joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d3480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401d35f7
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x40], rcx
movabs rdx, 0x20eedf43c3ce6ef5
movabs rax, 0x20eedf43c3ce6ee5
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x57], al
jb 0x1401d35f7
mov eax, dword [0x140223010]
xor eax, 0x7ae11b07
imul eax, dword [0x140223014]
sub eax, 0x97e2ebf3
add eax, 0xcbe5a292
add eax, 0x97e2ebf3
imul eax, eax, 0x64e94ad9
mov ecx, 0xe3c6dc9
xor ecx, 0xfacd0855
or eax, ecx
mov ecx, 0x9ce95449
xor ecx, 0x38961c5e
cmp eax, ecx
je 0x1401d3735
mov r8, qword [rsp + 0x40]
mov eax, dword [0x140223018]
xor eax, dword [0x14022301c]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xd9750e0e
mov r9d, 0x3ae7d57f
xor r9d, 0xe392db71
mov ecx, 0x52b771fd
xor ecx, 0xad488e02
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, 0xd9750e0e
mov r9d, 0x8507b24
xor r9d, 0xd125752a
or eax, r9d
imul eax, edx
add eax, ecx
mov ecx, 0xd7654304
xor ecx, 0x54eb823b
xor eax, ecx
mov ecx, 0xd3c1b1c1
xor edx, edx
div ecx
mov rcx, r8
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rdx, rcx
xor rdx, r8
cmp rdx, 0
setl dl
cmp rcx, 0xffffffffffffffff
setg cl
and cl, dl
mov byte [rsp + 0x37], cl
cmp eax, 0x2519d3c3
jae 0x1401d3735
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1401d35d4
jmp 0x1401d35e4
call fcn.140008bc6
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401d35f7
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x27], al
mov eax, dword [0x140223020]
mov ecx, dword [0x140223024]
xor ecx, 0x5f53a28b
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
mov edx, 0x63b05dff
xor edx, 0x9c4fa200
xor eax, edx
mov edx, 0x71f01675
xor edx, 0xcf604f32
mov r8d, 0x2355a36d
xor r8d, 0xdcaa5c92
xor edx, r8d
or eax, edx
mov edx, 0xbe905947
and edx, 0xbe905947
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
xor ecx, ecx
sub ecx, 0x9f0bc170
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x9bc6fb1b
mov r8d, 0x28ea0067
xor r8d, 0xb32cfb7c
mov ecx, 0x8b4785cb
xor ecx, 0x74b87a34
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x9bc6fb1b
mov r8d, 0x4608dc2
xor r8d, 0x9fa676d9
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x21a343ac
xor ecx, 0xd0b1d8b0
cmp eax, ecx
jbe 0x1401d373e
mov eax, dword [0x140223028]
mov edx, dword [0x14022302c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, 0xc6ef587f
xor eax, 0xc6ef587f
sub eax, ecx
or eax, 0x6b89e0c9
mov ecx, eax
xor ecx, 0x3ad6570
mov edx, 0xe62dce37
xor edx, 0x19d231c8
xor ecx, edx
or eax, 0x3ad6570
and eax, ecx
mov ecx, 0xe6f906b0
xor edx, edx
div ecx
cmp eax, 0x9dd9cc05
jae 0x1401d36d0
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
movabs byte [0xfffffde2e928bfac], al
invalid
Function at 0x1401dfae0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x140223498]
xor edx, edx
div dword [0x14022349c]
mov ecx, 0x51498d56
xor edx, edx
div ecx
mov ecx, 0x53fe59af
xor ecx, 0xac01a650
mov edx, eax
xor edx, ecx
and edx, 0x7d40fd52
mov r8d, 0xffffffff
xor r8d, 0x7d40fd52
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x7d40fd52
mov r8d, 0x88e99a6a
xor r8d, 0xf5a96738
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xd27a0abb
xor edx, edx
div ecx
mov ecx, 0x416c95e2
xor ecx, 0x5b262f2c
cmp eax, ecx
jae 0x1401dfc39
mov ecx, dword [0x1402234a0]
mov eax, dword [str.IX]
xor eax, 0xa9a53b30
or ecx, eax
add ecx, 0x4f1e09c
xor ecx, 0xb77663e0
mov edx, ecx
and edx, 0x4617f
add edx, edx
mov eax, ecx
neg edx
mov ecx, edx
lea eax, [rax + rcx - 0x7ffb9e81]
mov dword [rbp - 0x24], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1401e5670
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov r10, qword [r9]
mov qword [rdx], r10
mov r9, qword [r9 + 8]
mov qword [rdx + 8], r9
mov r9, qword [rax]
mov qword [r8], r9
mov rax, qword [rax + 8]
mov qword [r8 + 8], rax
sub rsp, 0x20
call fcn.14009dd62
mov eax, dword [rbp - 0x24]
add rsp, 0x20
cmp eax, 0xf4727265
je 0x1401dfb74
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
sub ecx, esp
test dword [rdi - 0x17], 0xffffff32
Function at 0x1401e4940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov rax, r8
mov r8, rdx
mov qword [rsp + 0x50], rcx
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
xor edx, edx
test r8, r8
cmovg rdx, r8
mov qword [rsp + 0x60], rdx
add rax, 8
mov qword [rsp + 0x68], rax
cmp rcx, 0
sete al
mov byte [rsp + 0x77], al
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rcx
mov rax, 0xffffffffffffffff
cmp rcx, rdx
mov qword [rsp + 0x48], rax
je 0x1401e4b79
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
shl rax, 4
add rdx, rax
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jne 0x1401e4b16
mov eax, dword [0x140223648]
xor eax, dword [0x14022364c]
sub eax, 0xeab9746b
mov ecx, 0xfa17a43a
xor edx, edx
div ecx
sub eax, 0x746ed972
cmp eax, 0xc5b1bc4e
jae 0x1401e4b92
mov eax, dword [0x140223650]
mov ecx, 0x40cea0fd
xor ecx, 0xbd3b8234
xor eax, ecx
mov ecx, dword [0x140223654]
mov edx, 0x532da10b
xor edx, 0x72fc4761
xor ecx, edx
xor edx, edx
div ecx
mov ecx, 0xde6bcb32
xor ecx, 0x71a55383
sub eax, ecx
xor eax, 0xc6799a19
xor eax, 0xca6b7830
cmp eax, 0x9ea78c84
jae 0x1401e4a14
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x77]
test cl, 1
mov qword [rsp + 0x48], rax
jne 0x1401e4b79
jmp 0x1401e4a7c
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
cmp rcx, rdx
mov qword [rsp + 0x48], rax
je 0x1401e4b79
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
mov cl, byte [rcx + rax]
mov dl, byte [rdx + rax]
movabs r8, 0xfb458873d8f78492
add rax, r8
movabs r8, 0x2c7d7e923a9f32ea
movabs r9, 0x2c7d7e923a9f32eb
xor r8, r9
add rax, r8
movabs r8, 0x3b612eeb5c6e0ce8
movabs r9, 0xc024a6988499887a
xor r8, r9
sub rax, r8
cmp cl, dl
mov qword [rsp + 0x30], rax
je 0x1401e4a91
mov rdx, qword [rsp + 0x40]
mov rax, rdx
add rax, 1
mov rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r8, 0x50a5ac6d110ea4c8
movabs r9, 0xaf5a5392eef15b37
xor r8, r9
xor rcx, r8
and rcx, 0xffffffffffffffff
shl rcx, 1
sub rcx, 0xffffffffffffffff
sub rdx, rcx
mov rcx, rax
and rcx, rdx
cmp rcx, 0
mov qword [rsp + 0x80], rax
jge 0x1401e4998
call fcn.140008bc6
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0xffffffffffffffff
setg al
and al, 1
movzx eax, al
add rsp, 0x88
ret
cmp eax, 0x79e984c2
invalid

Function at 0x1401e5670
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1401f2170
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.1401f245b
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x1401f244c
mov rax, qword [rsp + 0x40]
movabs rcx, 0xea1cf9565feede16
movabs rdx, 0x6f5be6cf7f063002
xor rcx, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x85471f9920e8ee14
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x1401f242b
mov rdx, qword [rsp + 0x38]
movabs rcx, 0xcccc97efd4817e5e
mov rax, rdx
add rax, rcx
movabs rcx, 0x28124c4f0d751e74
movabs r8, 0xd7edb3b0f28ae184
xor rcx, r8
add rax, rcx
movabs rcx, 0xcccc97efd4817e5e
sub rax, rcx
mov qword [rsp + 0x28], rax
movabs r8, 0xd97695fe30cc8a59
movabs rcx, 0x26896a01cf3375a6
xor r8, rcx
mov rcx, rax
xor rcx, r8
mov r8, rax
xor r8, 0xffffffffffffffff
or rcx, r8
movabs r8, 0xd01a485d1f9adc8e
movabs r9, 0x2fe5b7a2e0652371
xor r8, r9
xor rcx, r8
mov r8, rdx
xor r8, 0xffffffffffffffff
or rcx, r8
movabs r9, 0xafe1cbdef9d9e770
movabs r8, 0x501e34210626188f
xor r9, r8
mov r8, rdx
xor r8, r9
xor rdx, 0xffffffffffffffff
or r8, rdx
mov rdx, rax
and rdx, r8
xor rdx, 0xffffffffffffffff
and rcx, rdx
xor rcx, 0xffffffffffffffff
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x1401f22bb
jmp 0x1401f22c5
call fcn.140008bc6
jmp 0x1401f244c
mov eax, dword [0x140223ac0]
mov ecx, dword [0x140223ac4]
xor ecx, 0xffffffff
add eax, ecx
mov ecx, 0x204201ec
xor ecx, 0x204201ed
add eax, ecx
mov r8d, 0x59aef57d
xor r8d, 0xef0cf0b1
mov ecx, 0x7feb458d
xor ecx, 0x8014ba72
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xb6a205cc
or eax, 0xb6a205cc
imul eax, edx
add eax, ecx
mov ecx, 0xed73a27d
xor ecx, 0xfca5bf3c
mov r8d, eax
and r8d, ecx
mov ecx, 0x3f0730b9
xor ecx, 0x2ed12df8
or eax, ecx
add r8d, eax
mov ecx, r8d
xor ecx, 0xffffffff
mov eax, 0x9ef1fa95
xor eax, 0x2ed2b624
and eax, ecx
mov edx, 0x2f8116b0
xor edx, 0x9fa25a01
mov ecx, 0xf74c032b
xor ecx, 0x8b3fcd4
xor edx, ecx
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x54ddb2c6
mov r9d, 0x5863139a
xor r9d, 0xe8405f2b
and ecx, r9d
and edx, 0x54ddb2c6
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0x24779662
jbe 0x1401f2452
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140223ac8]
xor eax, 0x1651654e
mov r8d, dword [0x140223acc]
xor r8d, 0x38308420
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r9d, eax
mov rax, qword [rsp + 0x40]
mov r10d, 0x1415065d
xor r10d, 0x94fc0417
mov r8d, r9d
and r8d, r10d
xor r9d, 0x80e9024a
or r8d, r9d
and r8d, 0x384ed0e4
mov r9d, 0x28d04f8c
xor r9d, 0xbdde26c7
sub r8d, r9d
mov dword [rsp + 0x24], r8d
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140011d2a
mov eax, dword [rsp + 0x24]
cmp eax, 0x26fff6be
jb 0x1401f23a1
jmp 0x1401f244c
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.140011d2a
mov rcx, qword [rsp + 0x40]
call fcn.140011df0
nop
add rsp, 0x48
ret
invalid
Function at 0x1401f245b
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1401f6670
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.140206ec0
mov rdx, qword [rsp + 0x40]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [0x140223d00]
xor edx, edx
div dword [0x140223d04]
mov ecx, eax
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0x63d9842d
xor edx, 0x7b2b3b5b
mov r8d, 0x63f90f76
xor r8d, 0x7b0bb000
or edx, r8d
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or ecx, 0x18f2bf76
xor ecx, 0xffffffff
mov edx, 0x55da2095
xor edx, 0xaa25df6a
xor eax, edx
mov edx, 0x35f21830
xor edx, 0xca0de7cf
xor ecx, edx
and eax, ecx
and eax, 0x361ad16d
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xd5d5550c
xor ecx, 0x35b88cdc
mov edx, 0xd0f430e9
xor edx, 0x2f0bcf16
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xe06dd9d0
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x1e2f3003
xor ecx, 0x93eeff96
cmp eax, ecx
jb 0x1401f682f
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140223d08]
xor eax, 0x1d5c1781
mov r9d, dword [str.X__t]
mov edx, 0xe77a60f3
xor edx, 0x18859f0c
mov r10d, r9d
xor r10d, edx
mov r8d, eax
and r8d, r10d
mov edx, eax
or edx, r10d
mov r10d, 0x54cee94e
xor r10d, 0xab3116b1
xor edx, r10d
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
add eax, 0x48bb53a9
mov r8d, 0xce664d44
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x48]
xor eax, 0x2995460f
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x2ff23762
je 0x1401f6750
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1401f682a
jmp 0x1401f67e6
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov dl, 0x29
xor dl, 0x29
mov byte [rcx + rax], dl
movabs rdx, 0xd5d865e09f37b6e3
movabs rcx, 0xd5d865e09f37b6e2
xor rdx, rcx
mov rcx, rax
and rcx, rdx
shl rcx, 1
xor rax, 1
add rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x1401f669d
add rsp, 0x58
ret
call 0x12a00e088
sbb bh, bh
invalid
Function at 0x1401faf30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], rcx
mov eax, 0x10
mov qword [rbp + 0x58], rax
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp + 0x58]
mov rcx, rsp
mov qword [rbp + 0x88], rcx
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp + 0x58]
mov rcx, rsp
mov qword [rbp + 0x40], rcx
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp + 0x58]
mov rcx, rsp
mov qword [rbp + 0x48], rcx
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp + 0x58]
mov rcx, rsp
mov qword [rbp + 0x50], rcx
Function at 0x1401febc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rcx, rsp
mov qword [rbp - 0x20], rcx
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp - 0x38]
Function at 0x140206ec0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x140209c00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x14021337e
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650

Function at 0x140214714
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
call 0x140213780
nop
add rsp, 0x28
jmp fcn.1402139a0

Function at 0x1402153e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140215408
mov eax, 0
jmp 0x140215456
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140215431
mov eax, 0
jmp 0x140215456
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140215451
mov eax, 0
jmp 0x140215456
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14021545c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1402154da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1402154d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1402154d1
mov rax, qword [rbp - 8]
jmp 0x1402154ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1402154a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000eca0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14000edb8
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
nop dword [rax]
jne 0x14000eda6
mov rdx, qword [0x1408f8ae8]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
nop
cmp rsi, rdi
jb 0x14000ed84
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x18], rdx
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.140011ce0
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x20], xmm15
lea rsi, [0x140075aa0]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
call fcn.140010160
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x14000ed95
nop
cmp byte [0x1416f9860], 0
je 0x14000ed6e
lea rax, [0x1408f8ae8]
call fcn.1400091e0
mov rbx, qword [rsp + 0x30]
lea rcx, [0x1408f8ae8]
xchg qword [rcx], rbx
mov rdx, qword [0x1408f8ae8]
mov rax, qword [rsp + 0x48]
mov rbx, rax
mov rax, rdx
call fcn.14000ede0
add rsp, 0x38
pop rbp
ret
lea rax, [0x140b12093]
mov ebx, 0x27
call fcn.14003d800
lea rax, [0x140aeab59]
mov ebx, 0xf
call fcn.14003d800
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.14006f0a0
mov rax, qword [rsp + 8]
jmp fcn.14000eca0
Function at 0x14001be20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001bfab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1408f8c28]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003aca0
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001be85
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001be94
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001beb3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001bec3
cmp rbx, 0x1000
jae 0x14001be8b
jmp 0x14001bf2d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001bed5
xor edx, edx
jmp 0x14001bf24
mov rcx, qword [0x1408f8c28]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003aca0
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001beb9
jmp 0x14001bea8
call fcn.140072820
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003f2a0
lea rax, [0x140af7933]
mov ebx, 0x18
nop dword [rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
call fcn.14003f860
lea rax, [0x140af9075]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x30]
call fcn.14003f860
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140b06796]
mov ebx, 0x21
call fcn.14003d800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001be20
Function at 0x14001bfe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001c206
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1408f8c20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003ad20
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001c053
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001c062
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x14001c085
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001c095
cmp rbx, 0x1000
jae 0x14001c059
nop
jmp 0x14001c118
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001c0ad
xor esi, esi
jmp 0x14001c10a
mov rax, qword [0x1408f8c20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003ad20
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001c08b
jmp 0x14001c076
call fcn.140072820
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001c1a0
nop dword [rax + rax]
call fcn.14003f2a0
lea rax, [0x140af908e]
mov ebx, 0x19
call fcn.14003fb20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003f860
lea rax, [0x140af9075]
mov ebx, 0x19
call fcn.14003fb20
mov eax, dword [rsp + 0x34]
call fcn.14003f860
nop
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140ae7ef5]
mov ebx, 0xd
call fcn.14003d800
nop dword [rax + rax]
cmp eax, 0x5af
je 0x14001c140
call fcn.14003f2a0
lea rax, [0x140af908e]
mov ebx, 0x19
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
call fcn.14003f860
lea rax, [0x140af9075]
mov ebx, 0x19
call fcn.14003fb20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003f860
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140b0232c]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.14003d800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001bfe0