joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x140001328
cmp rax, rbx
jne 0x14000131b
mov ebx, 1
mov esi, ebx
jmp 0x14000132d
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001300
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x140001343
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400013a8
mov eax, dword [0x140003640]
test eax, eax
jne 0x1400013a2
mov dword [0x140003640], ebx
lea r15, [0x1400022c0]
lea rdi, [0x1400022a8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001394
test eax, eax
jne 0x140001398
cmp qword [rdi], 0
je 0x140001389
mov rax, qword [rdi]
mov rcx, qword [0x140002288]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000136a
test eax, eax
je 0x1400013a8
mov eax, 0xff
jmp 0x140001484
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400013cf
lea rdx, [0x1400022a0]
lea rcx, [0x140002290]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x1400013dc
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001410
lea rcx, [0x140003648]
call fcn.140001650
test eax, eax
je 0x140001410
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [0x140002288]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.14000119c
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x140001440
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x140001455
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x140001484
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14012b000
add rsp, 0x28
jmp 0x1400012dc

Function at 0x140001550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000159c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001594
cmp dword [rcx + 0x3c], edx
jl 0x140001594
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001594
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000159c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140011415
Capabilities:
Terminate process

Disassembly:
jmp 0x14001b9a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011519
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001c4d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001c4f0
xor al, al
jmp 0x14001c571
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001c503
xor al, al
jmp 0x14001c571
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001c52d
xor al, al
jmp 0x14001c571
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001c541
xor al, al
jmp 0x14001c571
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001c553
xor al, al
jmp 0x14001c571
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001c56f
xor al, al
jmp 0x14001c571
mov al, 1
add rsp, 0x38
ret
Function at 0xf3a0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf3a237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xf3a0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf3a0c7
add dl, dl
jne 0xf3a0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf3a14e
xor eax, eax
add dl, dl
jne 0xf3a0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf3a205
add dl, dl
jne 0xf3a10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3a11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3a128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3a135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xf3a142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xf3a0d6
mov eax, 1
add dl, dl
jne 0xf3a15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3a16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf3a153
sub eax, ebx
mov ebx, 1
jne 0xf3a1a4
mov ecx, 1
add dl, dl
jne 0xf3a186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf3a193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf3a17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf3a0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf3a1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf3a1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf3a1b5
cmp eax, 0x7d00
jae 0xf3a1f3
cmp eax, 0x500
jb 0xf3a1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf3a0d6
cmp eax, 0x7f
ja 0xf3a1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf3a0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xf3a22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xf3a0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005080
Capabilities:
Encode data using xor

Disassembly:
inc r14
xor rax, rax
dec rdi
mov r12, qword [rsp + rax]
nop
mov rax, 0x2ccc92ea
xor rsi, r10
mov r11, 0x2cda6b9e
dec r13
xor rax, r11
shr rbx, 0x19
sub r12, rax
sub r13, 0xe
mov rdi, 0x1417f05e
xor r15, r10
mov r14, 0x140d60a6
shl r13, 0xe
xor rdi, r14
rol r11, 0x2a
add rdi, r12
push r11
pop r15
mov r15, qword [rdi]
push rsi
pop rbx
mov r11, 0x51dd0ec8
xor rbx, rdi
mov r13, 0x51e44168
sub r10, rax
xor r11, r13
xorps xmm12, xmm9
add r11, r12
xorps xmm10, xmm0
mov r12, 0x5ddbc8c1
add rbx, r10
mov r14, 0x5ddb6086
shr rbx, 0x1a
xor r12, r14
dec rdi
mov r14, 0xbc
and rax, 0xe6
mov r13, 0xb8
nop
xor r14, r13
test r10, rsi
push r11
xor r13, rsi
push r12
push rax
pop rsi
push r15
inc rdi
sub rsp, 0x20
and rax, r10
mov rcx, r11
mov rsi, r10
mov rdx, r12
shr r11, 0x29
mov r8, r14
sub r10, 0xad
lea r9, [rsp]
rol r12, 0x3f
call r15
rol r11, 0x2a
add rsp, 0x20
xor r14, rsi
pop rax
mov r15, r14
pop r10
or r14, r12
pop rbx
xor r13, rsi
xor rdi, rdi
xorps xmm0, xmm4
lea rsi, [rbx + rdi]
nop
mov r14b, byte [rsi]
rol r11, 0x28
xor r14b, 0x65
and r11, 0x27
add r14b, 0x4d
nop
mov byte [rsi], r14b
ror r12, 0x24
inc rdi
shr r12, 0x15
cmp rdi, r10
push r12
pop r13
jne 0x140005065
and r11, r15
mov r13, 0xf7
cmp rsi, r15
mov rdi, 0xd7
and r12, r15
xor r13, rdi
xor r11, rsi
push rbx
push r12
pop rdi
sub rsp, 0x20
add r14, rsi
mov rcx, rbx
xchg r12, r14
mov rdx, r10
shl rbx, 0x32
mov r8, r13
or r11, rsi
lea r9, [rsp]
xorps xmm14, xmm9
call rax
nop
add rsp, 0x20
ror rbx, 0x39
ret

Function at 0x14004cad0
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x60
mov rdx, rcx
lea rcx, [rsp + 0x40]
call qword [0x1401a9808]
cmp qword [rax + 0x18], 8
jb 0x14004caee
mov rax, qword [rax]
xor ecx, ecx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x20], 3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rsp + 0x40]
mov rdi, rax
call fcn.1400524a0
cmp rdi, 0xffffffffffffffff
je 0x14004cb52
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x14004cb52
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x14004dbd0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1402bb010]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.1401706d2
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.ntdll.dll
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
xor eax, eax
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
test rbx, rbx
je 0x14004dc8d
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004dc6f
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x24]
call rax
movzx eax, word [rsp + 0x20]
mov dword [rsp + 0x20], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x24], 0xa
jne 0x14004dc8d
cmp dword [rsp + 0x20], 0x466e
jb 0x14004dc8d
xor al, al
jmp 0x14004dc8f
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14016ee40
add rsp, 0x250
pop rbx
ret
Function at 0x14006c130
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1402bb010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r13b
xor r8d, r8d
lea rdx, [0x1401b5426]
call fcn.140047980
mov dword [rsp + 0x30], 1
mov r12, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
jb 0x14006c1ad
mov r14, qword [r14]
test r14, r14
je 0x14006c324
test r12d, r12d
je 0x14006c324
mov ecx, 0x10
call qword [0x1401a9a90]
mov rsi, rax
test rax, rax
je 0x14006c324
mov r9d, 0x10
xor r8d, r8d
mov edx, r9d
mov rcx, rax
call qword [0x1401a9840]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14006c324
mov r8, rsi
mov edx, 0x10
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebx, eax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x14006c324
mov eax, r12d
and eax, 0xfffffff0
add eax, 0x10
mov dword [rsp + 0x68], eax
mov ecx, eax
call qword [0x1401a9a90]
mov rbp, rax
test rax, rax
je 0x14006c324
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, rbp
mov r8d, r12d
mov rdx, r14
mov rcx, rsi
call fcn.14016c1e0
test eax, eax
jne 0x14006c312
lea r8d, [rax + 0x10]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14006bcd0
mov rbx, rax
cmp r15, rax
je 0x14006c2bf
mov rcx, r15
call fcn.140047920
movups xmm0, xmmword [rbx]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rsp + 0x48]
call fcn.140047920
mov r8d, dword [rsp + 0x68]
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.14006bcd0
mov rbx, rax
cmp rdi, rax
je 0x14006c308
mov rcx, rdi
call fcn.140047920
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rsp + 0x48]
call fcn.140047920
mov rcx, rbp
call qword [0x1401a9a78]
mov rcx, rsi
call qword [0x1401a9a78]
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14016ee40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400740c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140074121
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400740e0
mov ecx, dword [r10]
jmp 0x14007420a
cmp ecx, 0x4e0
jb 0x14007420a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140074140
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140074190
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140075760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x1400757a4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140075790
ret

Function at 0x140075920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140075954
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140075940
ret
Function at 0x140081470
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x170
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1402bb010]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0xf
mov byte [rcx], al
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.1401706d2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14008150d
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400814f6
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140047980
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14016ee40
add rsp, 0x170
pop rbx
ret
Function at 0x14008dff0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402bb010]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor edx, edx
lea rcx, [0x14008df00]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
lea r8, [0x14008dfb0]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
mov rax, qword [0x1402f1e28]
mov rcx, qword [0x1402f1e20]
sub rax, rcx
sar rax, 5
mov r15, qword [0x1402f1cf0]
mov rbx, qword [0x1402f1ce8]
sub r15, rbx
sar r15, 2
cmp rax, r15
cmovb r15, rax
xor r12d, r12d
mov esi, r12d
test r15, r15
je 0x14008e20a
mov r14d, r12d
nop
add rcx, r14
cmp qword [rcx + 0x18], 8
jb 0x14008e09d
mov rcx, qword [rcx]
call fcn.14008dc30
mov edi, eax
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x80]
call fcn.1401706d2
mov word [rsp + 0x20], di
mov r9d, 0x80
lea r8, [rsp + 0x80]
lea edx, [r9 - 0x78]
mov ecx, dword [rbx + rsi*4]
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
test eax, eax
je 0x14008e1eb
mov word [rsp + 0x20], di
mov r9d, 8
lea r8, [rsp + 0x68]
lea edx, [r9 - 4]
mov rax, qword [0x1402f1ce8]
mov ecx, dword [rax + rsi*4]
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
test eax, eax
je 0x14008e1eb
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140053ee0
nop
mov rbp, qword [0x1402f1e38]
mov rbx, rbp
mov rdi, qword [rbp + 8]
cmp byte [rdi + 0x19], 0
jne 0x14008e192
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x40]
call fcn.1400529e0
shr eax, 0x1f
test al, al
je 0x14008e16c
mov rdi, qword [rdi + 0x10]
jmp 0x14008e172
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x14008e151
cmp rbx, rbp
je 0x14008e192
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400529e0
shr eax, 0x1f
test al, al
je 0x14008e1cf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [0x1402f1e38]
call fcn.14008e880
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [0x1402f1e38]
call fcn.14008e8e0
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x80]
call fcn.140053ee0
nop
lea rcx, [rsp + 0x40]
call fcn.1400524a0
inc rsi
add r14, 0x20
cmp rsi, r15
jae 0x14008e20a
mov rcx, qword [0x1402f1e20]
mov rbx, qword [0x1402f1ce8]
jmp 0x14008e090
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14016ee40
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140090740
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1402bb010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
movzx ecx, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [r8 + 1]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 2]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 3]
xor rcx, rax
imul rcx, rdx
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rbx, qword [rsi + 8]
mov rcx, r8
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8]
cmp rbx, rax
je 0x14009080c
mov rbx, qword [rdx + rcx*8 + 8]
mov rbx, qword [rbx]
nop
cmp rbx, rax
je 0x14009080c
mov rbx, qword [rbx + 8]
mov edx, dword [rbx + 0x10]
cmp dword [r9], edx
jne 0x1400907e0
mov rdx, rdi
mov rcx, rsi
call fcn.140090960
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14009093b
mov qword [rsp + 0x40], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140090846
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
add r8, r8
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140090866
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140090895
cmp rax, rbx
jne 0x140090871
mov qword [rdx + r8*8], rdi
jmp 0x140090895
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140090895
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14024ccd4]
test rax, rax
jns 0x1400908b6
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400908c7
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140090930
cmp rdx, 0x200
jae 0x1400908e3
lea rdx, [rdx*8]
jmp 0x1400908f5
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400908f5
add rdx, rdx
mov rcx, rsi
call fcn.1400902d0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140090930
mov r15, qword [rax + 8]
nop word [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140090740
cmp rbx, r15
jne 0x140090910
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14016ee40
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140090a10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, r8
mov r8, rcx
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
movzx edx, byte [rdi + 0x10]
mov r9, qword [r8 + 0x30]
xor rdx, rax
movzx eax, byte [rdi + 0x11]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rdi + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rdi + 0x13]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + 0x18]
and r9, rdx
shl r9, 4
add rcx, r9
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x140090aa8
cmp rax, rdi
jne 0x140090a9e
mov rax, qword [r8 + 8]
mov qword [rcx], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
mov qword [r9 + rcx + 8], rax
jmp 0x140090ab3
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x140090ab3
cmp rax, rdi
jne 0x140090ab3
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rcx], rbx
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi]
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.140047920
mov edx, 0x38
mov rcx, rdi
call fcn.14016f49c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret