joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400706b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 1
je 0x14004a342
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400706b0
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
mov rax, qword [rcx + 0x70]
test rax, rax
jne 0x1400707b8
cmp dword [rcx + 0x98], 0xffffffff
jne 0x1400707b3
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x140070805
mov edi, r8d
mov dword [r11 + 8], r8d
xor r14d, r14d
mov ebx, r14d
lea r15, [0x140d88f20]
nop word [rax + rax]
lea rax, [rsp + 0x90]
cmp edi, 0x2000000
cmovae rax, r15
lea rdx, [rbx + r12]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xa8]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140070772
mov ecx, dword [rsp + 0xa8]
test ecx, ecx
je 0x1400707ae
add rbx, rcx
sub edi, ecx
mov dword [rsp + 0x90], edi
cmp rbx, rbp
jge 0x1400707ae
jmp 0x140070720
test rbx, rbx
jne 0x1400707ae
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140015a00
nop
mov r8, rax
lea edx, [rbx + 1]
mov rcx, r13
call fcn.14004aff0
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x1400707a8
mov rcx, qword [rsp + 0x30]
call fcn.14000ade0
or rax, 0xffffffffffffffff
jmp 0x140070819
mov rax, rbx
jmp 0x140070819
test rax, rax
je 0x14007080b
call fcn.140070130
test al, al
je 0x14007080b
mov rcx, qword [rsi + 0x70]
call fcn.1400b0950
test eax, eax
je 0x14007080b
call fcn.1400aeeac
mov edx, dword [rax]
lea rcx, [rsp + 0x38]
call fcn.140015a00
nop
mov r8, rax
mov edx, 1
mov rcx, r13
call fcn.14004aff0
nop
mov rcx, qword [rsp + 0x38]
lock dec dword [rcx]
jne 0x140070805
mov rcx, qword [rsp + 0x38]
call fcn.14000ade0
or rax, 0xffffffffffffffff
jmp 0x140070819
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call fcn.140049b80
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140070840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 2
je 0x14004a3e2
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140070840
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
cmp qword [rcx + 0x70], 0
jne 0x140070935
cmp dword [rcx + 0x98], 0xffffffff
jne 0x140070935
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x14007092a
mov edi, r8d
xor r14d, r14d
mov ebx, r14d
lea r15, [0x140d88f20]
mov dword [rsp + 0x80], edi
lea rax, [rsp + 0x80]
cmp edi, 0x2000000
cmovae rax, r15
lea rdx, [rbx + r12]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x98]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400708f4
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x140070930
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jge 0x140070930
jmp 0x1400708a1
test rbx, rbx
jne 0x140070930
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140015a00
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call fcn.14004aff0
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x14007092a
mov rcx, qword [rsp + 0x30]
call fcn.14000ade0
or rax, 0xffffffffffffffff
jmp 0x14007093a
mov rax, rbx
jmp 0x14007093a
call fcn.140049e70
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140071290
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 8]
mov rbx, qword [rax + 0x78]
cmp rbx, 0xffffffffffffffff
jne 0x1400713df
cmp dword [rax + 0x98], ebx
jne 0x1400713b3
cmp qword [rax + 0x70], 0
jne 0x1400713b3
lea rbx, [rax + 0x20]
mov rcx, rbx
call fcn.14006f230
test al, al
jne 0x14007143b
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.14006ef50
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140017110
nop
mov rcx, qword [rsp + 0x80]
lock dec dword [rcx]
jne 0x140071322
mov rcx, qword [rsp + 0x80]
call fcn.14000ade0
mov dword [rsp + 0x70], 3
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140016630
test al, al
je 0x1400713a4
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.140017600
movzx ebx, al
test al, al
jne 0x140071392
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.140013020
nop
mov r8, rax
mov edx, 0xc
mov rcx, rdi
call fcn.14004aff0
nop
mov rax, qword [rsp + 0x88]
lock dec dword [rax]
jne 0x140071392
mov rcx, qword [rsp + 0x88]
call fcn.14000ade0
nop
lea rcx, [rsp + 0x30]
call fcn.1400175c0
movzx eax, bl
jmp 0x14007143d
lea rcx, [rsp + 0x30]
call fcn.1400175c0
jmp 0x14007143b
cmp rbx, 0xffffffffffffffff
jne 0x1400713df
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x1400713cb
call fcn.1400b1f08
mov ecx, eax
jmp 0x1400713d1
mov ecx, dword [rax + 0x98]
call fcn.1400b1a2c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007143b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rbp, rax
mov qword [rsp + 0x20], rax
mov r8, qword [rdi]
mov rdx, rsi
mov rcx, rdi
call qword [r8 + 0x30]
test al, al
je 0x14007142f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14007142f
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
cmp rbp, rsi
cmovge rdx, rcx
mov rdx, qword [rdx]
mov rcx, rdi
call qword [rax + 0x30]
mov al, 1
jmp 0x14007143d
mov rax, qword [rdi]
mov rdx, rbp
mov rcx, rdi
call qword [rax + 0x30]
xor al, al
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400809a0
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140dda370]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [rcx + 0xc], 0
mov rbx, rcx
jne 0x140080a66
mov ecx, dword [rcx + 8]
lea r8, [rsp + 0x20]
mov r9d, 8
mov edx, 0x1014
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400809fe
mov dword [rbx + 0xc], 3
mov eax, 3
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ac900
add rsp, 0x50
pop rbx
ret
movzx eax, word [rsp + 0x20]
cmp ax, 0x31
jne 0x140080a12
mov dword [rbx + 0xc], 3
jmp 0x140080a66
cmp ax, 0x30
jne 0x140080a21
mov dword [rbx + 0xc], 1
jmp 0x140080a66
cmp ax, 0x32
jne 0x140080a30
mov dword [rbx + 0xc], 2
jmp 0x140080a66
mov ecx, dword [rbx + 8]
mov r9d, 0xb
lea r8, [rsp + 0x30]
lea edx, [r9 + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400809df
movzx ecx, word [rsp + 0x30]
movzx eax, word [rsp + 0x20]
xor edx, edx
add ecx, 2
cmp eax, ecx
setne dl
add edx, 2
mov dword [rbx + 0xc], edx
mov eax, dword [rbx + 0xc]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ac900
add rsp, 0x50
pop rbx
ret

Function at 0x140080b10
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rdx
mov dword [rsp + 0x40], 0
mov r9d, 2
lea r8, [rsp + 0x40]
lea edx, [r9 + 0xb]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140080bb6
or r8d, 0xffffffff
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14000ed80
nop
lea rax, [0x140d8af08]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140009900
test al, al
je 0x140080ba2
mov edx, 1
mov rcx, rdi
call fcn.140050fd0
nop
mov rax, qword [rsp + 0x50]
lock dec dword [rax]
jne 0x140080bc0
mov rcx, qword [rsp + 0x50]
call fcn.14000ade0
jmp 0x140080bc0
mov rax, qword [rsp + 0x50]
lock dec dword [rax]
jne 0x140080bb6
mov rcx, qword [rsp + 0x50]
call fcn.14000ade0
xor edx, edx
mov rcx, rdi
call fcn.140050fd0
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140080bd0
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x140dda370]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0xf]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x28]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140080c4e
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14000ed80
nop
mov rdx, rax
mov rcx, rdi
call fcn.140051d80
nop
mov rcx, qword [rsp + 0x20]
lock dec dword [rcx]
jne 0x140080c58
mov rcx, qword [rsp + 0x20]
call fcn.14000ade0
jmp 0x140080c58
mov dword [rdi + 8], 0x80000000
mov qword [rdi], rbx
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac900
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140080c80
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x140dda370]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0xf]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x29]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140080cfe
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14000ed80
nop
mov rdx, rax
mov rcx, rdi
call fcn.140051d80
nop
mov rcx, qword [rsp + 0x20]
lock dec dword [rcx]
jne 0x140080d08
mov rcx, qword [rsp + 0x20]
call fcn.14000ade0
jmp 0x140080d08
mov dword [rdi + 8], 0x80000000
mov qword [rdi], rbx
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac900
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140080d30
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rax, qword [0x140dda370]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov dword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov edx, 0x100c
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140080dbf
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14000ed80
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call fcn.140008550
lea edx, [rax + 1]
mov rcx, rdi
call fcn.140050ff0
nop
mov rcx, qword [rsp + 0x20]
lock dec dword [rcx]
jne 0x140080dcc
mov rcx, qword [rsp + 0x20]
call fcn.14000ade0
jmp 0x140080dcc
mov edx, 1
mov rcx, rdi
call fcn.140050fd0
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ac900
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140080df0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov qword [rbp + 0x37], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov dword [rbp + 0x7f], 0
mov edx, 0x40
test r9d, r9d
cmovne edx, r9d
mov dword [rbp - 0x65], edx
cmp edx, 0x40
jle 0x140080e5d
movsxd rcx, edx
add rcx, rcx
call fcn.140004d70
mov qword [rbp - 0x61], rax
test rax, rax
jne 0x140080e55
call fcn.1400150c0
mov rax, qword [rbp - 0x61]
mov edx, dword [rbp - 0x65]
mov dword [rbp - 0x69], edx
jmp 0x140080e6c
lea rax, [rbp - 0x59]
mov qword [rbp - 0x61], rax
mov dword [rbp - 0x69], 0x40
mov r9d, edx
mov r8, rax
mov edx, edi
mov ecx, dword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140080e9e
lea rax, [0x140dd80a8]
mov qword [rbx], rax
lock inc dword [0x140dd80a8]
mov dword [rbp + 0x7f], 1
jmp 0x140080f44
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140080f2d
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov ecx, dword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, eax
test eax, eax
jne 0x140080ede
lea rax, [0x140dd80a8]
mov qword [rbx], rax
lock inc dword [0x140dd80a8]
mov dword [rbp + 0x7f], 1
jmp 0x140080f44
mov dword [rbp + 0x67], eax
lea rax, [rbp - 0x69]
lea rcx, [rbp + 0x67]
cmp edx, dword [rbp - 0x69]
cmovge rax, rcx
mov r8d, dword [rax]
lea rcx, [rbp - 0x69]
call fcn.140040dd0
mov r9d, dword [rbp - 0x65]
mov r8, qword [rbp - 0x61]
mov edx, edi
mov ecx, dword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140080f2d
lea rax, [0x140dd80a8]
mov qword [rbx], rax
lock inc dword [0x140dd80a8]
mov dword [rbp + 0x7f], 1
jmp 0x140080f44
or r8d, 0xffffffff
mov rdx, qword [rbp - 0x61]
mov rcx, rbx
call fcn.14000ed80
mov dword [rbp + 0x7f], 1
lea rax, [rbp - 0x59]
mov rcx, qword [rbp - 0x61]
cmp rcx, rax
je 0x140080f56
call fcn.140004d80
mov rax, rbx
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400811f0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x140dda370]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 0
test r8d, r8d
je 0x140081398
dec r8d
je 0x140081344
dec r8d
jne 0x1400813e8
mov dword [rsp + 0x54], 0x40
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 0x40
lea r9d, [r8 + 0x40]
lea r8, [rsp + 0x60]
mov edx, 0x1008
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400812f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400812a4
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x1400813e8
call fcn.140004d80
jmp 0x1400813e8
mov dword [rsp + 0x20], 0xff
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x20]
cmp dword [rsp + 0x50], 0xff
cmovle rax, rcx
mov r8d, dword [rax]
mov edx, 0xff
lea rcx, [rsp + 0x50]
call fcn.140040dd0
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x58]
mov edx, 0x1008
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400812f2
jmp 0x140081287
or r8d, 0xffffffff
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14000ed80
nop
mov rdx, rax
mov rcx, rdi
call fcn.140051d80
nop
mov rax, qword [rsp + 0x38]
lock dec dword [rax]
jne 0x140081327
mov rcx, qword [rsp + 0x38]
call fcn.14000ade0
nop
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x1400813f6
call fcn.140004d80
jmp 0x1400813f6
mov r9d, 0xd
lea r8, [rbp - 0x10]
lea edx, [r9 + 7]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400813e8
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000ed80
nop
mov rdx, rax
mov rcx, rdi
call fcn.140051d80
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x1400813f6
mov rcx, qword [rsp + 0x30]
call fcn.14000ade0
jmp 0x1400813f6
mov r9d, 9
lea r8, [rbp - 0x10]
lea edx, [r9 + 0xc]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400813e8
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x28]
call fcn.14000ed80
nop
mov rdx, rax
mov rcx, rdi
call fcn.140051d80
nop
mov rax, qword [rsp + 0x28]
lock dec dword [rax]
jne 0x1400813f6
mov rcx, qword [rsp + 0x28]
call fcn.14000ade0
jmp 0x1400813f6
mov dword [rdi + 8], 0x80000000
mov qword [rdi], 0
mov rax, rdi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400ac900
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140082210
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140dda370]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r12d, edx
mov rsi, rcx
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x38], 0
lea rdi, [0x140dd80a8]
mov qword [rsp + 0x28], rdi
lock inc dword [0x140dd80a8]
mov qword [rsp + 0x30], rdi
lock inc dword [0x140dd80a8]
mov r9d, 0xff
lea r8, [rbp - 0x80]
mov edx, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
or ebx, 0xffffffff
test eax, eax
je 0x1400822d0
mov r8d, ebx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14000ed80
mov r11, rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov qword [r11], rcx
mov rax, qword [rsp + 0x48]
lock dec dword [rax]
jne 0x1400822d0
mov rcx, qword [rsp + 0x48]
call fcn.14000ade0
mov rax, qword [rsp + 0x30]
cmp dword [rax + 8], 0
je 0x140082375
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140009fd0
nop
mov rax, qword [rsp + 0x40]
lea r9, [rsp + 0x20]
mov r8d, 0x10
lea rdx, [rsp + 0x60]
mov rcx, qword [rax + 0x10]
call fcn.140083d80
mov r11, rax
cmp byte [rsp + 0x20], 0
je 0x140082361
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x140082361
cmp r11d, 0x814
jne 0x140082361
mov r8d, ebx
lea rdx, [0x140d8b268]
lea rcx, [rsp + 0x50]
call fcn.14000c980
mov r11, rax
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [r11], rdi
mov rax, qword [rsp + 0x50]
lock dec dword [rax]
jne 0x140082361
mov rcx, qword [rsp + 0x50]
call fcn.14000ade0
nop
mov rax, qword [rsp + 0x40]
lock dec dword [rax]
jne 0x140082375
mov rcx, qword [rsp + 0x40]
call fcn.140004d80
mov rdi, qword [rsp + 0x28]
cmp dword [rdi + 8], 0
je 0x1400823ad
mov qword [rsi], rdi
lock inc dword [rdi]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x1400823a3
mov rcx, qword [rsp + 0x30]
call fcn.14000ade0
nop
mov rcx, qword [rsp + 0x28]
lock dec dword [rcx]
jmp 0x140082429
mov r9d, 0xff
lea r8, [rbp - 0x80]
mov edx, 0x59
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400823fe
mov r8d, ebx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000ed80
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov qword [rax], rdi
mov rax, qword [rsp + 0x58]
lock dec dword [rax]
jne 0x1400823f9
mov rcx, qword [rsp + 0x58]
call fcn.14000ade0
mov rdi, qword [rsp + 0x28]
mov qword [rsi], rdi
lock inc dword [rdi]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x140082421
mov rcx, qword [rsp + 0x30]
call fcn.14000ade0
nop
mov rax, qword [rsp + 0x28]
lock dec dword [rax]
jne 0x140082435
mov rcx, qword [rsp + 0x28]
call fcn.14000ade0
mov rax, rsi
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400ac900
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140082460
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x250
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x270], rbx
mov rax, qword [0x140dda370]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, edx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x20], 0
lea rcx, [0x140dd80a8]
mov qword [rdi], rcx
lock inc dword [0x140dd80a8]
mov dword [rsp + 0x20], 1
mov r9d, 0xff
lea r8, [rsp + 0x40]
mov edx, 0x5a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140082506
or r8d, 0xffffffff
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.14000ed80
mov rdx, qword [rdi]
mov rcx, qword [rax]
mov qword [rdi], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
lock dec dword [rcx]
jne 0x140082506
mov rcx, qword [rsp + 0x28]
call fcn.14000ade0
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400ac900
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x140087f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x14008803f
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1400abec0
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x140088010
sub eax, ebx
jmp 0x140088012
xor eax, eax
dec r8d
mov word [rdx], ax
jne 0x140088000
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x140088034
sub eax, ebx
jmp 0x140088036
xor eax, eax
dec edx
mov word [rcx], ax
jne 0x140088024
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x14008812f
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.140087d40
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x1400880a7
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x1400880bd
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x140087fb0
mov ecx, dword [rdi + 0x1718]
mov esi, dword [rdi + 0x58]
cmp ecx, esi
jae 0x14008812f
mov eax, dword [rdi + 0x94]
lea ebx, [r9 + rax]
cmp ecx, ebx
jae 0x140088101
sub esi, ebx
mov eax, 0x102
mov ecx, ebx
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, esi
call fcn.1400ac930
lea r11d, [rsi + rbx]
mov dword [rdi + 0x1718], r11d
jmp 0x14008812f
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x14008812f
sub ebx, ecx
sub esi, ecx
mov eax, 0x102
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, ebx
call fcn.1400ac930
add dword [rdi + 0x1718], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400973a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rdx, [0x140d9a100]
xor r9d, r9d
xor r8d, r8d
jmp fcn.14001c650

Function at 0x1400973c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r9d, r9d
lea rdx, [0x140d9a100]
lea r8d, [r9 + 1]
jmp fcn.14001c650