joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098d84
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r12d, r12d
lea rax, [rbp - 0x49]
lea r9, [rbp - 0x41]
mov qword [rbp - 0x41], r12
lea r8, str.LicStatusArray
mov qword [rbp - 0x39], r12
lea rdx, [0x1403db940]
mov qword [rbp - 0x31], r12
mov dword [rbp + 7], r12d
mov r13, rcx
mov qword [rsp + 0x20], rax
call fcn.140098f8c
mov edi, eax
cmp eax, 0x80070002
jne 0x140098dfc
mov edi, r12d
jmp 0x140098f05
test eax, eax
jns 0x140098e0c
mov ecx, eax
call fcn.140082a8c
jmp 0x140098f05
mov ecx, dword [rbp - 0x49]
movabs rax, 0x2492492492492493
mul rcx
mov esi, ecx
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 5
imul rax, rsi, 0x38
sub rcx, rax
je 0x140098e3d
mov edi, 0x8007000d
mov ecx, edi
jmp 0x140098e02
mov rbx, qword [rbp - 0x41]
mov r14d, r12d
test esi, esi
je 0x140098ef9
mov r15d, dword [rbp - 0x49]
add rbx, 0x14
movups xmm0, xmmword [rbx - 0x14]
mov eax, dword [rbx]
mov ecx, dword [rbx - 4]
mov dword [rbp + 0xb], eax
mov rax, qword [rbx + 4]
mov qword [rbp + 0xf], rax
mov rax, qword [rbx + 0xc]
mov dword [rbp + 7], ecx
mov qword [rbp + 0x17], rax
movdqu xmmword [rbp - 9], xmm0
movups xmm0, xmmword [rbx + 0x14]
movdqu xmmword [rbp + 0x1f], xmm0
test ecx, ecx
js 0x140098e34
cmp ecx, 4
jge 0x140098e34
lea r8, [rbp - 0x49]
mov edi, r12d
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x39]
call fcn.140094d18
mov r12b, al
test al, al
jne 0x140098ec4
mov edx, dword [rbp - 0x49]
lea r8, [rbp - 9]
lea rcx, [rbp - 0x39]
call fcn.140097b74
mov edi, eax
test eax, eax
jns 0x140098ec4
mov ecx, eax
call fcn.140082a8c
jmp 0x140098ece
xor r15d, r15d
test r12b, r12b
sete r15b
mov ecx, edi
call fcn.140082b34
xor r12d, r12d
test edi, edi
js 0x140098e39
test r15d, r15d
je 0x140098e34
inc r14d
add rbx, 0x38
cmp r14d, esi
jb 0x140098e54
lea rdx, [rbp - 0x39]
mov rcx, r13
call fcn.140080ed8
cmp edi, 0x8007000d
mov ebx, r12d
cmovne ebx, edi
mov ecx, ebx
call fcn.140082b34
lea rcx, [rbp - 0x39]
call fcn.140098864
xor r9d, r9d
mov qword [rbp - 0x29], 3
lea rax, [0x14000f69c]
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp - 0x41]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 0x11], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140389660
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140098f8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
lea rax, [rbp - 0x18]
and qword [rbp - 8], rdi
mov r14, r9
mov r15, r8
mov qword [rbp - 0x10], rdi
xor ebx, ebx
mov qword [r11 - 0x48], rax
and qword [rbp - 0x18], rbx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140098ff1
mov rdi, qword [rbp - 0x18]
and qword [rbp - 0x18], rbx
xor esi, esi
mov qword [rbp - 0x10], rdi
jmp 0x140099006
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
lea rcx, [rbp - 0x18]
call fcn.140072b58
test esi, esi
js 0x1400990b7
and dword [rbp + 0x20], ebx
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov rdx, r15
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400990a9
test rbx, rbx
jne 0x14009907e
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x140099077
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140099021
mov esi, 0x8007000e
jmp 0x1400990b7
mov esi, 0x8000ffff
jmp 0x1400990b7
cmp dword [rbp - 0x20], 3
je 0x14009908b
mov esi, 0x8007000d
jmp 0x1400990b7
mov qword [r14], rbx
xor ecx, ecx
call fcn.140082b34
mov rcx, qword [rbp + 0x40]
xor esi, esi
xor ebx, ebx
test rcx, rcx
je 0x1400990be
mov eax, dword [rbp + 0x20]
mov dword [rcx], eax
jmp 0x1400990be
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
test rbx, rbx
je 0x1400990de
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 8]
call fcn.140072b58
lea rcx, [rbp - 0x10]
call fcn.140072b58
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140099398
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x270
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor eax, eax
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x20], rax
lea rcx, str.systemroot
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140099401
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400993ee
mov esi, 0x80004005
jmp 0x1400994fd
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1400994fd
lea rdx, [rsp + 0x50]
lea rcx, str.windir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140099447
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400993e4
movzx esi, ax
lea rdx, [0x14044eab8]
or esi, 0x80070000
lea rcx, [0x14042f168]
test eax, eax
cmovle esi, eax
call fcn.1400f8590
jmp 0x1400994fd
lea rcx, [rsp + 0x20]
call fcn.1400998c8
mov esi, eax
test eax, eax
jns 0x14009945e
mov ecx, eax
jmp 0x1400994ff
lea rax, str.SPPSvc
xor esi, esi
and qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x28]
and qword [rsp + 0x40], rsi
mov qword [rsp + 0x28], rax
lea rax, [0x140099aa0]
mov qword [rsp + 0x30], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x1400994df
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14044aec8]
mov ebx, eax
lea rcx, [0x140433800]
call fcn.1400f7eec
test ebx, ebx
jne 0x1400994b7
mov esi, 0x80004005
jmp 0x1400994d8
lea rdx, [0x14044f048]
lea rcx, [0x140427744]
call fcn.1400f823c
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
mov ecx, esi
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
test esi, esi
jns 0x140099504
lea rdx, [0x140450588]
lea rcx, [0x140430aa8]
call fcn.1400f6768
mov ecx, esi
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
cmp dword [rsp + 0x20], 0
je 0x14009954c
cmp qword [0x140452610], 0
je 0x14009954c
mov rbx, qword [0x1404528b0]
test rbx, rbx
je 0x14009954c
mov rax, qword [0x1403cf6d0]
mov rcx, qword [0x140452618]
call rax
mov rax, qword [0x140452618]
mov rcx, rbx
call rax
and qword [0x1404528b0], 0
cmp dword [rsp + 0x24], 0
je 0x14009956c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
lea rdx, [0x14044df5c]
lea rcx, [0x14042657c]
call fcn.1400f7b8c
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140389660
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rsi
ret
Function at 0x1400a6a34
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
xor edi, edi
lea rax, [r11 - 0x30]
mov r14, r9
mov qword [r11 - 0x28], rdi
mov rbp, r8
mov qword [r11 - 0x30], rdi
xor r8d, r8d
mov qword [r11 - 0x48], rax
lea r9d, [rdi + 1]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a6a8e
mov rsi, qword [rsp + 0x38]
mov ebx, edi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
jmp 0x1400a6aa6
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.140082a8c
mov rsi, rdi
mov ecx, ebx
call fcn.140082b34
lea rcx, [rsp + 0x38]
call fcn.140072b58
test ebx, ebx
jns 0x1400a6ac4
mov ecx, ebx
call fcn.140082a8c
jmp 0x1400a6b08
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400a6b00
cmp eax, 2
je 0x1400a6b05
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400a6abb
mov edi, 1
mov dword [r14], edi
mov ecx, ebx
call fcn.140082b34
lea rcx, [rsp + 0x40]
call fcn.140072b58
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ab92c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
or qword [rsp + 0x48], 0xffffffffffffffff
xor edi, edi
mov qword [rsp + 0x40], rdi
mov r14, r8
mov r15, rdx
test rcx, rcx
jne 0x1400ab960
mov ecx, 0x80070057
mov edi, ecx
jmp 0x1400aba53
test r15, r15
je 0x1400ab954
test r14, r14
je 0x1400ab954
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400aba32
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x48], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400aba32
cmp dword [rsp + 0x80], edi
jne 0x1400ab954
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400aba28
lea r9, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov r8d, esi
mov qword [rsp + 0x20], rdi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400aba32
cmp dword [rsp + 0x98], esi
je 0x1400aba1b
mov ecx, 0x8000ffff
jmp 0x1400ab959
mov dword [r15], esi
mov qword [rsp + 0x40], rdi
mov qword [r14], rbx
jmp 0x1400aba58
mov ecx, 0x8007000e
jmp 0x1400ab959
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400aba43
mov edi, 0x80004005
jmp 0x1400aba51
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
lea rcx, [rsp + 0x40]
call fcn.1400a4bf0
lea rcx, [rsp + 0x48]
call fcn.14007f49c
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b4f54
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r15d, r15d
mov r14, r8
mov qword [rbp - 0x10], r15
mov ebx, r15d
mov qword [rbp - 0x20], rbx
mov rsi, rdx
mov qword [rbp - 0x18], r15
mov rdi, rcx
cmp rcx, 0xffffffff80000001
jne 0x1400b4f97
xor ecx, ecx
call fcn.140082b34
lea rax, [rbp + 0x30]
mov qword [rbp + 0x30], r15
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b4fd1
mov rbx, qword [rbp + 0x30]
mov edi, r15d
mov qword [rbp - 0x20], rbx
mov rsi, rbx
mov qword [rbp + 0x30], r15
jmp 0x1400b4fe9
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.140082a8c
mov rsi, r15
mov ecx, edi
call fcn.140082b34
lea rcx, [rbp + 0x30]
call fcn.140072b58
test edi, edi
js 0x1400b5047
xor ecx, ecx
call fcn.140082b34
mov eax, dword [rbp + 0x50]
test rbx, rbx
mov dword [rsp + 0x28], eax
mov r9d, 4
cmove rsi, r15
lea rax, [rbp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400b5039
mov edi, r15d
jmp 0x1400b504e
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
lea rcx, [rbp - 0x18]
call fcn.140078854
lea rcx, [rbp - 0x10]
call fcn.140072b58
lea rcx, [rbp - 0x20]
call fcn.140072b58
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b72b4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
and dword [rbp - 0x40], 0
lea rax, [0x14001bcdc]
and dword [rbp - 0x3c], 0
lea rdx, [rbp - 0x30]
and qword [rbp - 0x38], 0
mov rsi, r9
and qword [rbp - 0x18], 0
xor r9d, r9d
mov qword [rbp - 0x28], rax
mov ecx, 0xb9
lea rax, [rbp + 0x28]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x40]
lea r8d, [r9 + 0x30]
mov qword [rbp - 0x10], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x28]
test ebx, ebx
jns 0x1400b7324
mov ecx, ebx
jmp 0x1400b73a1
xor edi, edi
cmp dword [rbp - 0x3c], edi
jle 0x1400b738d
movsxd rbx, edi
shl rbx, 7
add rbx, qword [rbp - 0x38]
mov rcx, rbx
lea rdx, [rbx + 0x68]
call fcn.1400b982c
lea rax, [0x14001b99c]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x20], rax
xor r9d, r9d
lea rax, [rbx + 0x60]
mov ecx, 0xb9
mov qword [rbp - 0x10], rax
lea rax, [rbx + 0x58]
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x30]
call sub.ntdll.dll_NtQuerySystemInformation
inc edi
cmp edi, dword [rbp - 0x3c]
jl 0x1400b732b
lea r8, [rbp - 0x40]
mov rdx, rsi
call fcn.1400c07a4
mov ebx, eax
test eax, eax
jns 0x1400b73a6
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1400cccac
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x1400b73d5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c0128
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp - 8], rax
xor r15d, r15d
mov dword [rbp - 0x38], 0x73006d
mov ebx, r15d
mov dword [rbp - 0x34], 0x740066
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rbx
mov r8, rcx
mov dword [rbp - 0x30], 0x73003a
mov rsi, rdx
mov dword [rbp - 0x2c], 0x700070
mov r9, rcx
mov dword [rbp - 0x28], 0x63002f
mov dword [rbp - 0x24], 0x630061
sub r8, rax
mov dword [rbp - 0x20], 0x650068
mov dword [rbp - 0x1c], 0x740073
mov dword [rbp - 0x18], 0x72006f
mov dword [rbp - 0x14], 0x2f0065
mov dword [rbp - 0x10], 0x730025
mov word [rbp - 0xc], r15w
mov dword [rbp - 0x50], 0x6d0048
mov dword [rbp - 0x4c], 0x630061
mov dword [rbp - 0x48], 0x65004b
mov dword [rbp - 0x44], 0x79
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1400c01e5
add rax, 2
test edx, edx
jne 0x1400c01d1
test ecx, ecx
jne 0x1400c01f7
mov edi, 0x80070057
mov ecx, edi
call fcn.140082a8c
jmp 0x1400c0221
mov r8, r9
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x40]
call fcn.140081d18
mov edi, eax
test eax, eax
jns 0x1400c021a
mov ecx, eax
call fcn.140082a8c
mov rbx, qword [rbp - 0x40]
jmp 0x1400c0221
mov rax, qword [rbp - 0x40]
mov qword [rsi], rax
mov ecx, edi
call fcn.140082b34
test rbx, rbx
je 0x1400c0249
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140389660
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c8a5c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x50], 0
mov r12, r8
and qword [rbp - 0x58], 0
lea r8, [rbp - 0x50]
mov r13d, edx
mov r15, r9
lea rdx, [rbp - 0x60]
call fcn.1400ce4ec
mov ebx, eax
test eax, eax
jns 0x1400c8aab
mov ecx, eax
jmp 0x1400c8b3e
mov ebx, 0x20
mov edx, ebx
lea ecx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400c8b37
mov r14, qword [rbp - 0x50]
lea r8d, [rbx + 0x1c]
mov edi, dword [rbp - 0x60]
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x58], rax
lea ecx, [r8 + 0x7d]
lea rax, [0x14001ed9c]
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x5c]
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x48], 3
mov dword [rbp - 0x30], r13d
mov qword [rbp - 0x2c], r12
mov dword [rbp - 0x18], ebx
mov qword [rbp - 0x14], rsi
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp - 0x5c]
test ebx, ebx
js 0x1400c8b3c
xor eax, eax
mov dword [r15], 0x20
and qword [rbp - 0x58], rax
mov ecx, edi
mov rdi, r14
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x50]
mov qword [rax], rsi
jmp 0x1400c8b43
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
lea rcx, [rbp - 0x58]
call fcn.140061a14
lea rcx, [rbp - 0x50]
call fcn.140061a14
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400ca174
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or qword [rsp + 0x68], 0xffffffffffffffff
xor ebx, ebx
mov rsi, r8
mov edi, edx
test rcx, rcx
jne 0x1400ca19e
mov ecx, 0x80070057
mov ebx, ecx
jmp 0x1400ca21d
mov qword [rsp + 0x30], rbx
mov r8d, 2
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400ca1fc
lea r9, [rsp + 0x50]
mov qword [rsp + 0x68], rcx
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400ca1fc
cmp dword [rsp + 0x50], edi
je 0x1400ca222
mov ecx, 0x8000ffff
jmp 0x1400ca19a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400ca20d
mov ebx, 0x80004005
jmp 0x1400ca21b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
lea rcx, [rsp + 0x68]
call fcn.14007f49c
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400cefac
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x48
xor r9d, r9d
mov qword [r11 - 0x10], rcx
lea rax, [0x140020adc]
mov qword [r11 - 0x28], 3
mov qword [r11 - 0x20], rax
lea rdx, [r11 - 0x28]
lea rax, [r11 + 8]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [r11 - 0x18], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x1400cf888
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
xor ebx, ebx
and dword [rbp - 0x24], esi
mov r15, r8
and dword [rbp - 0x28], esi
mov r14, rdx
and qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x38], rbx
test ecx, ecx
je 0x1400cf909
cmp ecx, 1
je 0x1400cf8cc
mov ecx, 0x80070057
mov edi, ecx
jmp 0x1400cf9c9
lea rax, [0x140021b1c]
mov qword [rbp - 0x20], 3
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
xor r9d, r9d
lea rax, [rbp + 0x30]
mov qword [rbp - 0x10], rax
mov ecx, 0xb9
lea rax, [rbp - 0x40]
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x30]
jmp 0x1400cf944
lea rax, [0x140021e5c]
mov qword [rbp - 0x20], 3
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
xor r9d, r9d
lea rax, [rbp + 0x48]
mov qword [rbp - 0x10], rax
mov ecx, 0xb9
lea rax, [rbp - 0x40]
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x48]
mov edi, ecx
test ecx, ecx
js 0x1400cf9c9
lea rdx, [rbp - 0x38]
mov rcx, r14
call fcn.14005739c
mov edi, eax
test eax, eax
jns 0x1400cf969
mov ecx, eax
call fcn.140082a8c
mov rbx, qword [rbp - 0x38]
jmp 0x1400cf9ce
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.140071f58
mov edi, eax
test eax, eax
jns 0x1400cf989
mov ecx, eax
call fcn.140082a8c
mov rsi, qword [rbp - 0x30]
jmp 0x1400cf963
mov rbx, qword [rbp - 0x38]
lea rcx, [rbp - 0x30]
mov rdx, rbx
call fcn.140071ee4
mov edi, eax
test eax, eax
jns 0x1400cf9ac
mov ecx, eax
call fcn.140082a8c
mov rsi, qword [rbp - 0x30]
jmp 0x1400cf9ce
mov rsi, qword [rbp - 0x30]
mov r8d, 0x7fffffff
mov rcx, rsi
mov rdx, r15
call fcn.140072514
mov edi, eax
test eax, eax
jns 0x1400cf9ce
mov ecx, eax
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
test rbx, rbx
je 0x1400cf9e3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400cf9f7
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rbp - 0x40], 0
test rsi, rsi
je 0x1400cfa10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x98]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d147c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
lea rax, [rbp - 0x18]
and qword [rbp - 8], rdi
mov r14, r9
mov r15, r8
mov qword [rbp - 0x10], rdi
xor ebx, ebx
mov qword [r11 - 0x48], rax
and qword [rbp - 0x18], rbx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d14e1
mov rdi, qword [rbp - 0x18]
and qword [rbp - 0x18], rbx
xor esi, esi
mov qword [rbp - 0x10], rdi
jmp 0x1400d14f6
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
lea rcx, [rbp - 0x18]
call fcn.140072b58
test esi, esi
js 0x1400d15af
and dword [rbp + 0x20], ebx
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov rdx, r15
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d15a1
test rbx, rbx
jne 0x1400d156e
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x1400d1567
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400d1511
mov esi, 0x8007000e
jmp 0x1400d15af
mov esi, 0x8000ffff
jmp 0x1400d15af
cmp dword [rbp - 0x20], 1
je 0x1400d157b
mov esi, 0x8007000d
jmp 0x1400d15af
mov edx, dword [rbp + 0x20]
lea r9, [rbp - 0x1c]
mov r8, r14
mov rcx, rbx
call fcn.140081470
mov esi, eax
test eax, eax
jns 0x1400d1597
mov ecx, eax
jmp 0x1400d15b1
cmp dword [rbp - 0x1c], 0
je 0x1400d15b6
xor ebx, ebx
jmp 0x1400d15b6
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
test rbx, rbx
je 0x1400d15d6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 8]
call fcn.140072b58
lea rcx, [rbp - 0x10]
call fcn.140072b58
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret