joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401928a0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x20], r8
mov rsi, rcx
mov edi, edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea rcx, [0x140446508]
call fcn.140006c60
mov r14, rax
mov rcx, qword [0x1406ad0b8]
mov rdx, qword [rcx + 8]
lea rcx, [r14 + 8]
call fcn.140006e70
mov qword [rbp - 0x48], r14
test dil, dil
je 0x1401929c0
xor ecx, ecx
mov dword [rbp - 0x50], ecx
test rsi, rsi
je 0x140192920
mov qword [rbp + 0x10], rsi
lea rcx, [rsi + 0xc]
jmp 0x140192926
xor ecx, ecx
mov qword [rbp + 0x10], rsi
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x70], rcx
lea r8, [rbp - 0x50]
mov qword [rbp - 0x78], r8
mov edx, 0x20001009
mov dword [rbp - 0x64], edx
mov r9d, 4
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0xa8]
call fcn.1400070f0
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
mov edx, dword [rbp - 0x64]
mov r9d, dword [rbp - 0x68]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0xa8]
call fcn.140007140
xor ecx, ecx
mov qword [rbp - 0x58], rcx
mov edx, dword [rbp - 0x50]
test edx, edx
je 0x1401929b1
mov dword [rbp - 0x40], edx
mov rcx, qword [rbp - 0x48]
inc dword [rcx + 0x14]
mov rax, qword [rcx + 8]
mov r8d, dword [rcx + 0x10]
mov r10d, dword [rax + 8]
cmp r10d, r8d
jbe 0x1401929b7
lea r10d, [r8 + 1]
mov dword [rcx + 0x10], r10d
mov ecx, r8d
mov dword [rax + rcx*4 + 0x10], edx
mov rsi, qword [rbp + 0x10]
jmp 0x1401929c0
mov rsi, qword [rbp + 0x10]
jmp 0x1401929c0
call fcn.1402cd600
mov rsi, qword [rbp + 0x10]
xor r9d, r9d
test rsi, rsi
je 0x1401929ce
add rsi, 0xc
jmp 0x1401929d0
xor esi, esi
mov qword [rbp - 0x60], rsi
mov rdx, rsi
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x70], r9
lea rcx, [0x140191b30]
mov qword [rbp - 0x80], rcx
mov r8d, 0xffffffff
mov dword [rbp - 0x68], r8d
lea rcx, [rbp - 0xa8]
call fcn.1400070f0
mov rdx, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
mov r8d, dword [rbp - 0x68]
call sub.KERNEL32.dll_EnumCalendarInfoExEx
lea rcx, [rbp - 0xa8]
call fcn.140007140
xor eax, eax
mov qword [rbp - 0x60], rax
mov rbx, qword [rbp + 0x20]
mov ecx, dword [rbx + 8]
jmp 0x140192a68
mov rdx, qword [rbp - 0x48]
cmp eax, r8d
jae 0x140192a9b
mov r8, qword [rdx + 8]
cmp eax, dword [r8 + 8]
jae 0x140192aa1
mov edx, eax
movzx r8d, word [r8 + rdx*4 + 0x10]
cmp eax, ecx
jae 0x140192aa1
mov word [rbx + rdx*2 + 0x10], r8w
inc eax
mov edx, ecx
mov r8, qword [rbp - 0x48]
mov r8d, dword [r8 + 0x10]
mov r10d, r8d
cmp edx, r10d
jg 0x140192a99
mov r10d, edx
cmp eax, r10d
jl 0x140192a41
mov eax, r8d
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
jmp 0x140192a7d
call fcn.140184a20
int3
call fcn.14021ae50
int3
Function at 0x140198450
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
cmp dword [rbx + 0x198], 0xffffffff
jne 0x140198561
lea rsi, [0x1403e1438]
cmp qword [rsi - 8], 0
jne 0x14019857f
cmp byte [rsi], 0
jne 0x140198561
lea rdi, [0x1403e10a0]
cmp qword [rdi - 8], 0
jne 0x140198589
cmp byte [rdi], 0
jne 0x140198597
movzx r14d, byte [rbx + 0x1b8]
mov qword [rbp + 0x10], rbx
mov rax, rbx
test r14d, r14d
je 0x1401985ad
mov rcx, qword [rax + 8]
cmp byte [rax + 0x1b8], 0
je 0x1401985c6
xor edx, edx
or edx, 0x2000100c
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x140198578
add rcx, 0xc
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400070f0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140007140
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
inc eax
xor ecx, ecx
cmp eax, 6
cmovg eax, ecx
mov ecx, eax
mov rbx, qword [rbp + 0x10]
mov dword [rbx + 0x198], ecx
mov eax, dword [rbx + 0x198]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x1401984f9
call fcn.140001706
jmp 0x140198490
call fcn.140001488
cmp byte [rdi], 0
je 0x1401984b4
mov r14d, 1
mov rax, rbx
test r14d, r14d
mov qword [rbp + 0x10], rbx
jne 0x1401984cc
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
mov edx, 0x100c
call fcn.14019aa40
mov ecx, eax
mov qword [rbp + 0x10], rbx
jmp 0x140198557
mov edx, 0x80000000
jmp 0x1401984df
Function at 0x14019b0b0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x1406af028]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rbx, [rsp + 0x20]
test rcx, rcx
je 0x14019b16f
add rcx, 0xc
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rbx
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.1400070f0
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov esi, eax
lea rcx, [rbp + 8]
call fcn.140007140
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test esi, esi
jle 0x14019b176
mov rcx, rbx
call fcn.140157990
lea rcx, [0x1406af028]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x14019b15d
call fcn.1400074c0
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x14019b0f2
xor eax, eax
jmp 0x14019b148

Function at 0x14019b180
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x14019b1b6
add rcx, 0xc
jmp 0x14019b1b8
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400070f0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140007140
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14019b220
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov r8d, edx
or r8d, 0x80000000
cmp byte [rcx + 0x1b8], 0
cmove edx, r8d
mov rcx, qword [rcx + 8]
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x14019b2d0
add rcx, 0xc
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400070f0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140007140
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x14019b26d
Function at 0x14019b850
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x1406af028]
mov qword [rbp + 0x48], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0xb0
lea rsi, [rsp + 0x20]
lea rdi, [0x1403e10a0]
cmp qword [rdi - 8], 0
jne 0x14019ba8e
cmp byte [rdi], 0
jne 0x14019b950
mov rcx, rbx
call fcn.14019a3d0
test eax, eax
je 0x14019b94c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14019b945
add rcx, 0xc
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov r8, rsi
mov qword [rbp + 0x30], r8
mov edx, 0x5c
mov dword [rbp + 0x44], edx
mov r9d, 0x55
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.1400070f0
mov rcx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
mov edx, dword [rbp + 0x44]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov ebx, eax
lea rcx, [rbp + 8]
call fcn.140007140
xor eax, eax
mov qword [rbp + 0x50], rax
test ebx, ebx
setne bl
movzx ebx, bl
movzx eax, bl
lea rcx, [0x1406af028]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x14019b933
call fcn.1400074c0
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x14019b8c4
xor ebx, ebx
jmp 0x14019b91b
mov rcx, qword [rbx + 8]
mov r8, rsi
mov edx, 0x5c
mov r9d, 0x55
call fcn.14021b260
mov r8d, eax
test r8d, r8d
je 0x14019b94c
dec r8d
mov rcx, rsi
xor edx, edx
call fcn.140157a00
lea rcx, [rbx + 8]
mov rdx, rax
call fcn.140006e70
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov r8, rsi
mov edx, 0x20000071
mov r9d, 2
call fcn.14021b260
test eax, eax
je 0x14019b94c
cmp dword [rsi], 0
setne cl
mov byte [rbx + 0x1ba], cl
lea rcx, [rbx + 0x10]
mov rdx, rdi
call fcn.140006e70
cmp byte [rbx + 0x1ba], 0
je 0x14019ba0b
lea rcx, [rbx + 0x18]
mov rdx, rdi
call fcn.140006e70
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x55
call fcn.14021b370
mov r8d, eax
test r8d, r8d
jle 0x14019b94c
dec r8d
mov rcx, rsi
xor edx, edx
call fcn.140157a00
lea rcx, [rbx + 0x38]
mov rdx, rax
call fcn.140006e70
jmp 0x14019ba84
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.140006e70
lea rcx, [rbx + 0x18]
mov rdx, rdi
call fcn.140006e70
mov rcx, rdi
mov r8, rsi
mov edx, 0x20000001
mov r9d, 2
call fcn.14021b260
test eax, eax
je 0x14019b94c
mov ecx, dword [rsi]
mov dword [rbx + 0x1b4], ecx
mov ecx, dword [rbx + 0x1b4]
call fcn.140198dd0
test eax, eax
jne 0x14019ba84
mov rcx, rdi
mov edx, 0x5f
cmp dword [rcx], ecx
call fcn.14015bea0
test eax, eax
jle 0x14019ba84
mov rcx, rdi
mov r8d, eax
xor edx, edx
call fcn.14015b9c0
lea rcx, [rbx + 0x18]
mov rdx, rax
call fcn.140006e70
mov ebx, 1
jmp 0x14019b91b
call fcn.140001488
jmp 0x14019b89a
Function at 0x14019d9c0
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov dword [rbx + 0x178], 0xffffffff
mov dword [rbx + 0x17c], 0xffffffff
mov dword [rbx + 0x180], 0xffffffff
lea rcx, [rbx + 8]
mov rdx, rsi
call fcn.140006e70
lea rcx, [rbx + 0x90]
mov rdx, rdi
call fcn.140006e70
mov rcx, qword [rbx + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.14019da30

Function at 0x14019e100
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x184], 0
jne 0x14019e2b2
test rsi, rsi
je 0x14019e2d8
cmp rsi, qword [rbx + 0x90]
jne 0x14019e136
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
xor edi, edi
jmp 0x14019e185
mov rax, qword [rbx + 0x148]
test rax, rax
jne 0x14019e166
mov rcx, qword [rbx + 8]
cmp dword [rcx], ecx
call fcn.1401985e0
mov rbp, rax
lea rcx, [rbx + 0x148]
mov rdx, rbp
call fcn.140006e70
mov rax, rbp
cmp edi, dword [rax + 8]
jae 0x14019e316
mov ecx, edi
movzx ebp, word [rax + rcx*2 + 0x10]
mov rcx, rsi
mov rax, qword [rsi]
call qword [rax + 0x40]
cmp eax, ebp
je 0x14019e1bf
inc edi
mov rax, qword [rbx + 0x148]
test rax, rax
jne 0x14019e1b1
mov rcx, qword [rbx + 8]
cmp dword [rcx], ecx
call fcn.1401985e0
mov rbp, rax
lea rcx, [rbx + 0x148]
mov rdx, rbp
call fcn.140006e70
mov rax, rbp
cmp dword [rax + 8], edi
jle 0x14019e2e5
jmp 0x14019e13a
cmp qword [rbx + 0x90], 0
je 0x14019e27c
xor ecx, ecx
mov qword [rbx + 0x130], rcx
mov qword [rbx + 0x138], rcx
mov qword [rbx + 0x140], rcx
mov qword [rbx + 0x60], rcx
mov qword [rbx + 0xb0], rcx
mov qword [rbx + 0xa0], rcx
mov qword [rbx + 0xa8], rcx
mov qword [rbx + 0xc0], rcx
mov qword [rbx + 0xb8], rcx
mov qword [rbx + 0xc8], rcx
mov qword [rbx + 0xd0], rcx
mov qword [rbx + 0xd8], rcx
mov dword [rbx + 0x180], 0xffffffff
mov qword [rbx + 0x110], rcx
mov qword [rbx + 0x118], rcx
mov qword [rbx + 0x108], rcx
mov qword [rbx + 0x68], rcx
mov qword [rbx + 0xe0], rcx
mov qword [rbx + 0xe8], rcx
mov qword [rbx + 0xf0], rcx
mov qword [rbx + 0x98], rcx
mov qword [rbx + 0x48], rcx
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x170], rcx
mov dword [rbx + 0x180], 0xffffffff
lea rcx, [rbx + 0x90]
mov rdx, rsi
call fcn.140006e70
mov rsi, qword [rbx + 8]
mov rcx, qword [rbx + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.14019da30
lea rcx, [0x1403fde48]
call fcn.140006c60
mov rbx, rax
mov rcx, rbx
lea rdx, [0x1403abae0]
call fcn.14017c730
mov rcx, rbx
call fcn.140007bd0
lea rcx, [0x1403d3300]
call fcn.1401636d0
int3
lea rcx, [0x1403fc318]
call fcn.140006c60
mov rbx, rax
mov rcx, rbx
mov r8, rsi
lea rdx, [0x1403d3300]
lea r9, [0x1403b0400]
call fcn.1401637b0
mov rcx, rbx
call fcn.140007bd0
int3
call fcn.14021ae50
int3
Function at 0x1402108c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x40]
xorps xmm4, xmm4
movaps xmmword [rbp + 0x70], xmm4
xor eax, eax
mov qword [rbp + 0x80], rax
mov rax, qword [0x1406af028]
mov qword [rbp + 0x50], rax
mov rsi, rcx
mov rbx, rdx
mov edi, dword [rbx + 8]
shl edi, 2
cmp edi, 0x400
jge 0x140210952
mov edx, edi
mov r14, rdx
test r14, r14
je 0x140210948
mov rcx, r14
add rcx, 0xf
and rcx, 0xfffffffffffffff0
add rsp, 0x40
neg rcx
add rcx, rsp
jb 0x14021092a
xor ecx, ecx
test dword [rsp], esp
sub rsp, 0x1000
cmp rsp, rcx
jae 0x14021092a
mov rsp, rcx
test dword [rsp], esp
sub rsp, 0x40
lea r14, [rsp + 0x40]
test edi, edi
jl 0x140210ac4
jmp 0x140210968
movsxd rdx, edi
lea rcx, [0x14048bb60]
call fcn.140006d80
lea r14, [rax + 0x10]
mov edi, dword [rax + 8]
mov qword [rbp + 0x58], r14
mov qword [rbp + 0xd8], rbx
lea rcx, [rbx + 0xc]
mov qword [rbp + 0x80], rcx
mov r15, qword [rbp + 0x80]
xor r13d, r13d
test edi, edi
cmovne r13, r14
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x78], r13
lea rcx, [rbp]
call fcn.1400070f0
call sub.KERNEL32.dll_GetConsoleOutputCP
mov ebx, eax
lea rcx, [rbp]
call fcn.140007140
mov ecx, ebx
mov r8, r15
mov rbx, qword [rbp + 0xd8]
mov r9d, dword [rbx + 8]
mov r13, qword [rbp + 0x60]
mov rdx, r13
mov dword [rsp + 0x28], edi
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov dword [rbp + 0x4c], ecx
mov qword [rbp + 0x3c], r8
mov dword [rbp + 0x48], r9d
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rbp + 0x44], edx
lea rcx, [rbp]
call fcn.1400070f0
mov ecx, dword [rbp + 0x4c]
mov r8, qword [rbp + 0x3c]
mov r9d, dword [rbp + 0x48]
mov edx, dword [rbp + 0x44]
call sub.KERNEL32.dll_WideCharToMultiByte
mov ebx, eax
lea rcx, [rbp]
call fcn.140007140
xor ecx, ecx
mov qword [rbp + 0x78], rcx
mov qword [rbp + 0x80], rcx
test edi, edi
cmovne rcx, qword [rbp + 0x58]
mov qword [rbp + 0x70], rcx
mov rdi, rcx
lea r14, [rbp + 0x6c]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov qword [rbp + 0x3c], rcx
mov rdx, rdi
mov qword [rbp + 0x34], rdx
mov r8d, ebx
mov dword [rbp + 0x44], r8d
mov r9, r14
mov qword [rbp + 0x2c], r9
lea rcx, [rbp]
call fcn.1400070f0
mov rcx, qword [rbp + 0x3c]
mov rdx, qword [rbp + 0x34]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x2c]
call sub.KERNEL32.dll_WriteFile
lea rcx, [rbp]
call fcn.140007140
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
call fcn.140003a10
mov dword [rax + 0xe0], ebx
xor eax, eax
mov qword [rbp + 0x70], rax
lea rcx, [0x1406af028]
mov rcx, qword [rcx]
cmp qword [rbp + 0x50], rcx
je 0x140210aaf
call fcn.1400074c0
nop
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140184960
int3
Function at 0x14021b260
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x14021b289
add rcx, 0xc
jmp 0x14021b28b
xor ecx, ecx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x44], edx
mov qword [rbp - 0x58], r8
mov dword [rbp - 0x48], r9d
lea rcx, [rbp - 0x80]
call fcn.1400070f0
mov rcx, qword [rbp - 0x50]
mov edx, dword [rbp - 0x44]
mov r8, qword [rbp - 0x58]
mov r9d, dword [rbp - 0x48]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.140007140
mov eax, ebx
xor ecx, ecx
mov qword [rbp - 0x40], rcx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14021ba30
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x14021ba5c
add rcx, 0xc
mov rbx, rcx
jmp 0x14021ba5e
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.1400070f0
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.140007140
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
call fcn.140003a10
mov dword [rax + 0xe0], esi
movzx eax, bl
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14021c140
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov ebx, ecx
mov qword [rbp - 0x40], rdx
mov rsi, rdx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, ebx
mov dword [rbp - 0x44], ecx
mov rdx, rsi
mov qword [rbp - 0x4c], rdx
lea rcx, [rbp - 0x78]
call fcn.1400070f0
mov ecx, dword [rbp - 0x44]
mov rdx, qword [rbp - 0x4c]
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140007140
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140003a10
mov dword [rax + 0xe0], esi
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14021c690
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov ebx, edx
mov qword [rbp - 0x40], rcx
mov rsi, rcx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov edx, ebx
mov dword [rbp - 0x44], edx
lea rcx, [rbp - 0x78]
call fcn.1400070f0
mov rcx, qword [rbp - 0x4c]
mov edx, dword [rbp - 0x44]
call sub.KERNEL32.dll_GetSystemDirectoryW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140007140
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140003a10
mov dword [rax + 0xe0], esi
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14021ce00
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r14, r9
mov r15, qword [rbp + 0x38]
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
mov byte [rbp - 0x4c], 0
lea rcx, [0x1403dd9b8]
call fcn.140385990
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], r15
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
mov r9, r14
mov ebx, dword [rbp + 0x30]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x78], r9
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], r15
lea rcx, [rbp - 0xa0]
call fcn.1400070f0
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x78]
call sub.KERNEL32.dll_CreateThread
mov rbx, rax
lea rcx, [rbp - 0xa0]
call fcn.140007140
nop
xor eax, eax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x3c], 1
mov byte [rbp - 0x4c], 1
mov rax, qword [rbp - 0x58]
mov qword [rax + 8], rbx
mov rcx, rax
mov rax, rcx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14021cf50
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401f7160
mov rcx, qword [rbp - 0x48]
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x78]
call fcn.1400070f0
mov rcx, qword [rbp - 0x50]
call sub.KERNEL32.dll_ResumeThread
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140007140
nop
cmp byte [rbp - 0x40], 0
je 0x14021cfc1
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1401f71a0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret