joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5f78], 0
lea rbx, [rcx + 0x5f80]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180048e27
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180048dda
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18004b530
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180033350
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5f78]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5f88]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1800d38d8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180048e2f
mov rcx, rbx
call fcn.180033350
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180049150
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1800d38e0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1800491b3
mov qword [rsp], rbx
lea rbx, [0x1800ac3e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180049193
cmp byte [r8], r9b
jne 0x180049193
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180049180
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5ee8]
not eax
mov r8, qword [r10 + 0x5ef0]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x1800491df
cmp dword [r8 + 8], eax
je 0x1800491e6
add r8, 0x48
cmp r8, rcx
jne 0x1800491d0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret

Function at 0x180049510
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1800d38e0]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5ed4], ecx
test rbx, rbx
je 0x18004957f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.180049590
lea rdx, [0x1800abfd0]
mov rcx, rbx
mov rdi, rax
call fcn.1800329a0
mov rbx, rax
test rax, rax
je 0x18004957a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18005db40
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1800d2040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1800d38e0]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18005dd5e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18005dd5e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1800d38e0]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x18005dc14
movsx rdx, word [r8 + 0x6030]
lea rax, [r8 + 0x6034]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x18005dc09
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6030], cx
movsx rax, cx
lea rax, [rax*8 + 0x6034]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6028]
test rdi, rdi
je 0x18005dc31
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x18005dc34
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x18005dc77
mov rsi, qword [r8 + 0x90]
jmp 0x18005dc7a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18005dca5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1800d38e0]
mov rcx, qword [rax + 0x4ad0]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, [0x1800c15f0]
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18005dd1e
inc rbx
cmp rbx, 5
jl 0x18005dd00
jmp 0x18005dd4a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x18005dd60
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800804e0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x180074690
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18007471c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800746f0
lea r11, [0x1800ac3e0]
nop
cmp r9b, 0x23
jne 0x1800746d3
cmp byte [r8], r9b
jne 0x1800746d3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800746c0
mov rcx, qword [0x1800d38e0]
not eax
cmp dword [rcx + 0x4068], eax
jne 0x180074707
mov dword [rcx + 0x406c], eax
cmp dword [rcx + 0x4098], eax
jne 0x180074779
mov byte [rcx + 0x409c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1800d38e0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4008]
movsxd rax, dword [rbx + 0xf0]
mov r8, qword [rbx + 0xf8]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1800328f0
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x4050], eax
jne 0x180074772
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.18004a4c0
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18007b620
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x18007b679
cmp edx, 1
jne 0x18007b680
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rax, [0x1800d3928]
mov qword [0x1800d3938], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x18007b150]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800d3930], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov byte [0x1800d20d8], 0
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18007c210
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18007c460
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18007c32a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007c274
mov rax, qword [0x1800d2008]
cmp qword [rsp + 0x20], rax
ja 0x18007c274
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007c236
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18007c2a5
jmp 0x18007c32a
cmp dword [rsp + 0x50], 0x10000
jne 0x18007c30d
cmp qword [rsp + 0x48], 0x10000
jb 0x18007c30d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007c2eb
mov rax, qword [rsp + 0x28]
jmp 0x18007c32c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18007c2fb
xor eax, eax
jmp 0x18007c32c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007c325
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18007c460
mov qword [rsp + 0x20], rax
jmp 0x18007c236
xor eax, eax
add rsp, 0x68
ret

Function at 0x18007c340
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18007c4a0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18007c456
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007c39b
mov rax, qword [0x1800d2008]
cmp qword [rsp + 0x20], rax
ja 0x18007c39b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007c35d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18007c3cc
jmp 0x18007c456
cmp dword [rsp + 0x50], 0x10000
jne 0x18007c434
cmp qword [rsp + 0x48], 0x10000
jb 0x18007c434
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007c412
mov rax, qword [rsp + 0x28]
jmp 0x18007c458
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18007c422
xor eax, eax
jmp 0x18007c458
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007c451
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18007c4a0
mov qword [rsp + 0x20], rax
jmp 0x18007c35d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007c4f0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18007ca80
mov qword [rsp + 0x28], 0
cmp qword [0x1800d3228], 0
jne 0x18007c538
cmp qword [0x1800d3220], 0
je 0x18007c538
mov rax, qword [0x1800d3220]
mov qword [0x1800d3228], rax
cmp qword [0x1800d3228], 0
je 0x18007c5de
mov rax, qword [0x1800d3228]
cmp qword [rax + 0x10], 0
je 0x18007c5de
mov rax, qword [0x1800d3228]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007c5de
mov rax, qword [0x1800d3228]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007c5de
mov rax, qword [0x1800d3228]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18007c5a4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18007c5ab
xor eax, eax
jmp 0x18007c759
mov rax, qword [0x1800d3228]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18007c759
mov rax, qword [0x1800d3220]
mov qword [0x1800d3228], rax
jmp 0x18007c600
mov rax, qword [0x1800d3228]
mov rax, qword [rax + 8]
mov qword [0x1800d3228], rax
cmp qword [0x1800d3228], 0
je 0x18007c64d
cmp qword [0x1800d3228], 0
je 0x18007c64b
mov rax, qword [0x1800d3228]
cmp qword [rax + 0x10], 0
je 0x18007c64b
mov rax, qword [0x1800d3228]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007c64b
mov rax, qword [0x1800d3228]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007c64b
jmp 0x18007c57c
jmp 0x18007c5ee
mov rcx, qword [rsp + 0x60]
call fcn.18007e920
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18007c760
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18007c757
mov rax, qword [rsp + 0x48]
mov qword [0x1800d3228], rax
mov rax, qword [0x1800d3228]
mov dword [rax], 0x52727464
mov rax, qword [0x1800d3228]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800d3228]
mov rcx, qword [0x1800d3220]
mov qword [rax + 8], rcx
mov rax, qword [0x1800d3228]
mov qword [0x1800d3220], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800d3228]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18007c708
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18007c742
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18007c6fe
mov rax, qword [0x1800d3228]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18007c57c
xor eax, eax
add rsp, 0x58
ret
Function at 0x18007d470
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18007d4b7
xor al, al
jmp 0x18007d559
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18007d4e1
xor al, al
jmp 0x18007d559
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x18007d551
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x18007d551
mov al, 1
jmp 0x18007d559
jmp 0x18007d557
xor al, al
add rsp, 0x78
ret

Function at 0x18007d860
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800d3220]
mov qword [rsp + 0x28], rax
jmp 0x18007d880
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007d8af
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18007d8ad
call sub.KERNEL32.dll_GetLastError
jmp 0x18007d8b1
jmp 0x18007d872
xor eax, eax
add rsp, 0x38
ret
Function at 0x18007df70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1800d3238], eax
je 0x18007df9d
mov eax, 0x10dd
jmp 0x18007e1b6
cmp dword [0x1800d323c], 0
je 0x18007dfb1
mov eax, dword [0x1800d323c]
jmp 0x18007e1b6
cmp qword [rsp + 0x78], 0
jne 0x18007dfc3
mov eax, 0x57
jmp 0x18007e1b6
cmp qword [rsp + 0x70], 0
jne 0x18007dfd5
mov eax, 6
jmp 0x18007e1b6
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x18007e007
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x1800d323c], eax
mov rax, qword [rsp + 0x70]
mov qword [0x1800d3240], rax
mov eax, dword [rsp + 0x20]
jmp 0x18007e1b6
mov ecx, 0x30
call fcn.180080500
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18007e079
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x1800d323c], eax
cmp qword [rsp + 0x30], 0
je 0x18007e064
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x50]
call fcn.180080984
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x1800d3240], rax
mov eax, dword [rsp + 0x20]
jmp 0x18007e1b6
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.18007df40
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.18007df40
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x18007e0d6
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x18007e0f3
mov dword [rsp + 0x20], 9
cmp dword [0x1800d3230], 0
je 0x18007e0ee
jmp 0x18007e03a
jmp 0x18007e030
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x18007e120
mov dword [rsp + 0x20], 9
cmp dword [0x1800d3230], 0
je 0x18007e11b
jmp 0x18007e03a
jmp 0x18007e030
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18007e157
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x18007e030
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x1800d3250]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x1800d3250], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007e1c0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1800d3238], eax
je 0x18007e1db
mov eax, 0x10dd
jmp 0x18007e300
mov rax, qword [0x1800d3250]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007e285
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x18007e250
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x18007e250
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.18007cbc0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.180080984
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18007e1e7
mov qword [0x1800d3250], 0
call fcn.18007d620
mov rax, qword [0x1800d3248]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18007e2e9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.180080984
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18007e2a1
mov qword [0x1800d3248], 0
mov dword [0x1800d3238], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007e830
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800d323c], 0
je 0x18007e84d
mov eax, dword [0x1800d323c]
jmp 0x18007e913
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x18007e860
xor eax, eax
jmp 0x18007e913
mov ecx, 0x10
call fcn.180080500
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18007e8ce
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18007e8b3
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.180080984
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800d323c], eax
mov qword [0x1800d3240], 0
mov eax, dword [rsp + 0x20]
jmp 0x18007e913
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x18007e8e8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x18007e889
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1800d3248]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1800d3248], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x18007fd80
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18007fdba
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18007fdbf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18007fe08
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180085c40]
cmp byte [rcx + rax], 0
je 0x18007fe08
dec r8
sub rdx, 1
jne 0x18007fdee
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x4137c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41394b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00673c78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413825
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413834
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413853
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413863
cmp rbx, 0x1000
jae 0x41382b
jmp 0x4138cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413875
xor edx, edx
jmp 0x4138c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00673c78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413859
jmp 0x413848
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00673c78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00536feb]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00537535]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00539c0c]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS