joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801488b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
sub rsp, 0x20
mov r13d, r8d
movsxd rdi, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x40000
mov rcx, r9
mov r12, r9
call fcn.1801603e0
cmp edi, r13d
jg 0x180148a66
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r14
or r14, 0xffffffffffffffff
lea rbp, [rbx + rdi*8]
nop
nop
mov rbx, qword [rbp]
mov r8d, dword [rbp]
shr rbx, 6
and r8d, 0x3f
mov ecx, r8d
mov rax, rbx
shr rax, cl
test rax, rax
jne 0x180148a81
cmp r8d, 0xe
jle 0x1801489f5
lea ecx, [r8 - 0xe]
shr rbx, cl
shl rbx, 4
add rbx, r12
cmp byte [rbx], al
jne 0x180148a75
mov eax, dword [rbx]
mov rsi, qword [rbx + 8]
mov ecx, eax
movzx eax, al
and ecx, 0xffffff00
add ecx, 0x100
xor ecx, eax
test rsi, rsi
mov dword [rbx], ecx
je 0x1801489da
sar ecx, 8
mov eax, 4
movsxd rcx, ecx
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.18004a530
xor r9d, r9d
mov qword [rbx + 8], rax
mov eax, dword [rbx]
sar eax, 8
sub eax, 1
test eax, eax
jle 0x1801489c1
xor r8d, r8d
nop
nop
nop
nop
mov eax, dword [r8 + rsi]
mov rdx, qword [rbx + 8]
add r9d, 1
mov dword [r8 + rdx], eax
mov eax, dword [rbx]
add r8, 4
sar eax, 8
sub eax, 1
cmp r9d, eax
jl 0x1801489a0
mov rcx, rsi
call fcn.18015fde0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
sar rcx, 8
mov dword [rax + rcx*4 - 4], edi
jmp 0x180148a47
mov ecx, 4
call fcn.18004a530
movsxd rcx, dword [rbx]
sar rcx, 8
mov qword [rbx + 8], rax
mov dword [rax + rcx*4 - 4], edi
jmp 0x180148a47
test r8d, r8d
je 0x180148a47
mov eax, SafeArrayDestroy
sub eax, r8d
movzx ecx, al
shl rbx, cl
mov ecx, eax
mov eax, 1
shl rbx, 4
shl eax, cl
add rbx, r12
test eax, eax
movsxd rcx, eax
je 0x180148a47
nop
cmp byte [rbx], 0
jne 0x180148a7b
cmp qword [rbx + 8], 0
jne 0x180148a7b
mov byte [rbx], r8b
and dword [rbx], 0xff
mov eax, edi
shl eax, 8
add rbx, 0x10
or dword [rbx - 0x10], eax
sub rcx, 1
jne 0x180148a20
add edi, 1
add rbp, 8
cmp edi, r13d
jle 0x180148900
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
call fcn.1801483d0
int3
call fcn.1801483d0
int3
call fcn.1801483d0
int3
Function at 0x18015ffd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x1802984a0]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.18016c3a0
test rax, rax
je 0x180160024
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x1801600b9
mov ecx, 2
call fcn.18016e350
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.1801603e0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1801600a5
test ebx, ebx
jne 0x1801600a5
lea ecx, [rax + 2]
call fcn.18016e350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1801600e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5b8
mov rcx, qword [0x1802984a0]
call fcn.18016c3a0
test rax, rax
je 0x180160115
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
add rsp, 0x5b8
ret
mov ecx, 2
mov qword [rsp + 0x5b0], rbx
call fcn.18016e350
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.1801603e0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18016019e
test ebx, ebx
jne 0x18016019e
lea ecx, [rax + 2]
call fcn.18016e350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x5b8
ret
Function at 0x1801630d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
test r8, r8
mov rbp, r9
mov rsi, r8
mov r12d, edx
mov r13, rcx
jne 0x18016311c
call fcn.180169240
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rax], SafeArrayUnaccessData
call fcn.18015ffd0
xor eax, eax
jmp 0x1801631c2
mov qword [rsp + 0x50], rdi
call fcn.180165de0
mov edx, 0x2d8
mov ecx, 1
call fcn.180165780
test rax, rax
mov rdi, rax
je 0x1801631a8
call fcn.18016c710
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.18016c4f0
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
test rcx, rcx
lea r8, [rsp + 0x60]
mov rdx, r12
cmovne r8, rcx
mov r9, rdi
mov rcx, r13
mov qword [rsp + 0x28], r8
lea r8, [0x180163030]
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov qword [rdi + 8], 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1801631bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.180160500
test ebx, ebx
je 0x1801631bb
mov ecx, ebx
call fcn.1801692a0
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret
Function at 0x1801639e0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
cmp edx, 1
mov rbx, r8
jne 0x180163b47
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, SysAllocStringByteLen
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180163a38
mov rcx, rax
mov dword [rax], SysAllocStringByteLen
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x180163a40
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rbx + 8]
mov qword [rsp + 0x38], rsi
mov esi, dword [rbx + 4]
mov qword [rsp + 0x40], rdi
mov edi, dword [rbx + 0xc]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x10]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12d, 2
je 0x180163a85
bts edi, 0xf
mov eax, esi
mov ecx, 1
mov dword [0x1802984dc], r12d
shl eax, 8
mov dword [0x1802984e8], esi
mov dword [0x1802984ec], ebp
add eax, ebp
mov dword [0x1802984e0], edi
mov dword [0x1802984e4], eax
call fcn.18016e4b0
mov r12, qword [rsp + 0x48]
test eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
je 0x180163a38
call fcn.18016c980
test eax, eax
je 0x180163b3a
call fcn.180175cf0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x18029a7d8], rax
call fcn.180175b20
mov qword [0x1802984b8], rax
call fcn.1801752b0
test eax, eax
js 0x180163b35
call fcn.180175a10
test eax, eax
js 0x180163b30
call fcn.180175680
test eax, eax
js 0x180163b30
xor ecx, ecx
call fcn.180167100
test eax, eax
jne 0x180163b30
add dword [0x1802984b0], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
call fcn.1801755f0
call fcn.18016c4a0
call fcn.18016e510
xor eax, eax
add rsp, 0x20
pop rbx
ret
test edx, edx
jne 0x180163b90
mov eax, dword [0x1802984b0]
test eax, eax
jle 0x180163a38
sub eax, 1
cmp dword [0x180298538], edx
mov dword [0x1802984b0], eax
jne 0x180163b6f
call fcn.180167330
test rbx, rbx
jne 0x180163c09
call fcn.1801755f0
call fcn.18016c4a0
call fcn.18016e510
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
cmp edx, 2
jne 0x180163bfd
call fcn.180165de0
mov edx, 0x2d8
mov ecx, 1
call fcn.180165780
test rax, rax
mov rbx, rax
je 0x180163a38
mov ecx, dword [0x1802960b8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
test eax, eax
je 0x180163bed
xor edx, edx
mov rcx, rbx
call fcn.18016c4f0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rbx + 8], 0xffffffffffffffff
mov dword [rbx], eax
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.180160500
xor eax, eax
add rsp, 0x20
pop rbx
ret
cmp edx, 3
jne 0x180163c09
xor ecx, ecx
call fcn.18016c920
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18016e407
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180295a70]
jne 0x1801604fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1801604f6
repz ret
ror rcx, 0x10
jmp 0x18016e360
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180298610]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180298708]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18016e3e5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180298610]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18016e407
mov rax, qword [rsp + 0x88]
mov qword [0x180298708], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1802986a8], rax
mov rax, qword [0x180298708]
mov qword [0x180298580], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180298690], rax
mov dword [0x180298570], 0xc0000409
mov dword [0x180298574], 1
mov rax, qword [0x180295a70]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180295a78]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180298608], eax
mov ecx, 1
call fcn.18016e350
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18024b0d8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180298608], 0
jne 0x18016e48e
mov ecx, 1
call fcn.18016e350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180170790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x1801707ce
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x1801707b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x1801709b5
mov ecx, 3
call fcn.180180ad0
cmp eax, 1
je 0x18017096c
mov ecx, 3
call fcn.180180ad0
test eax, eax
jne 0x180170805
cmp dword [0x1802984c8], 1
je 0x18017096c
cmp edi, 0xfc
je 0x1801709b5
mov qword [rsp + 0x50], rbp
lea rbp, [0x180298af0]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.18016bef0
test eax, eax
je 0x180170849
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.18015ff30
lea rdx, [0x180298b09]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x180298c0d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x180170899
lea r8, str._program_name_unknown_
lea rcx, [0x180298b09]
mov edx, 0x2fb
call fcn.18016bef0
test eax, eax
je 0x180170899
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.18015ff30
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180298b09]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x1801708e8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x180298e04]
lea r9d, [rax + 3]
lea r8, [0x18024b694]
sub rdx, rcx
call fcn.180160d40
test eax, eax
je 0x1801708e8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.18015ff30
lea r8, [0x18024b690]
mov edx, 0x314
mov rcx, rbp
call fcn.180179420
test eax, eax
je 0x180170914
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.18015ff30
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.180179420
test eax, eax
je 0x180170944
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.18015ff30
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.180180870
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x1801709b5
cmp rax, 0xffffffffffffffff
je 0x1801709b5
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1801709d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.180180ad0
cmp eax, 1
je 0x180170a02
mov ecx, 3
call fcn.180180ad0
test eax, eax
jne 0x180170ab6
cmp dword [0x1802984c8], 1
jne 0x180170ab6
mov qword [rsp + 0x48], rbx
lea rbx, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x180170a2e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x180170a18
jmp 0x180170aa2
cmp edi, 0x17
jae 0x180170aa2
mov ecx, 3
call fcn.180180ad0
cmp eax, 1
je 0x180170a59
mov ecx, 3
call fcn.180180ad0
test eax, eax
jne 0x180170aa2
cmp dword [0x1802984c8], 1
jne 0x180170aa2
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x180170aa2
cmp rax, 0xffffffffffffffff
je 0x180170aa2
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.180170790
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x180175b20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x180298f68]
test eax, eax
jne 0x180175b73
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x180175b53
mov dword [0x180298f68], 1
jmp 0x180175b8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x180175b6d
mov dword [0x180298f68], 2
jmp 0x180175c69
mov eax, dword [0x180298f68]
cmp eax, 1
jne 0x180175c60
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x180175cb3
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x180175bb5
add rbx, 2
cmp word [rbx], 0
jne 0x180175ba1
add rbx, 2
cmp word [rbx], 0
jne 0x180175ba1
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x180175c53
mov rcx, rbp
call fcn.180165710
test rax, rax
mov rsi, rax
je 0x180175c53
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x180175c2d
mov rcx, rsi
call fcn.180160500
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x180175c39
cmp eax, 2
je 0x180175c69
test eax, eax
jne 0x180175cb3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x180175cb3
cmp byte [rax], 0
je 0x180175c92
nop
add rax, 1
cmp byte [rax], 0
jne 0x180175c80
add rax, 1
cmp byte [rax], 0
jne 0x180175c80
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.180165710
test rax, rax
mov rdi, rax
jne 0x180175cc5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.180161690
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x180177d00
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180295a70]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180177d47
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801604e0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.180160cd0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801604e0
add rsp, 0x38
ret

Function at 0x180179600
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0xb0
mov rax, qword [0x180295a70]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov esi, ecx
mov r9d, 0x78
and ecx, 0x3ff
mov rbp, r8
mov ebx, edx
lea edx, [r9 - 0x77]
lea r8, [rsp + 0x20]
bts ecx, 0xa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1801796e9
movzx ecx, byte [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0xc8], rdi
test cl, cl
lea r8, [rsp + 0x20]
mov edi, edx
je 0x18017969a
nop
lea eax, [rcx - 0x61]
add r8, 1
cmp al, 5
ja 0x180179680
add cl, 0xd9
jmp 0x18017968a
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x18017968a
add cl, 0xf9
movsx eax, cl
mov cl, byte [r8]
add edi, edi
test cl, cl
lea edi, [rax + rdi*8 - 0x30]
jne 0x180179670
cmp esi, edi
je 0x1801796dc
test ebx, ebx
je 0x1801796dc
mov rdi, qword [rbp]
movzx eax, byte [rdi]
lea rcx, [rdi + 1]
nop
cmp al, 0x41
jl 0x1801796b8
cmp al, 0x5a
jle 0x1801796be
sub al, 0x61
cmp al, 0x19
ja 0x1801796c9
mov al, byte [rcx]
add edx, 1
add rcx, 1
jmp 0x1801796b0
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp edx, ecx
je 0x1801796e1
mov eax, 1
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1801604e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x180180870
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.18016c2b0
xor ebx, ebx
cmp qword [0x180299260], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x18018099c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x180180aaf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180180aaf
mov rcx, rax
call fcn.18016c1e0
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180299260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18016c1e0
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180299268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18016c1e0
lea rcx, [rsp + 0x98]
mov qword [0x180299270], rax
call fcn.180167060
test eax, eax
je 0x18018094f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.18015ff30
cmp dword [rsp + 0x98], 2
jne 0x18018099c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18016c1e0
test rax, rax
mov qword [0x180299280], rax
je 0x18018099c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18016c1e0
mov qword [0x180299278], rax
mov rcx, qword [0x180299278]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x180180a48
cmp qword [0x180299280], rbp
je 0x180180a48
call fcn.18016c3a0
mov rcx, qword [0x180299280]
mov rsi, rax
call fcn.18016c3a0
test rsi, rsi
mov r12, rax
je 0x180180a48
test rax, rax
je 0x180180a48
call rsi
test rax, rax
je 0x180180a13
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180180a13
test byte [rsp + 0x40], 1
jne 0x180180a48
lea rcx, [rsp + 0x30]
call fcn.1801670b0
test eax, eax
je 0x180180a35
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.18015ff30
cmp dword [rsp + 0x30], 4
jb 0x180180a42
bts edi, 0x15
jmp 0x180180a86
bts edi, 0x12
jmp 0x180180a86
mov rcx, qword [0x180299268]
cmp rcx, rbp
je 0x180180a86
call fcn.18016c3a0
test rax, rax
je 0x180180a86
call rax
test rax, rax
mov rbx, rax
je 0x180180a86
mov rcx, qword [0x180299270]
cmp rcx, rbp
je 0x180180a86
call fcn.18016c3a0
test rax, rax
je 0x180180a86
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180299260]
call fcn.18016c3a0
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x180180aaf
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180180ab1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret