joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d110
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov al, 1
cmp byte [rcx + 8], 0
jne 0x14003d1f4
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
jne 0x14003d160
lea r8, str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14003d154
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rdi
test rdi, rdi
je 0x14003d1fb
mov rcx, rdi
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14003d1a7
cmp eax, 0x80
je 0x14003d1c9
test eax, eax
je 0x14003d1e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_wait_on_registry_mutex:__X
lea r8, str.Acquire
mov r9d, 0xbb
jmp 0x14003d1c2
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Timed_out_waiting_for_registry_mutex
lea r8, str.Acquire
mov r9d, 0xae
call fcn.14002cc90
jmp 0x14003d1ed
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Found_abandoned_registry_mutex._Continuing...
lea r8, str.Acquire
mov r9d, 0xb5
call fcn.14002cc90
mov byte [rsi + 8], 1
cmp byte [rsi + 8], 0
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Couldnt_open_registry_mutex:__X
lea r8, str.Acquire
mov r9d, 0xa4
call fcn.14002cc90
xor eax, eax
jmp 0x14003d1f4
Function at 0x14003de90
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rdi, [rsp + 0x70]
mov qword [rdi], 0
mov qword [rsp + 0x20], rdi
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
xor ebx, ebx
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003df7f
lea rax, [rsp + 0x6c]
mov dword [rax], ebx
lea rcx, [rsp + 0x68]
mov dword [rcx], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rcx
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, 2
test eax, eax
jne 0x14003df74
lea rbx, [rsp + 0x64]
mov dword [rbx], 0xffffffff
lea rax, [rsp + 0x60]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8, rsi
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
cmp dword [rbx], 0
sete cl
test eax, eax
mov ebx, 2
cmove ebx, ecx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003df84
mov ebx, 2
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140057bf0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
Function at 0x140056520
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, qword [0x1400ab588]
test r14, r14
jne 0x140056671
lea rcx, [0x14007e795]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x140056588
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x140056588
mov rbx, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x140056588
mov rsi, rax
mov r15d, 1
jmp 0x140056616
lea rcx, [0x14007e750]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x140056680
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x140056680
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x140056680
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x140056680
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
mov rax, rbx
call qword [0x1400af010]
test eax, eax
jne 0x140056680
mov rbx, qword [rsp + 0x28]
xor r15d, r15d
mov ecx, 0x20
mov edx, 8
call fcn.140018270
test rax, rax
je 0x140056685
mov r14, rax
mov qword [rax], r15
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
xor eax, eax
lock cmpxchg qword [0x1400ab588], r14
je 0x140056671
mov rsi, rax
cmp qword [r14], 0
jne 0x14005665b
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_CloseHandle
mov edx, 0x20
mov r8d, 8
mov rcx, r14
call fcn.140018300
mov r14, rsi
mov rax, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140065340
mov ecx, 0x20
mov edx, 8
call fcn.140058e80
int3
Function at 0x140002635
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1400854d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x1400854f9
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140085543
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x1400854ee
mov rax, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x14000311b
Capabilities:
Get hostname

Disassembly:
jmp 0x140023ef0
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x348
lea rdi, [rsp + 0x20]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x360]
mov rax, qword [0x1402d9140]
xor rax, rsp
mov qword [rsp + 0x338], rax
mov dword [rsp + 0x310], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x254], 0x104
lea r8, [rsp + 0x254]
lea rdx, [rsp + 0x30]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140024016
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x268]
call fcn.140001460
mov qword [rsp + 0x318], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x320], rax
mov r8, qword [rsp + 0x320]
lea rdx, str.GetComputerNameExW_failed:
lea rcx, [rsp + 0x290]
call fcn.140009354
mov qword [rsp + 0x328], rax
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x330], rax
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0x2c0]
call fcn.140003fc6
lea rdx, [0x1402d7ca8]
lea rcx, [rsp + 0x2c0]
call fcn.140009be2
nop
lea rcx, [rsp + 0x290]
call fcn.14000278e
lea rcx, [rsp + 0x268]
call fcn.14000278e
nop
mov eax, dword [rsp + 0x254]
shl rax, 1
mov qword [rsp + 0x2d8], rax
cmp qword [rsp + 0x2d8], 0x208
jae 0x140024038
jmp 0x14002403d
call fcn.140006c12
xor eax, eax
mov rcx, qword [rsp + 0x2d8]
mov word [rsp + rcx + 0x30], ax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x2f0]
call fcn.140005718
lea rcx, [rsp + 0x300]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x300]
mov rcx, qword [rsp + 0x360]
call fcn.1400036b6
mov eax, dword [rsp + 0x310]
or eax, 1
mov dword [rsp + 0x310], eax
mov rax, qword [rsp + 0x360]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1402378c0]
call fcn.140007996
mov rax, rdi
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.140004d81
add rsp, 0x348
pop rdi
pop rsi
ret
Function at 0x140003cc4
Capabilities:
Get geographical location

Disassembly:
jmp 0x140110d20
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.140003f67
mov dword [rsp + 0x28], eax
call fcn.140005ab5
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov edx, 0x22
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x20]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x30
je 0x140110d9f
cmp dword [rsp + 0x24], 0x31
je 0x140110da6
cmp dword [rsp + 0x24], 0x32
je 0x140110dad
jmp 0x140110db4
mov eax, 2
jmp 0x140110db6
mov eax, 1
jmp 0x140110db6
mov eax, 3
jmp 0x140110db6
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x14000492b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14019adf0
mov rax, rcx
neg rcx
test rax, 7
je 0x14019ae0d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14019ae68
test al, 7
jne 0x14019ae00
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14019ae21
mov rdx, qword [rax - 8]
test dl, dl
je 0x14019ae92
test dh, dh
je 0x14019ae8c
shr rdx, 0x10
test dl, dl
je 0x14019ae86
test dh, dh
je 0x14019ae80
shr rdx, 0x10
test dl, dl
je 0x14019ae7a
test dh, dh
je 0x14019ae74
shr edx, 0x10
test dl, dl
je 0x14019ae6e
test dh, dh
jne 0x14019ae21
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x140004976
Capabilities:
Query environment variable

Disassembly:
jmp 0x1401f4d20
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1401f48a0
lea rcx, [rsp + 0x20]
call fcn.1401f48f0
movzx eax, al
test eax, eax
jne 0x1401f4d65
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1401f48d0
mov rax, qword [rsp + 0x40]
jmp 0x1401f4e5f
lea rcx, [rsp + 0x20]
call fcn.1401f49f0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1401f4990
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140004ef8
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140003f85
lea rcx, [rsp + 0x28]
call fcn.1400056f0
movzx eax, al
test eax, eax
jne 0x1401f4dff
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140007630
lea rcx, [rsp + 0x20]
call fcn.1401f48d0
mov rax, qword [rsp + 0x50]
jmp 0x1401f4e5f
lea rcx, [rsp + 0x20]
call fcn.1401f49f0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140008e6d
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140004dbd
lea rcx, [rsp + 0x28]
call fcn.140009d63
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140007630
lea rcx, [rsp + 0x20]
call fcn.1401f48d0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x14000518c
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140135de0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140135760
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140135e1f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140304020]
jmp 0x140135e29
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400055a6
Capabilities:
Query environment variable

Disassembly:
jmp 0x1401f4a70
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1401f48a0
lea rcx, [rsp + 0x40]
call fcn.1401f4a20
movzx eax, al
test eax, eax
jne 0x1401f4ab8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1401f48d0
mov rax, qword [rsp + 0x70]
jmp 0x1401f4c89
lea rcx, [rsp + 0x40]
call fcn.1401f49f0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1401f4990
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1401f49f0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140007081
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1401f4b5e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1401f48d0
mov rax, qword [rsp + 0x80]
jmp 0x1401f4c89
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140004ef8
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004b6f
lea rcx, [rsp + 0x48]
call fcn.1400042cd
movzx eax, al
test eax, eax
jne 0x1401f4bc5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400023d8
lea rcx, [rsp + 0x40]
call fcn.1401f48d0
mov rax, qword [rsp + 0x88]
jmp 0x1401f4c89
lea rcx, [rsp + 0x48]
call fcn.140005d35
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1401f49f0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140007081
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1401f4c5b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400023d8
lea rcx, [rsp + 0x40]
call fcn.1401f48d0
mov rax, qword [rsp + 0xa0]
jmp 0x1401f4c89
lea rcx, [rsp + 0x48]
call fcn.140004b24
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400023d8
lea rcx, [rsp + 0x40]
call fcn.1401f48d0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400055bf
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140135d10
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401356e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140135d51
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140304020]
jmp 0x140135d57
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x14000563c
Capabilities:
Get hostname

Disassembly:
jmp 0x140023d10
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x158
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x170]
mov rax, qword [0x1402d9140]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x120], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0x10
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x140023e25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x78]
call fcn.140001460
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x130], rax
mov r8, qword [rsp + 0x130]
lea rdx, str.GetComputerNameW_failed:
lea rcx, [rsp + 0xa0]
call fcn.140009354
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x140], rax
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0xd0]
call fcn.140003fc6
lea rdx, [0x1402d7ca8]
lea rcx, [rsp + 0xd0]
call fcn.140009be2
nop
lea rcx, [rsp + 0xa0]
call fcn.14000278e
lea rcx, [rsp + 0x78]
call fcn.14000278e
nop
mov eax, dword [rsp + 0x64]
shl rax, 1
mov qword [rsp + 0xe8], rax
cmp qword [rsp + 0xe8], 0x20
jae 0x140023e41
jmp 0x140023e46
call fcn.140006c12
xor eax, eax
mov rcx, qword [rsp + 0xe8]
mov word [rsp + rcx + 0x28], ax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x100], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x100]
call fcn.140005718
lea rcx, [rsp + 0x110]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x170]
call fcn.1400036b6
mov eax, dword [rsp + 0x120]
or eax, 1
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x170]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140237820]
call fcn.140007996
mov rax, rdi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.140004d81
add rsp, 0x158
pop rdi
pop rsi
ret
Function at 0x1400056f5
Capabilities:
Get geographical location

Disassembly:
jmp 0x1401d8420
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1401d7350
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401d8487
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140304030]
jmp 0x1401d84a9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400041e2
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140005727
Capabilities:
Terminate process

Disassembly:
jmp 0x140112cb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140005a24
Capabilities:
Get graphical window text

Disassembly:
jmp 0x14001dc50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x64]
call fcn.1400054e3
mov qword [rsp + 0x70], rax
xor eax, eax
mov word [rsp + 0x66], ax
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x70]
lea r8, [rsp + 0x66]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140007937
nop
lea rcx, [rsp + 0x38]
call fcn.140005317
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x38]
call fcn.140005317
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.140003b11
mov eax, dword [rsp + 0x68]
or eax, 1
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x38]
call fcn.14000114f
mov rax, qword [rsp + 0x90]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1402357a0]
call fcn.140007996
mov rax, rdi
add rsp, 0x80
pop rdi
ret
Function at 0x140005c9a
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401d6b80
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402d9140]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1401d6ba6
jmp 0x1401d6c23
mov rcx, qword [rbp + 0x30]
call fcn.14000492b
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1401d6bbf
jmp 0x1401d6c23
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1401d6bdc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140002720
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400030f3
test eax, eax
jne 0x1401d6c23
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140004d81
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140005e7f
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400b3a00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x198
mov rax, qword [0x1402d9140]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x120], rax
mov rcx, qword [rsp + 0x1c0]
call fcn.14000231f
mov dword [rsp + 0xd8], eax
mov rcx, qword [rsp + 0x1c0]
call fcn.140004683
mov qword [rsp + 0xe0], rax
xor r8d, r8d
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
call fcn.14000519b
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x138]
call fcn.140004ab6
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x150], rax
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x150]
call fcn.140002513
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x168], rax
lea rax, str.__:_
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], 0xa
lea rax, [rsp + 0xf8]
lea rcx, [rsp + 0xe8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x110]
lea rcx, [rsp + 0xf8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
mov r8, qword [rsp + 0x168]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xa8]
call fcn.140007a4f
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x178], rax
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x1b0]
call fcn.140003fc6
nop
lea rcx, [rsp + 0xa8]
call fcn.14000278e
nop
lea rcx, [rsp + 0x80]
call fcn.14000278e
nop
lea rcx, [rsp + 0x58]
call fcn.140008440
nop
lea rcx, [rsp + 0x30]
call fcn.140008440
mov rax, qword [rsp + 0x1b0]
lea rcx, vtable.util::win::logged_runtime_error.0
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
call fcn.140001d61
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140004d81
add rsp, 0x198
pop rdi
pop rsi
ret

Function at 0x140005f4c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140212450
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140212474
xor eax, eax
jmp 0x1402124c2
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14021249c
xor eax, eax
jmp 0x1402124c2
mov rax, qword [rsp + 8]
add rax, 0x18
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x20b
je 0x1402124bd
xor eax, eax
jmp 0x1402124c2
mov eax, 1
add rsp, 0x28
ret
Function at 0x140006172
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400c7610
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400c764d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140008fb7
add rsp, 0x58
ret

Function at 0x1400062e9
Capabilities:
Set environment variable

Disassembly:
jmp 0x1401f6bd0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret