x28]
add rcx, 6
lea rdx, [0x140033730]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400113fb
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + 0x30]
mov dword [rsp + 0x34], eax
mov eax, dword [rcx + 0x34]
mov dword [rsp + 0x30], eax
jmp 0x1400113fd
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140026f10
add rsp, 0x70
pop rbx
ret
Function at 0x1400117e8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r12d, r8d
mov ebp, edx
mov rsi, rcx
test rcx, rcx
je 0x1400118c1
test edx, edx
je 0x1400118c1
lea rax, [rcx + 0x10040]
mov r14d, ebp
lea r15, [rcx + rbp]
mov rdi, rsi
cmp rax, r15
mov ecx, 0x10040
lea rax, [rsi + 0x40]
cmovbe r14d, ecx
add r14, rsi
cmp rax, r14
jae 0x1400118c1
movsxd rcx, dword [rdi + 0x3c]
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400118b5
lea rax, [rdi + 0xf8]
add rax, rcx
cmp rax, r15
jae 0x1400118b5
cmp dword [rcx + rdi], 0x4550
jne 0x1400118b5
mov eax, 0x14c
cmp word [rcx + rdi + 4], ax
jne 0x1400118b5
or dword [rsp + 0x68], 0xffffffff
lea r9, [rsp + 0x68]
mov edx, esi
lea r8, [rsp + 0x50]
sub edx, edi
xor ebx, ebx
and dword [rsp + 0x50], ebx
add edx, ebp
mov rcx, rdi
call qword [sym.imp.imagehlp.dll_CheckSumMappedFile]
nop dword [rax + rax]
test rax, rax
je 0x1400118b1
mov eax, dword [rsp + 0x50]
lea ecx, [rbx + 1]
cmp dword [rsp + 0x68], eax
cmove ebx, ecx
test ebx, ebx
jne 0x1400118c1
add rdi, r12
lea rcx, [rdi + 0x40]
cmp rcx, r14
jb 0x140011842
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140012bfc
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and dword [rsp + 0x70], 0
mov r14, rdx
mov rbp, rcx
mov esi, 0x400
jmp 0x140012c8d
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, 0x70050
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140012ce6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x140012cbd
mov rcx, rbx
add esi, esi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140012c20
mov ecx, 0x5aa
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor edi, edi
test rbx, rbx
je 0x140012cd1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov qword [r14], rbx
xor ebx, ebx
jmp 0x140012cbd
Function at 0x140013164
Capabilities:
Get storage device properties

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14003f0b8]
xor rax, rsp
mov qword [rsp + 0x60], rax
and dword [rsp + 0x40], 0
lea r8, [r11 - 0x38]
xor eax, eax
mov r14, r9
and qword [r11 - 0x50], rax
mov edx, 0x2d1400
and qword [r9], rax
mov rbp, rcx
and dword [rsp + 0x50], eax
mov r9d, 0xc
and dword [rsp + 0x54], eax
mov qword [r11 - 0x40], rax
lea rax, [r11 - 0x48]
mov qword [r11 - 0x58], rax
lea rax, [r11 - 0x40]
mov dword [rsp + 0x28], 8
mov qword [r11 - 0x68], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x1400131f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x14001328e
mov edi, 0x28
cmp dword [rsp + 0x4c], edi
cmova edi, dword [rsp + 0x4c]
xor ecx, ecx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14001322f
mov ecx, 0x5aa
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor esi, esi
jmp 0x14001328e
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov r9d, 0xc
mov edx, 0x2d1400
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x14001327a
cmp dword [rbx + 4], edi
je 0x140013275
mov dword [rbx + 4], edi
mov qword [r14], rbx
xor ebx, ebx
test rbx, rbx
je 0x14001328e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140026f10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400142e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, ebx
test rcx, rcx
je 0x140014386
cmp bx, word [rcx]
je 0x140014386
xor edx, edx
call fcn.14001452c
mov rsi, rax
test rax, rax
je 0x140014382
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140014331
test al, 0x10
je 0x140014331
lea edi, [rbx + 1]
jmp 0x140014354
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
mov ecx, 0x10b
cmove eax, ecx
mov ecx, 3
cmp eax, 2
cmove eax, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, edi
jmp 0x140014399
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400143b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov edi, ebx
test rcx, rcx
je 0x140014505
cmp bx, word [rcx]
je 0x140014505
xor edx, edx
call fcn.14001452c
mov rsi, rax
test rax, rax
je 0x140014516
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x1400144c5
bt eax, 0xb
jae 0x1400144be
mov ebp, 0x80
mov rcx, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
je 0x1400144c5
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 7]
mov dword [rsp + 0x28], ebp
xor r9d, r9d
mov edx, 0xc0010000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400144c5
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 2]
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x60]
mov edx, 0x9c040
mov qword [rsp + 0x20], rbx
mov rcx, rbp
mov word [rsp + 0x60], bx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x14001449f
mov ebx, 1
jmp 0x1400144ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x1400144d3
mov ebx, 1
jmp 0x1400144d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140014518
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014790
Capabilities:
Create directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, rcx
mov ebp, ebx
mov qword [rsp + 0x78], rbx
lea r12d, [rbx + 1]
cmp bx, word [rcx]
jne 0x1400147ca
lea ecx, [rbx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x1400149b6
lea rdx, [rsp + 0x78]
call fcn.14001452c
mov rsi, rax
test rax, rax
je 0x140014998
lea r8, [rsp + 0x80]
mov qword [rsp + 0x80], rbx
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov rcx, rax
call fcn.140014b14
mov r14d, 0x5c
test eax, eax
js 0x1400148e8
cmp dword [rsp + 0x70], r12d
jne 0x1400148b2
mov r14, qword [rsp + 0x80]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r14 + rcx*2], bx
jne 0x140014826
mov rax, qword [rsp + 0x78]
lea rdi, [rax + rcx*2]
test r14, r14
je 0x14001485e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov r14d, 0x5c
cmp r12d, 1
jne 0x140014949
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140014904
mov rcx, rsi
mov word [rax], bx
call fcn.1400142e0
test eax, eax
jne 0x1400148a8
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
mov word [rdi], r14w
add rdi, 2
jmp 0x14001486e
mov rdi, qword [rsp + 0x78]
movzx ecx, word [rdi]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x1400148cd
sub cx, 0x41
cmp cx, 0x19
ja 0x140014864
mov eax, 0x3a
cmp ax, word [rdi + 2]
jne 0x140014864
cmp r14w, word [rdi + 4]
jne 0x140014864
add rdi, 8
jmp 0x140014864
movzx ecx, ax
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x78]
jmp 0x140014864
cmp r12d, 1
jne 0x140014949
mov rcx, rsi
call fcn.1400142e0
cmp eax, r12d
je 0x140014942
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
cmp eax, r12d
je 0x140014942
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.CreatePath:_Unable_to_create___s___GLE__0x_x
jmp 0x14001495c
mov ebx, 1
jmp 0x140014976
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.CreatePath:_Unable_to_create_parent_directory_for___s___GLE__0x_x
mov r9, r15
mov dword [rsp + 0x20], eax
mov edx, 0x3000000
lea rcx, [0x14003f810]
mov ebp, eax
call fcn.140013654
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x1400149a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014eb4
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14003f0b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, 1
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [rbx + 0x1f]
lea ecx, [rbx + 0x59]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x140014ef9
xor ebx, ebx
cmp dword [rsp + 0x30], 3
cmovl ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140026f10
add rsp, 0x50
pop rbx
ret

Function at 0x140015138
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov ebp, r8d
mov r15, rdx
lea r9, [rax - 0x28]
xor r8d, r8d
xor edx, edx
mov esi, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14001518b
test eax, eax
js 0x14001521c
mov ebx, 0xc0000001
jmp 0x14001521c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400151ba
mov ebx, 0xc000009a
jmp 0x14001521c
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1400151fe
movzx eax, word [rdi]
add eax, 2
mov dword [r14], eax
cmp eax, ebp
jbe 0x1400151ef
mov ebx, 0xc0000023
jmp 0x1400151fe
mov rdx, qword [rdi + 8]
mov rcx, r15
mov r8d, eax
call sub.msvcrt.dll_memcpy
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140015a18
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14003f0b8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
sub edx, 1
je 0x140015aab
cmp edx, 1
je 0x140015a48
mov ebx, 0xc000000d
jmp 0x140015ad6
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
lea rdx, [0x140035110]
call fcn.140015528
mov ebx, eax
test eax, eax
js 0x140015a9a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x23000003
mov dword [rsp + 0x30], 0x10
call fcn.140016ca8
mov ebx, eax
test eax, eax
js 0x140015a9a
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140015ad6
call fcn.1400157fc
jmp 0x140015ad6
xor r9d, r9d
lea rdx, [rsp + 0x40]
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 0x5a]
call qword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140015ad6
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140026f10
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400195a8
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x14003f0b8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor esi, esi
mov r9d, 0xa0
mov dword [rsp + 0x30], r9d
mov rdi, rdx
mov qword [rdx], rsi
test cl, 1
je 0x1400195eb
mov ebx, 0xc0000002
jmp 0x140019648
lea rax, [rsp + 0x30]
mov edx, 3
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140019638
cmp dword [rsp + 0x40], 0x4c
jb 0x140019634
mov r9, rdi
mov word [rsp + 0x7e], si
mov r8d, 0x2001f
lea rdx, [rsp + 0x44]
xor ecx, ecx
call fcn.14001cb28
mov ebx, eax
test ebx, ebx
jns 0x140019648
mov rcx, qword [rdi]
test rcx, rcx
je 0x140019648
call fcn.14001c79c
mov qword [rdi], rsi
mov eax, ebx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140026f10
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret