joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140112540
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
mov qword [rcx + 0x18f30], rdx
jne 0x140112677
mov qword [rsp + 0x38], rsi
lea rcx, [0x14028e640]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
je 0x140112601
xor esi, esi
mov qword [rsp + 0x30], rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r8d, [rsi + 0xa]
mov rcx, rdi
lea rdx, [rsp + 0x30]
mov dword [rax], esi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
movsxd rsi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x22
je 0x140112601
test esi, esi
js 0x140112601
mov rax, qword [rsp + 0x30]
cmp rax, rdi
je 0x140112601
movzx ecx, byte [rax]
test cl, cl
je 0x1401125e2
movsx ecx, cl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x140112601
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
movzx ecx, byte [rax]
test cl, cl
jne 0x1401125c1
cmp esi, 0xffffffff
je 0x140112601
mov rdx, rsi
mov rcx, rbx
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
jmp 0x140113080
movabs rax, 0x10000000000
mov qword [rbx + 0x2ef0], 0x3ff
bsr rcx, rax
mov r9d, 1
movabs rax, 0xffffffffff
add cl, 0xfd
mov edx, r9d
shl rdx, cl
add rax, rdx
lea r8, [rdx - 1]
not r8
and r8, rax
mov qword [rbx], r8
jne 0x14011264b
lea eax, [r9 - 2]
jmp 0x14011264f
bsr rax, r8
mov rsi, qword [rsp + 0x38]
mov ecx, eax
mov rdi, qword [rsp + 0x40]
shl r9, cl
lea ecx, [rax - 3]
sub r8, r9
lea eax, [rax*8 - 0xb8]
shr r8, cl
add eax, r8d
cdqe
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
movabs rax, 0x10000000000
mov r9, rdx
mov r10, rcx
cmp rdx, rax
ja 0x1401130ff
mov r8d, 0x800000
mov r11d, 1
cmp rdx, r8
jb 0x1401130c4
bsr rcx, rdx
mov edx, r11d
lea r8, [r9 - 1]
add cl, 0xfd
shl rdx, cl
add r8, rdx
lea rax, [rdx - 1]
not rax
and r8, rax
mov qword [r10], r8
mov qword [r10 + 0x2ef0], 0x3ff
test r8, r8
jne 0x1401130dd
lea eax, [r8 - 1]
jmp 0x1401130e1
bsr rax, r8
mov ecx, eax
shl r11, cl
lea ecx, [rax - 3]
sub r8, r11
lea eax, [rax*8 - 0xb8]
shr r8, cl
add eax, r8d
cdqe
mov qword [r10 + 8], rax
ret
Function at 0x140117d00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
lea rcx, [fcn.140117d00]
xor rax, rcx
xor rax, rbx
mov r8, rax
shr r8, 0x11
xor r8, rax
and r8d, 0xf
add r8, 1
je 0x140117d7c
movabs r9, 0xbf58476d1ce4e5b9
movabs r10, 0x94d049bb133111eb
nop
mov rcx, rax
shr rcx, 0x1e
xor rcx, rax
imul rcx, r9
mov rdx, rcx
shr rdx, 0x1b
xor rdx, rcx
imul rdx, r10
mov rax, rdx
shr rax, 0x1f
xor rax, rdx
sub r8, 1
jne 0x140117d50
add rsp, 0x20
pop rbx
ret

Function at 0x140119170
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140119190
mov qword [0x14035b2a0], rax
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14011919f
mov qword [0x14035b2a8], rax
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1401191f0
lea rdx, str.VirtualAlloc2FromApp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404403b0], rax
test rax, rax
jne 0x1401191e7
lea rdx, str.VirtualAlloc2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404403b0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140119225
lea rdx, str.NtAllocateVirtualMemoryEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x1404403b8], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 5
call fcn.14011ac90
test al, al
jne 0x140119241
mov ecx, 6
call fcn.14011ac90
test al, al
je 0x140119246
call fcn.140119b80
add rsp, 0x50
pop rbx
ret
Function at 0x14011a360
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
xor r15d, r15d
lea rsi, [0x14035b2b0]
mov ebp, r15d
lea r14d, [r15 + 0xe]
lea r12d, [r15 + 0x40]
nop
cmp dword [rsi + 4], r15d
jne 0x14011a4dd
mov r8, r12
mov byte [rsp + 0x20], r15b
lea rdx, str.mimalloc_
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
mov r8, r12
mov byte [rsp + 0x60], r15b
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 0x41
mov byte [rsp + 0x60], r15b
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], r15b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x14011a4d6
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r15b
jne 0x14011a406
cmp rbx, 0x41
mov rdi, r15
cmovae rbx, r12
test rbx, rbx
je 0x14011a437
nop
movsx ecx, byte [rsp + rdi + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsp + rdi + 0x20], al
inc rdi
cmp rdi, rbx
jb 0x14011a420
mov byte [rsp + rbx + 0x20], r15b
cmp byte [rsp + 0x20], r15b
je 0x14011a523
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x14011a523
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x14011a483
mov dword [rsi], r15d
mov dword [rsi + 4], 2
jmp 0x14011a4dd
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xf0]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rcx, qword [rsp + 0xf0]
cmp byte [rcx], r15b
jne 0x14011a4c1
mov dword [rsi], eax
mov dword [rsi + 4], 2
jmp 0x14011a4dd
mov rdx, qword [rsi + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.14011a660
mov dword [rsi + 4], 1
cmp rbp, 2
je 0x14011a4f6
mov r8d, dword [rsi]
lea rcx, str.option__s:__ld_n
mov rdx, qword [rsi + 0x10]
call fcn.14011a540
inc rbp
add rsi, 0x18
sub r14, 1
jne 0x14011a390
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov dword [rsi], 1
mov dword [rsi + 4], 2
jmp 0x14011a4dd
Function at 0x14011a7c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rsi, rcx
mov byte [rsp + 0x20], 0
mov edi, 0x40
lea rdx, str.mimalloc_
mov r8d, edi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
mov r8d, edi
mov byte [rsp + 0x60], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea r8d, [rdi + 1]
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x14011a93f
mov qword [rsp + 0xd8], rbx
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14011a847
cmp rbx, 0x41
cmovae rbx, rdi
xor edi, edi
test rbx, rbx
je 0x14011a877
nop
movsx ecx, byte [rsp + rdi + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsp + rdi + 0x20], al
inc rdi
cmp rdi, rbx
jb 0x14011a860
mov byte [rsp + rbx + 0x20], 0
cmp byte [rsp + 0x20], 0
mov rbx, qword [rsp + 0xd8]
je 0x14011a957
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x14011a957
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x14011a8dd
mov dword [rsi], 0
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rcx, qword [rsp + 0xd0]
cmp byte [rcx], 0
jne 0x14011a92a
mov dword [rsi], eax
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov rdx, qword [rsi + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.14011a660
mov dword [rsi + 4], 1
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov dword [rsi], 1
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x14011aab0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xc0
movsxd rax, ecx
lea rcx, [rax + rax*2]
lea rax, [0x14035b2b0]
cmp dword [rax + rcx*8 + 4], 0
lea rbx, [rax + rcx*8]
jne 0x14011ac76
mov qword [rsp + 0xd0], rsi
lea rdx, str.mimalloc_
mov esi, 0x40
mov byte [rsp + 0x20], 0
mov r8d, esi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8d, esi
mov byte [rsp + 0x60], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea r8d, [rsi + 1]
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x14011ac51
mov qword [rsp + 0xe0], rdi
lea rax, [rsp + 0x70]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x14011ab55
cmp rdi, 0x41
cmovae rdi, rsi
xor esi, esi
test rdi, rdi
je 0x14011ab87
nop dword [rax]
movsx ecx, byte [rsp + rsi + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsp + rsi + 0x20], al
inc rsi
cmp rsi, rdi
jb 0x14011ab70
mov byte [rsp + rdi + 0x20], 0
cmp byte [rsp + 0x20], 0
mov rdi, qword [rsp + 0xe0]
je 0x14011ac6b
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x14011ac6b
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x14011abef
mov dword [rbx], 0
mov eax, dword [rbx]
mov rsi, qword [rsp + 0xd0]
mov dword [rbx + 4], 2
add rsp, 0xc0
pop rbx
ret
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xd8]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rcx, qword [rsp + 0xd8]
cmp byte [rcx], 0
jne 0x14011ac3c
mov rsi, qword [rsp + 0xd0]
mov dword [rbx], eax
mov dword [rbx + 4], 2
add rsp, 0xc0
pop rbx
ret
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.14011a660
mov eax, dword [rbx]
mov rsi, qword [rsp + 0xd0]
mov dword [rbx + 4], 1
add rsp, 0xc0
pop rbx
ret
mov dword [rbx], 1
jmp 0x14011abd5
mov eax, dword [rbx]
add rsp, 0xc0
pop rbx
ret
Function at 0x14011ad40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x40
movsd xmm0, qword [0x140440400]
movaps xmmword [rsp + 0x30], xmm6
xorps xmm6, xmm6
ucomisd xmm0, xmm6
jp 0x14011ae0a
jne 0x14011ae0a
lea rcx, [rsp + 0x50]
movaps xmmword [rsp + 0x20], xmm7
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [0x140440408]
comisd xmm6, xmm0
mov rbx, qword [rsp + 0x50]
jb 0x14011ada6
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x58]
movsd qword [0x140440408], xmm0
xorps xmm7, xmm7
lea rcx, [rsp + 0x50]
cvtsi2sd xmm7, rbx
divsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140440408]
comisd xmm6, xmm1
mov rbx, qword [rsp + 0x50]
jb 0x14011aded
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x58]
movsd qword [0x140440408], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
subsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x20]
movsd qword [0x140440400], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140440408]
mov rbx, qword [rsp + 0x50]
comisd xmm6, xmm1
movaps xmm6, xmmword [rsp + 0x30]
jb 0x14011ae4a
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x58]
movsd qword [0x140440408], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
add rsp, 0x40
pop rbx
ret
Function at 0x14011c120
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
call fcn.14011c500
lea rbx, [0x14043a150]
mov rcx, qword [rax]
add rcx, 0x88
cmp rcx, rbx
je 0x14011c153
xor edx, edx
mov r8d, 0x240
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x240
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
movsd xmm0, qword [0x140440400]
xorps xmm6, xmm6
ucomisd xmm0, xmm6
jp 0x14011c222
jne 0x14011c222
lea rcx, [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm7
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [0x140440408]
comisd xmm6, xmm0
mov rbx, qword [rsp + 0x60]
jb 0x14011c1be
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x68]
movsd qword [0x140440408], xmm0
xorps xmm7, xmm7
lea rcx, [rsp + 0x70]
cvtsi2sd xmm7, rbx
divsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140440408]
comisd xmm6, xmm1
mov rbx, qword [rsp + 0x70]
jb 0x14011c205
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x78]
movsd qword [0x140440408], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
subsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
movsd qword [0x140440400], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140440408]
mov rbx, qword [rsp + 0x20]
comisd xmm6, xmm1
movaps xmm6, xmmword [rsp + 0x40]
jb 0x14011c262
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x28]
movsd qword [0x140440408], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
movsd qword [0x1404403f8], xmm0
add rsp, 0x50
pop rbx
ret
Function at 0x140122550
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x1401225e0]
mov ecx, 0x13
call fcn.14014a4d0
mov ecx, 0x40
call fcn.14011e8b0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14012259a
lea rdx, [rax + 0xd]
mov dword [rax + 8], 0x28
mov qword [rax], rdx
mov byte [rax + 0xc], 0
mov dword [rax + 0x38], 0
mov byte [rdx], 0
mov qword [0x1404404a0], rax
test rax, rax
jne 0x1401225b2
mov dword [rbx], 7
add rsp, 0x20
pop rbx
ret
lea rcx, str.ICU_TIMEZONE_FILES_DIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rcx, [0x14028b96b]
mov rdx, rbx
test rax, rax
cmovne rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140122680
push rbx
sub rsp, 0x30
cmp dword [rdx], 0
mov rbx, rdx
jg 0x140122706
mov rax, qword [0x1404404a0]
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rax + 0x38], 0
mov rax, qword [rax]
mov byte [rax], 0
call fcn.14014d750
mov rcx, qword [0x1404404a0]
mov r9, rbx
movups xmm1, xmmword [rax]
movdqa xmm0, xmm1
movq rdx, xmm1
psrldq xmm0, 8
movd r8d, xmm0
call fcn.1401550b0
mov rax, qword [0x1404404a0]
mov edx, 0x2f
mov rcx, qword [rax]
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
je 0x140122706
nop
mov edx, 0x2f
mov byte [rax], 0x5c
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
jne 0x1401226f0
add rsp, 0x30
pop rbx
ret

Function at 0x140122a80
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0xa0
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [0x1404404a8]
xor edi, edi
mov dword [rsp + 0x20], edi
test rax, rax
jne 0x140122bb5
mov qword [rsp + 0xb0], rbx
lea r9d, [rdi + 0x55]
lea rbx, [0x1404404c0]
xor ecx, ecx
mov r8, rbx
lea edx, [rdi + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x140122b91
xor edx, edx
lea r8d, [rdi + 0x55]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, edi
mov ecx, edi
nop
lea rdx, [rsp + 0x30]
add rdx, rcx
cmp word [rbx + rcx*2], 0x5f
jne 0x140122b04
mov byte [rdx], 0x2d
jmp 0x140122b0a
movzx eax, byte [rbx + rcx*2]
mov byte [rdx], al
cmp byte [rdx], dil
je 0x140122b1b
inc r8d
inc rcx
cmp rcx, 0x55
jl 0x140122af0
movzx eax, byte [rsp + 0x84]
cmp r8d, 0x55
mov ecx, 0x41
cmovge eax, edi
mov byte [rsp + 0x84], al
call fcn.14014a6b0
mov rbx, rax
test rax, rax
je 0x140122b91
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140123c70
cmp dword [rsp + 0x20], edi
jg 0x140122b89
movsxd rcx, eax
lea rdx, [0x1401225e0]
mov qword [0x1404404a8], rbx
mov byte [0x1404404b0], 1
mov byte [rcx + rbx], dil
mov ecx, 0x13
call fcn.14014a4d0
jmp 0x140122b91
mov rcx, rbx
call fcn.14014a680
mov rcx, qword [0x1404404a8]
lea rax, str.en_US
mov rbx, qword [rsp + 0xb0]
test rcx, rcx
cmovne rax, rcx
mov qword [0x1404404a8], rax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140250070
add rsp, 0xa0
pop rdi
ret
Function at 0x1401496f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r15
sub rsp, 0x28
cmp dword [r8], 0
mov r15d, edx
mov rbx, rcx
jg 0x1401498a1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
cmp edx, dword [rcx + 0x270]
jl 0x140149742
mov ebp, dword [rcx + 0x11c]
mov r14d, dword [rcx + 0x124]
mov esi, dword [rcx + 0x120]
mov edi, dword [rcx + 0x118]
jmp 0x1401497fc
lea esi, [rdx - 0x1a4450]
mov edx, 0x5b5
movd xmm0, esi
lea r8, [rsp + 0x50]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1402c1460]
addsd xmm0, qword [0x1402c1470]
call fcn.140195020
mov edx, 4
mov edi, eax
lea ecx, [rax - 1]
call fcn.140195000
imul ecx, edi, 0x16d
xor edx, edx
mov r8d, edi
and r8d, 3
sub esi, ecx
sub esi, eax
mov eax, r8d
add esi, 0x16d
neg eax
sbb ecx, ecx
add ecx, 0x3c
cmp esi, ecx
jl 0x1401497ad
test r8d, r8d
setne dl
inc edx
lea eax, [rdx + rsi]
lea ecx, [rax + rax*2]
mov eax, 0x59493e15
lea ecx, [rcx*4 + 6]
imul ecx
lea rcx, [0x140000000]
mov ebp, edx
sar ebp, 7
mov eax, ebp
shr eax, 0x1f
add ebp, eax
movsxd rax, ebp
test r8d, r8d
jne 0x1401497e6
movzx edx, word [rcx + rax*2 + 0x2c12b8]
jmp 0x1401497ee
movzx edx, word [rcx + rax*2 + 0x2c12a0]
mov r14d, esi
movsx eax, dx
sub r14d, eax
inc r14d
inc esi
cmp edi, dword [rbx + 0x280]
jne 0x140149816
cmp r15d, dword [rbx + 0x270]
jl 0x140149816
mov ecx, edi
call fcn.1401496b0
add esi, eax
mov dword [rbx + 0x14], ebp
mov ecx, 1
mov rbp, qword [rsp + 0x40]
mov dword [rbx + 0x88], 1
mov byte [rbx + 0x6a], 1
mov dword [rbx + 0x20], r14d
mov r14, qword [rsp + 0x20]
mov dword [rbx + 0x94], 1
mov word [rbx + 0x6d], 0x101
mov dword [rbx + 0x24], esi
mov rsi, qword [rsp + 0x48]
mov dword [rbx + 0x98], 1
mov dword [rbx + 0x58], edi
mov dword [rbx + 0xcc], 1
mov byte [rbx + 0x7b], 1
cmp edi, ecx
jge 0x14014987c
xor ecx, ecx
mov eax, 1
sub eax, edi
mov edi, eax
mov dword [rbx + 0xc], ecx
mov dword [rbx + 0x80], 1
mov word [rbx + 0x68], 0x101
mov dword [rbx + 0x10], edi
mov rdi, qword [rsp + 0x58]
mov dword [rbx + 0x84], 1
add rsp, 0x28
pop r15
pop rbx
ret
Function at 0x14015ab30
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor eax, eax
lea rcx, [rbp + 0x10]
xor edi, edi
mov dword [rbp + 0x1c0], eax
xor edx, edx
mov dword [rsp + 0x30], edi
mov r8d, 0x1b0
mov word [rbp + 0x1c4], ax
mov word [rsp + 0x34], ax
mov byte [rsp + 0x36], al
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x80
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x80
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
jne 0x14015abc3
xor eax, eax
jmp 0x14015ada2
mov qword [rsp + 0x3f0], rbx
mov ecx, 0x10
mov qword [rsp + 0x3f8], rsi
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov r9d, 3
mov word [rsp + 0x20], di
lea r8, [rbp + 0x1c0]
mov ecx, eax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
xor r8d, r8d
lea r9, [rbp + 0x1c0]
mov esi, eax
lea rcx, [rsp + 0x34]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea edx, [r8 + 3]
mov dword [rsp + 0x20], 3
call fcn.140156db0
lea r8, [rsp + 0x30]
xor ecx, ecx
lea rdx, str.windowsZones
call fcn.14013ac50
lea r9, [rsp + 0x30]
mov r8, rax
lea rdx, [0x1402bf050]
mov rcx, rax
mov rbx, rax
call fcn.140139090
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xbc]
mov edx, 0x80
mov dword [rsp + 0x20], 0xffffffff
lea rcx, [rbp + 0x250]
call fcn.140156db0
cmp dword [rsp + 0x30], edi
jle 0x14015ac9c
test rbx, rbx
je 0x14015ac95
mov rcx, rbx
call fcn.140136350
xor eax, eax
jmp 0x14015ad92
cmp word [rbp + 0xbc], di
je 0x14015ad6a
lea rcx, [rsp + 0x40]
call fcn.140136320
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x250]
call fcn.140139090
cmp dword [rsp + 0x30], edi
jg 0x14015ad60
test esi, esi
je 0x14015acf8
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.14013a8c0
test rax, rax
jne 0x14015ad17
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], edi
lea r8, [rsp + 0x38]
lea rdx, [0x1402bf060]
lea rcx, [rsp + 0x40]
call fcn.14013a8c0
cmp dword [rsp + 0x30], edi
jg 0x14015ad60
movzx ecx, word [rax]
mov r8d, edi
test cx, cx
je 0x14015ad4d
lea rdx, [rbp + 0x1d0]
nop
cmp cx, 0x20
je 0x14015ad4d
movzx ecx, byte [rax]
inc r8d
add rax, 2
mov byte [rdx], cl
inc rdx
movzx ecx, word [rax]
test cx, cx
jne 0x14015ad30
movsxd rax, r8d
cmp rax, 0x80
jae 0x14015adc2
mov byte [rbp + rax + 0x1d0], dil
lea rcx, [rsp + 0x40]
call fcn.140136350
cmp byte [rbp + 0x1d0], dil
je 0x14015ad82
lea rcx, [rbp + 0x1d0]
call fcn.14014e6e0
mov rdi, rax
test rbx, rbx
je 0x14015ad8f
mov rcx, rbx
call fcn.140136350
mov rax, rdi
mov rbx, qword [rsp + 0x3f0]
mov rsi, qword [rsp + 0x3f8]
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.140250070
mov rdi, qword [rsp + 0x400]
add rsp, 0x3e0
pop rbp
ret
call fcn.1402503b0
int3