joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405ecd34
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
or ebp, 0x2ced719f
rol ah, cl
bt ax, r12w
sub rsp, 0x30
adc rbp, rbp
cmovns rbp, r8
mov rax, qword [0x14002d180]
rcr bpl, cl
shl bp, cl
mov rbp, rcx
cmp r13b, r9b
test rax, rax
jmp 0x1405ecd69
jne 0x1405ecf62
mov rax, qword gs:[0x30]
mov qword [rsp + 0x48], rbx
xor r11w, r15w
stc
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rdi
movzx r11w, sil
sub r11b, r9b
mov rcx, qword [rax + 0x60]
and esi, 0xa9a6db8
mov qword [rsp + 0x20], r14
dec r14
btr si, 0xf2
movabs r14, 0x85986016e208429a
mov rax, qword [rcx + 0x18]
btc di, bx
not r11b
movsx r11, cx
mov rsi, qword [rax + 0x10]
nop dword [rax]
xor rax, rdi
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
shrd di, r12w, 0x7e
bswap edi
mov edi, dword [rax + r11 + 0x88]
cmp r10w, ax
lea rdi, [rdi + r11]
cmp r13d, r8d
cmp rdi, r11
je 0x1405ecec8
mov ebx, dword [rdi + 0x18]
xor r10d, r10d
cmp r14b, 0xf1
stc
test ebx, ebx
jmp 0x1405ece0d
je 0x1405ecec8
mov r9d, dword [rdi + 0x20]
lea r9, [r9 + r11]
ror ah, 0xe3
btr rax, 0x5b
nop dword [rax]
ror cl, cl
mov eax, dword [r9]
sal cx, 0x53
cmovno ecx, r8d
sar ch, 0x3e
sub r8d, r8d
sbb cl, 0x85
bts cx, r12w
btc cx, r9w
lea rax, [rax + r11]
shr cx, cl
stc
movzx ecx, byte [rax]
jmp 0x1405ece5b
test cl, cl
jmp 0x1405ece62
je 0x1405eceab
movsx edx, cl
and rcx, 0x221a5f02
lea rax, [rax + 1]
movzx ecx, byte [rax]
clc
jmp 0x1405ece7f
xor rdx, r8
test dl, r10b
movsx r8d, r8w
imul r8, rdx, 0x1000193
test cl, cl
jmp 0x1405ece97
jne 0x1405ece68
cmp r8, r14
jmp 0x1405ecea5
je 0x1405eced5
inc r10d
clc
add r9, 4
stc
cmp r14w, 0x2b8c
cmp r10d, ebx
jmp 0x1405ecec2
jb 0x1405ece2c
mov rsi, qword [rsi]
jmp 0x1405eced0
jmp 0x1405ecdcf
mov eax, dword [rdi + 0x24]
btr r14d, 0xf9
mov edx, dword [rdi + 0x1c]
or r8w, bp
sal rdi, cl
sets r14b
lea rax, [rax + r11]
xor di, 2
not ch
mov r14, qword [rsp + 0x20]
inc ecx
jmp 0x1405ecf08
add rdx, r11
rol dil, 7
add bh, ch
mov rdi, qword [rsp + 0x28]
movzx esi, r14w
sub rcx, 0x62f17d8d
mov rsi, qword [rsp + 0x50]
jmp 0x1405ecf2e
movzx r8d, word [rax + r10*2]
movsxd rax, ebx
bts bx, si
mov rbx, qword [rsp + 0x48]
cbw
mov eax, dword [rdx + r8*4]
or ecx, 0x1b491861
bt cx, 0x43
not cl
add rax, r11
mov qword [0x14002d180], rax
mov cl, r12b
bswap cx
mov rcx, rbp
jmp 0x1405ecf6a
call rax
cmp eax, 0xffffffff
movzx ebp, ax
setne al
shr bp, cl
add rsp, 0x30
not ebp
movsxd rbp, r13d
xchg bpl, bpl
pop rbp
jmp 0x1405ecf8a
ret
Function at 0x1405ecf8b
Capabilities:
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
adc r11d, esp
mov qword [rsp + 0x18], rbp
inc r11w
jmp 0x1405ecfac
push rsi
push rdi
cmovnp r11d, esi
and bp, 0x306f
push r14
clc
btc r14w, si
add r11b, 0x29
sub rsp, 0x30
bt ax, 0x71
xor rax, 0x219044da
rol ah, 0xfb
mov rax, qword [0x14002c010]
xor rax, rsp
or bp, 0x2267
mov qword [rsp + 0x28], rax
shld r11w, ax, 0xb8
shr r11b, 0xb8
sal r11w, cl
mov rax, qword gs:[0x30]
bt di, 0x9b
shl r11w, 0xba
mov ebp, ecx
bts r11d, edx
btr di, bx
movzx r11, r11w
movabs r14, 0x92e49d960b7788cc
mov rcx, qword [rax + 0x60]
clc
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
stc
movsxd rax, r8d
inc r11w
nop dword [rax]
movzx r11d, r9w
nop word [rax + rax]
add ah, 0x2c
movsxd r11, ebx
mov r11, qword [rsi + 0x30]
test dh, 0x5b
bswap rax
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
cmc
clc
jmp 0x1405ed06d
add rdi, r11
cmp rdi, r11
jmp 0x1405ed078
je 0x1405ed139
mov ebx, dword [rdi + 0x18]
sub r10d, r10d
test ebx, ebx
jmp 0x1405ed08b
je 0x1405ed139
mov r9d, dword [rdi + 0x20]
add r9, r11
movsx cx, r12b
nop dword [rax]
movsx cx, r14b
shr eax, cl
mov eax, dword [r9]
sub r8d, r8d
bts rcx, r15
movzx ecx, r13w
lea rax, [rax + r11]
stc
movzx ecx, byte [rax]
stc
test ecx, r14d
test cl, cl
jmp 0x1405ed0cc
je 0x1405ed117
movsx edx, cl
test r14b, r9b
mov cx, 0x3fb2
lea rax, [rax + 1]
movzx ecx, byte [rax]
test dil, 0x27
xor rdx, r8
cmp dl, r14b
rcr r8b, 0xa5
movsx r8d, bp
imul r8, rdx, 0x1000193
test cl, cl
jmp 0x1405ed103
jne 0x1405ed0d2
cmp r8, r14
jmp 0x1405ed111
je 0x1405ed146
inc r10d
cmp rsp, r14
jmp 0x1405ed123
add r9, 4
test bx, r10w
cmp r10d, ebx
jmp 0x1405ed133
jb 0x1405ed0ab
mov rsi, qword [rsi]
jmp 0x1405ed141
jmp 0x1405ed050
mov eax, dword [rdi + 0x24]
rcl dh, 0xb9
lea r9, [rsp + 0x20]
setns dl
mov edx, dword [rdi + 0x1c]
sal cx, cl
shl ch, cl
add rax, r11
inc cl
cmc
lea rdx, [rdx + r11]
mov cx, r9w
mov ecx, ebp
dec r8b
movzx r8d, word [rax + r10*2]
sub ah, 0xfb
mov eax, dword [rdx + r8*4]
sub r8d, r8d
add rax, r11
mov dl, 0x4d
mov dl, 1
call rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
jmp 0x1405ed194
call fcn.140024b00
mov rbx, qword [rsp + 0x58]
shrd si, bx, 0x37
sal bpl, cl
mov rbp, qword [rsp + 0x60]
sar sil, 0x40
cmovae si, r12w
add rsp, 0x30
pop r14
movzx edi, bx
movsx edi, bx
pop rdi
mov sil, 0x92
movsx esi, r14w
movsxd rsi, esi
pop rsi
jmp 0x1405ed1d1
ret
Function at 0x1405ecfac
Capabilities:
Access peb ldr_data
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
adc r11d, esp
mov qword [rsp + 0x18], rbp
inc r11w
jmp 0x1405ecfac
push rsi
push rdi
cmovnp r11d, esi
and bp, 0x306f
push r14
clc
btc r14w, si
add r11b, 0x29
sub rsp, 0x30
bt ax, 0x71
xor rax, 0x219044da
rol ah, 0xfb
mov rax, qword [0x14002c010]
xor rax, rsp
or bp, 0x2267
mov qword [rsp + 0x28], rax
shld r11w, ax, 0xb8
shr r11b, 0xb8
sal r11w, cl
mov rax, qword gs:[0x30]
bt di, 0x9b
shl r11w, 0xba
mov ebp, ecx
bts r11d, edx
btr di, bx
movzx r11, r11w
movabs r14, 0x92e49d960b7788cc
mov rcx, qword [rax + 0x60]
clc
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
stc
movsxd rax, r8d
inc r11w
nop dword [rax]
movzx r11d, r9w
nop word [rax + rax]
add ah, 0x2c
movsxd r11, ebx
mov r11, qword [rsi + 0x30]
test dh, 0x5b
bswap rax
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
cmc
clc
jmp 0x1405ed06d
add rdi, r11
cmp rdi, r11
jmp 0x1405ed078
je 0x1405ed139
mov ebx, dword [rdi + 0x18]
sub r10d, r10d
test ebx, ebx
jmp 0x1405ed08b
je 0x1405ed139
mov r9d, dword [rdi + 0x20]
add r9, r11
movsx cx, r12b
nop dword [rax]
movsx cx, r14b
shr eax, cl
mov eax, dword [r9]
sub r8d, r8d
bts rcx, r15
movzx ecx, r13w
lea rax, [rax + r11]
stc
movzx ecx, byte [rax]
stc
test ecx, r14d
test cl, cl
jmp 0x1405ed0cc
je 0x1405ed117
movsx edx, cl
test r14b, r9b
mov cx, 0x3fb2
lea rax, [rax + 1]
movzx ecx, byte [rax]
test dil, 0x27
xor rdx, r8
cmp dl, r14b
rcr r8b, 0xa5
movsx r8d, bp
imul r8, rdx, 0x1000193
test cl, cl
jmp 0x1405ed103
jne 0x1405ed0d2
cmp r8, r14
jmp 0x1405ed111
je 0x1405ed146
inc r10d
cmp rsp, r14
jmp 0x1405ed123
add r9, 4
test bx, r10w
cmp r10d, ebx
jmp 0x1405ed133
jb 0x1405ed0ab
mov rsi, qword [rsi]
jmp 0x1405ed141
jmp 0x1405ed050
mov eax, dword [rdi + 0x24]
rcl dh, 0xb9
lea r9, [rsp + 0x20]
setns dl
mov edx, dword [rdi + 0x1c]
sal cx, cl
shl ch, cl
add rax, r11
inc cl
cmc
lea rdx, [rdx + r11]
mov cx, r9w
mov ecx, ebp
dec r8b
movzx r8d, word [rax + r10*2]
sub ah, 0xfb
mov eax, dword [rdx + r8*4]
sub r8d, r8d
add rax, r11
mov dl, 0x4d
mov dl, 1
call rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
jmp 0x1405ed194
call fcn.140024b00
mov rbx, qword [rsp + 0x58]
shrd si, bx, 0x37
sal bpl, cl
mov rbp, qword [rsp + 0x60]
sar sil, 0x40
cmovae si, r12w
add rsp, 0x30
pop r14
movzx edi, bx
movsx edi, bx
pop rdi
mov sil, 0x92
movsx esi, r14w
movsxd rsi, esi
pop rsi
jmp 0x1405ed1d1
ret
Function at 0x1405ed389
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
clc
push rsi
push rdi
push r14
add r14b, 0xb3
test spl, 0xce
sub rsp, 0x20
stc
rcr r14b, cl
mov r14, rcx
stc
test r8w, 0x72b
mov rcx, qword [rcx]
jmp 0x1405ed3bb
test rcx, rcx
jmp 0x1405ed3c3
je 0x1405ed598
mov r8, qword [r14 + 0x10]
cmp dx, 0x745d
cmc
cmp bl, dil
test r8, r8
jmp 0x1405ed3de
je 0x1405ed3f0
sub edx, edx
jmp 0x1405ed3eb
call fcn.1400258e4
mov rax, qword [0x14002d210]
cmc
test rax, rax
jmp 0x1405ed400
jne 0x1405ed582
mov rax, qword gs:[0x30]
add dil, bl
btr ebp, 0xa0
shrd rsi, rdi, 0xff
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
and sil, r10b
bswap rsi
mov rsi, qword [rax + 0x10]
xadd r11w, ax
movabs rbp, 0x19c0f48bf548020e
cbw
bt di, si
mov r11, qword [rsi + 0x30]
rol dil, cl
xor ax, r13w
cdqe
movsxd rax, dword [r11 + 0x3c]
movzx edi, bx
xor edi, 0x2d6c1fc9
mov edi, dword [rax + r11 + 0x88]
cmp ebp, 0x64330c70
add rdi, r11
test rax, r11
jmp 0x1405ed475
cmp rdi, r11
je 0x1405ed539
sub r10d, r10d
mov ebx, dword [rdi + 0x18]
test ebx, ebx
jmp 0x1405ed48b
je 0x1405ed539
mov r9d, dword [rdi + 0x20]
shr ah, 0x1d
add r9, r11
movzx rcx, dx
nop dword [rax]
bsr ecx, ebp
mov eax, dword [r9]
test ax, 0x112a
rol cl, 0xfe
bts cx, r10w
add rax, r11
xor r8d, r8d
movzx ecx, byte [rax]
clc
jmp 0x1405ed4cb
test cl, cl
jmp 0x1405ed4d2
je 0x1405ed518
movsx edx, cl
xchg cl, ch
xor rdx, r8
rcr cl, cl
xor ch, 0xf6
imul r8, rdx, 0x1000193
jmp 0x1405ed4f1
lea rax, [rax + 1]
movzx ecx, byte [rax]
jmp 0x1405ed4fd
test cl, cl
jmp 0x1405ed504
jne 0x1405ed4d8
cmp r8, rbp
jmp 0x1405ed512
je 0x1405ed541
inc r10d
cmc
stc
cmp r8d, 0x25a82175
add r9, 4
cmp dil, spl
cmp r10d, ebx
jmp 0x1405ed533
jb 0x1405ed4a9
mov rsi, qword [rsi]
jmp 0x1405ed442
mov eax, dword [rdi + 0x24]
lea rax, [rax + r11]
shrd cx, cx, 0xe
btr cx, 0x2d
movzx edx, word [rax + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
movzx cx, r10b
movsxd rcx, r10d
sub cx, 0x6eff
add rax, r11
movzx ecx, cx
setle ch
xchg cx, cx
mov qword [0x14002d210], rax
mov cl, 0xb5
mov rcx, qword [r14]
jmp 0x1405ed58a
call rax
mov qword [r14], 0
xor bp, 0x6da5
mov rbx, qword [rsp + 0x48]
xchg rsi, r14
rol r14b, 0x6f
mov rbp, qword [rsp + 0x50]
shl r14w, 0x40
add rsp, 0x20
movsx si, r15b
jmp 0x1405ed5bc
pop r14
movzx si, sil
jmp 0x1405ed5cb
pop rdi
cmovno esi, r8d
jmp 0x1405ed5d5
pop rsi
jmp 0x1405ed5db
ret
Function at 0x140607fe7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
xor r8b, cl
shl r8b, cl
rcl r8b, cl
mov qword [rsp + 0x10], rsi
btr r8, r9
sbb r8b, cl
sbb r8w, 0x1afc
push rdi
clc
sub rsp, 0x20
rcr dil, 0xcf
adc r8b, r12b
add r8b, 0x62
mov qword [rcx + 0x8a8], 0
rol edi, cl
bts r8w, sp
mov rdi, rcx
stc
bts r8w, r13w
shld r8w, bx, 0xf7
mov qword [rcx + 0x8b0], 0
bt r8w, r12w
xor edx, edx
bsr r8w, r12w
mov qword [rcx + 0x8b8], 0
sar r8, cl
rcl r8w, 0xea
mov r8d, 0x100
jmp 0x14060806e
mov qword [rcx + 0x8c0], 0
xor esi, esi
clc
mov qword [rcx + 0x8c8], 0
mov dword [rcx + 0x8d0], 0
test r14b, 0x2c
mov qword [rcx + 0x8d4], 0
cmc
test r15b, r10b
clc
add rcx, 0x7a4
jmp 0x1406080b1
call fcn.1400258e4
xor edx, edx
mov r8b, r8b
mov dword [rdi + 0x8a4], esi
bswap ecx
movsxd rcx, r9d
jmp 0x1406080cb
mov r8d, 0x100
lea rcx, [rdi + 0x69c]
call fcn.1400258e4
sub edx, edx
setbe r8b
mov cl, 0x2d
movzx r8d, si
mov dword [rdi + 0x79c], esi
cmovo r8w, si
movsx r8w, spl
mov r8d, 0x100
bswap cx
lea rcx, [rdi + 0x598]
call fcn.1400258e4
sub edx, edx
mov dword [rdi + 0x698], esi
jmp 0x14060811f
mov r8d, 0x100
movsx ecx, bp
lea rcx, [rdi + 0x494]
call fcn.1400258e4
xor edx, edx
not rcx
movsx r8, r14w
mov dword [rdi + 0x594], esi
movsxd r8, edi
movzx r8w, r14b
movsx r8w, dil
mov r8d, 0x400
setae ch
movzx cx, r14b
lea rcx, [rdi + 0x90]
jmp 0x14060816a
call fcn.1400258e4
mov rbx, qword [rsp + 0x30]
clc
cmp cx, r11w
mov dword [rdi + 0x490], esi
mov qword [rdi + 0x7c], rsi
mov dword [rdi + 0x84], esi
mov qword [rdi + 0x88], rsi
cmp r9w, dx
clc
cmc
mov qword [rdi + 0x58], rsi
test r10b, 0x38
cmp r10d, 0x1b917e5c
mov qword [rdi + 0x60], rsi
cmp rax, rdi
stc
mov qword [rdi + 0x68], rsi
cmc
cmp r14w, r8w
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x34], rsi
cmp rax, 0x286c4bba
mov qword [rdi + 0x3c], rsi
clc
mov qword [rdi + 0x44], rsi
cmp r14w, bx
stc
mov qword [rdi + 0x4c], rsi
mov dword [rdi + 0x54], esi
cmc
test r12b, r9b
mov qword [rdi + 4], rsi
cmc
mov qword [rdi + 0xc], rsi
mov qword [rdi + 0x14], rsi
mov qword [rdi + 0x1c], rsi
mov qword [rdi + 0x24], rsi
cmp r10, 0x36f95298
mov qword [rdi + 0x2c], rsi
shrd si, di, 5
mov rsi, qword [rsp + 0x38]
test dil, 0xea
add rsp, 0x20
not edi
pop rdi
ret
Function at 0x1400039b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400039fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400039fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400039fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400039fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400039fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a00
xor al, al
add rsp, 0x28
ret

Function at 0x140008498
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400082c4

Function at 0x140014b50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014b78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014b78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400556c8
Capabilities:
Get token membership

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x28
lea rax, str.S_1_5_80_123231216_2592883651_3715271367_3753151631_4175906628
xor ecx, ecx
mov qword [rbp + 0x50], rax
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
cmp eax, 0x6bd
jne 0x1400556fa
xor ebx, ebx
jmp 0x1400558bf
test eax, eax
je 0x14005572c
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
mov r12d, 0x80004005
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
mov ecx, ebx
call fcn.140079c40
jmp 0x1400558bf
and dword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
call fcn.140069480
lea rdx, [0x140439858]
mov ebx, eax
lea rcx, [0x14041c6e8]
call fcn.1400edf70
test ebx, ebx
jns 0x140055771
mov ecx, ebx
call fcn.140079c40
lea rdx, [0x1404387d8]
lea rcx, [0x140423638]
call fcn.1400ed8ec
jmp 0x1400558b7
cmp dword [rbp + 0x38], 0
je 0x14005577e
xor ebx, ebx
jmp 0x1400558b7
cmp dword [0x14043f5e4], 0
je 0x1400558ab
xor r14d, r14d
lea r15, [rbp + 0x50]
mov r12d, 0x80004005
mov rcx, qword [r15]
lea rdx, [rbp + 0x48]
xor esi, esi
xor ebx, ebx
and qword [rbp + 0x48], rsi
and dword [rbp + 0x40], ebx
mov dword [rbp + 0x38], esi
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x1400557dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400557c6
mov ebx, r12d
jmp 0x1400557d4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.140079c40
jmp 0x1400557f7
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400557b7
mov esi, dword [rbp + 0x40]
mov dword [rbp + 0x38], esi
mov ecx, ebx
call fcn.140079c60
lea rcx, [rbp + 0x48]
call fcn.140069fec
test ebx, ebx
js 0x1400558ea
test esi, esi
jne 0x140055777
inc r14d
add r15, 8
cmp r14d, 1
jb 0x140055798
lea r8, [rbp + 0x38]
lea edx, [rsi + 0x12]
call fcn.14006f4bc
lea rdx, [0x14043a2a8]
mov ebx, eax
lea rcx, [0x14041d038]
call fcn.1400edc30
test ebx, ebx
js 0x1400558b0
cmp dword [rbp + 0x38], esi
jne 0x140055777
lea r8, [rbp + 0x38]
lea edx, [rsi + 0x13]
call fcn.14006f4bc
mov ebx, eax
test eax, eax
jns 0x14005586c
mov ecx, eax
jmp 0x1400558b2
cmp dword [rbp + 0x38], 0
jne 0x140055777
lea r8, [rbp + 0x38]
mov edx, SafeArrayUnaccessData
call fcn.14006f4bc
mov ebx, eax
test eax, eax
js 0x140055868
cmp dword [rbp + 0x38], 0
jne 0x140055777
lea rcx, [rbp + 0x38]
call fcn.1400554cc
test eax, eax
js 0x1400558ab
cmp dword [rbp + 0x38], 0
jne 0x140055777
mov ebx, 0xc004f025
mov ecx, ebx
call fcn.140079c40
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
mov ecx, ebx
call fcn.140079c60
lea rdx, [0x1404380e4]
lea rcx, [0x140426370]
call fcn.1400ed5b8
mov eax, ebx
add rsp, 0x28
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ecx, ebx
call fcn.140079c40
lea rdx, [0x14043975c]
lea rcx, [0x14042b828]
call fcn.1400ee2b8
jmp 0x1400558b7
Function at 0x14005ab54
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
and qword [rbp + 0x1f], 0
xorps xmm0, xmm0
and qword [rbp + 0x47], 0
mov rdi, rdx
mov rbx, rcx
movdqa xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x27], xmm0
lea rdx, [0x140439e70]
movdqa xmmword [rbp + 0x37], xmm1
lea rcx, [0x14041cc34]
call fcn.1400ed270
lea rax, [0x140004fd8]
mov qword [rbp - 0x29], 3
mov qword [rbp - 0x21], rax
lea rdx, [0x14043cb58]
lea rax, [rbp + 0x67]
mov qword [rbp - 9], rbx
mov qword [rbp - 0x19], rax
lea rcx, [0x1404176a8]
lea rax, [rbp + 7]
mov qword [rbp - 0x11], rax
call fcn.1400ee940
xor r9d, r9d
lea rdx, [rbp - 0x29]
mov ecx, 0xb9
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x67]
test ebx, ebx
jns 0x14005ac02
mov ecx, ebx
call fcn.140079c40
jmp 0x14005ac6b
lea rdx, [0x140436e78]
lea rcx, [0x1404222ac]
call fcn.1400ee5fc
mov rcx, qword [rbp + 0x37]
mov rdx, rdi
call fcn.140079b08
mov ebx, eax
test eax, eax
jns 0x14005ac2b
mov ecx, eax
jmp 0x14005abfb
mov rcx, qword [rbp + 0x3f]
lea rdx, [rdi + 8]
call fcn.140079b08
mov ebx, eax
test eax, eax
js 0x14005ac27
mov rcx, qword [rbp + 0x47]
lea rdx, [rdi + 0x10]
call fcn.140079b08
mov ebx, eax
test eax, eax
jns 0x14005ac6b
mov ecx, eax
call fcn.140079c40
lea rdx, [0x140439810]
lea rcx, [0x14042b968]
call fcn.1400eefd4
mov ecx, ebx
call fcn.140079c60
lea rcx, [rbp + 7]
call fcn.14005a810
lea rdx, [0x14043e328]
lea rcx, [0x140420d70]
call fcn.1400eec90
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005be9c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov r13, rdx
mov rdi, rcx
mov qword [rbp - 0x31], rbx
lea rdx, [0x14043c624]
mov esi, ebx
lea rcx, [0x14041f1ac]
mov r14d, ebx
mov r15, r9
mov r12, r8
call fcn.1400eefd4
xorps xmm1, xmm1
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
movups xmmword [rbp - 1], xmm1
movups xmmword [rbp + 0xf], xmm1
movups xmmword [rbp + 0x1f], xmm1
test r15, r15
jne 0x14005bf16
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140079c40
jmp 0x14005bffc
mov rbx, qword [0x14043f520]
lea rdx, [0x14043c708]
lea rcx, [0x14041f250]
lea rsi, [rbx + 8]
call fcn.1400ed270
test rsi, rsi
je 0x14005bf4a
mov r14d, 1
mov rcx, rsi
mov edx, r14d
call fcn.140072570
lea rax, [0x140002598]
mov qword [rbp + 0x1f], rdi
mov qword [rbp - 0x21], rax
lea rdx, [0x14043a08c]
lea rax, [rbp + 0x7f]
mov qword [rbp + 0x27], rbx
lea rcx, [0x1404147fc]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x29], 3
call fcn.1400ee5fc
xor r9d, r9d
lea rax, [rbp - 1]
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp - 0x31]
mov ecx, 0xb9
mov qword [rbp - 9], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x7f]
test ebx, ebx
js 0x14005bf0a
mov rbx, qword [rbp - 0x31]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea r9, [rbp - 0x39]
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
lea rdx, [0x14043d1dc]
mov ebx, eax
lea rcx, [0x14041fc98]
call fcn.1400eec90
test ebx, ebx
js 0x14005bf0a
mov eax, dword [rbp - 0x39]
mov dword [r15], eax
mov ecx, ebx
call fcn.140079c60
lea rdx, [0x14043b5ec]
lea rcx, [0x140425ff8]
call fcn.1400ee940
lea rcx, [rbp - 1]
call fcn.1400578a0
lea rcx, [rbp - 0x31]
call fcn.1400577f4
test rsi, rsi
je 0x14005c03a
test r14d, r14d
je 0x14005c03a
mov rcx, rsi
call fcn.14007240c
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140084e08
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140436b28]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rax, [0x140006698]
mov qword [rbp - 0x39], 3
mov qword [rbp - 0x31], rax
mov r12, rdx
lea rax, [rbp - 0x49]
mov rbx, rcx
lea rdx, [0x140438688]
mov qword [rbp - 0x29], rax
lea rcx, [0x14042345c]
mov r15, r9
mov r14, r8
call fcn.1400ed5b8
xor r9d, r9d
mov qword [rbp - 0x21], rbx
lea rax, [rbp + 0x17]
mov qword [rbp - 0x19], r12
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], rax
lea ebx, [r9 + 0x50]
mov r8d, ebx
lea ecx, [rbx + 0x69]
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp - 0x49]
xor edi, edi
test esi, esi
jns 0x140084ec0
mov ecx, esi
call fcn.140079c40
lea rdx, [0x140438ed8]
lea rcx, [0x140423cf0]
call fcn.1400edc30
jmp 0x140084fa6
lea rax, [0x140006018]
mov qword [rbp - 0x39], 3
mov qword [rbp - 0x31], rax
lea rdx, [0x14043c24c]
lea rax, [rbp - 0x45]
lea rcx, [0x14041ed1c]
mov qword [rbp - 0x29], rax
call fcn.1400ee2b8
lea rax, [rbp + 0x17]
mov qword [rbp - 0x21], r12
mov qword [rbp - 9], rax
lea rdx, [rbp - 0x39]
lea rax, [rbp - 0x41]
mov qword [rbp - 0x19], rdi
xor r9d, r9d
mov qword [rbp + 0xf], rax
mov r8, rbx
mov qword [rbp - 0x11], r14
mov ecx, 0xb9
mov dword [rbp - 1], edi
mov dword [rbp + 3], 1
mov qword [rbp + 7], rdi
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp - 0x45]
cmp ecx, 0xc004d304
je 0x140084fa3
mov esi, ecx
test ecx, ecx
jns 0x140084f44
call fcn.140079c40
jmp 0x140084fa6
mov ebx, dword [rbp - 0x41]
mov r12d, 0xfff
mov r14d, ebx
and r14d, 0xf000
cmp r14d, 0xc000
jne 0x140084f71
mov eax, ebx
and eax, r12d
sub eax, 0x401
cmp eax, 0x95
jbe 0x140084f9e
lea rdx, [0x14043cd80]
lea rcx, [0x140417948]
call fcn.1400ed8ec
cmp r14d, 0xc000
jne 0x140084fa3
and ebx, r12d
sub ebx, 0x497
cmp ebx, 0x169
ja 0x140084fa3
mov edi, 1
mov dword [r15], edi
mov ecx, esi
call fcn.140079c60
lea rdx, [0x14043a398]
lea rcx, [0x14041d0f4]
call fcn.1400edf70
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14037a9a0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret