joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001278c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140012560
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012560
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012560
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012560
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012560
cmp dword [rcx + 0x84], 0xe
jbe 0x140012560
cmp dword [rcx + 0xf8], esi
je 0x140012560
mov ecx, r14d
call fcn.1400126a8
mov ecx, 2
call fcn.140019000
nop
cmp byte [0x140041740], 0
jne 0x14001262a
mov r15d, 1
mov eax, r15d
xchg dword [0x140041730], eax
test ebx, ebx
jne 0x1400125d3
mov rdi, qword [0x140033010]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140041738]
cmp rcx, rax
je 0x1400125ca
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140008ff0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140041750]
jmp 0x1400125df
cmp ebx, r15d
jne 0x1400125e5
lea rcx, [0x140041768]
call fcn.140012c5c
nop
test ebx, ebx
jne 0x1400125fc
lea rdx, [0x1400233a0]
lea rcx, [0x140023378]
call fcn.140012420
lea rdx, [0x1400233b0]
lea rcx, [0x1400233a8]
call fcn.140012420
movzx eax, byte [0x140041740]
test esi, esi
cmove eax, r15d
mov byte [0x140041740], al
jmp 0x14001262a
mov ecx, 2
call fcn.140019054
test esi, esi
jne 0x140012641
mov ecx, r14d
call fcn.14001265c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400124f0
Function at 0x140014dfc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140014c9c
call fcn.140013de4
mov dword [rax], 0x16
call fcn.140013cc4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140014c84
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140014c84
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140014cce
lock or dword [rax + 0x14], 0x10
jmp 0x140014c84
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140014ceb
mov rcx, qword [rbp + 0x10]
call fcn.14001c034
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140010158
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400146d4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140014d42
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140014c84
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140014dae
mov rcx, qword [rbp + 0x10]
call fcn.140010158
cmp eax, 0xffffffff
je 0x140014d95
mov rcx, qword [rbp + 0x10]
call fcn.140010158
cmp eax, 0xfffffffe
je 0x140014d95
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140010158
movsxd rdi, eax
lea rsi, [0x140041790]
mov rcx, rbx
sar rdi, 6
call fcn.140010158
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140014d9c
lea rax, [0x140033270]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140014dae
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140014de4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140014de0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140014de0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140014c87
jmp 0x140014c54
Function at 0x140002050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002149
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002151
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000218a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002160
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021b5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021db
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021c0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a4a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000a551
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140010340
cmp rax, 1
jne 0x14000a587
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a52d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a520
cmp rcx, 1
jb 0x14000a587
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a4f0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c820
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140010004
int3
Function at 0x14000a610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a655
xor al, al
jmp 0x14000a6a2
cmp word [rbx], 0
je 0x14000a66d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a660
cmp word [rsp + 0x30], 0
je 0x14000a69b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a6c3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a680
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c820
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.140010004
int3
Function at 0x14000b7a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x140030dd8]
test rcx, rcx
je 0x14000b7db
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b7ce
mov rcx, qword [0x140030dd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140030dd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140030de8], 0
je 0x14000b8ce
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x14002a930]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140043610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b8af
test al, 0x10
je 0x14000b8af
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b855
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000d0e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d12a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d12a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d12a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d12a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d12a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000d12c
xor al, al
add rsp, 0x28
ret

Function at 0x14000fdf4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fe63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fe63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fe63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fe63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fe63
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fe63
cmp dword [rcx + 0xf8], 0
je 0x14000fe63
mov ecx, ebx
call fcn.14000ff14
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fcf0
nop
cmp dword [rbp + 0x20], 0
je 0x14000feb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000febc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fdf4

Function at 0x14000fff8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fe63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fe63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fe63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fe63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fe63
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fe63
cmp dword [rcx + 0xf8], 0
je 0x14000fe63
mov ecx, ebx
call fcn.14000ff14
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fcf0
nop
cmp dword [rbp + 0x20], 0
je 0x14000feb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000febc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fdf4
Function at 0x1400195e4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001966b
mov rsi, rbx
cmp word [rax], bp
je 0x14001962a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019614
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019610
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016e14
mov rdi, rax
test rax, rax
je 0x140019658
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020850
mov rbp, rdi
xor ecx, ecx
call fcn.140015e38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001bc34
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001bc4a
mov al, 1
jmp 0x14001bcaa
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001bc5b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001bca8
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019d88
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001bca8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001bca8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001bca8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001bcaa
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400200c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400200e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400200e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140006c40
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x700
mov rax, qword [0x1400543a8]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov rdi, qword [0x140054fc8]
lea eax, [rdx - 0x40253]
mov r10d, r8d
mov ebx, edx
cmp eax, 1
jbe 0x140006db6
mov r9d, 0x7d
lea r8, [rsp + 0x3f0]
mov ecx, r10d
lea edx, [r9 - 0x7b]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140006da2
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x3d0
call sub.msvcrt.dll_memset
mov rcx, qword [rdi]
lea r8, [rsp + 0x354]
sar ebx, 0x1f
mov r9d, 0x40
lea eax, [rbx + 4]
and ebx, 1
mov dword [rsp + 0x3d4], eax
lea edx, [rbx + 0x6d]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140006da2
mov rcx, qword [rdi]
lea edx, [rbx + 0x6f]
mov ebx, 0x100
lea r8, [rsp + 0x4f0]
mov r9d, ebx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140006da2
lea r9, [rsp + 0x3f0]
mov edx, ebx
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0x150]
call fcn.140008674
mov ecx, 0x80000000
mov ebx, eax
add eax, ecx
test ecx, eax
jne 0x140006d39
cmp ebx, 0x8007007a
jne 0x140006db6
call fcn.140007244
mov rax, qword [rdi + 0x48]
test rax, rax
jne 0x140006d65
lea r9, str.EVENT_NOTIFICATION_DISMISSED_1E2D67D6_F596_4640_84F6_CE09D630E983
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x48], rax
test rax, rax
je 0x140006db6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.14000703c
test eax, eax
jne 0x140006d7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x3d4]
lea rdx, [rsp + 0x354]
lea rcx, [rsp + 0x150]
call fcn.140007140
test eax, eax
je 0x140006da2
xor ebx, ebx
jmp 0x140006db6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.140031020
mov rbx, qword [rsp + 0x710]
add rsp, 0x700
pop rdi
ret
Function at 0x14000792c
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [0x1400543a8]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov edi, ecx
mov r14d, r9d
mov rcx, qword [0x140054fc8]
mov esi, r8d
mov ebx, edx
call fcn.1400078d8
mov rax, qword [0x140054fc8]
lea rcx, [rsp + 0x64]
xor edx, edx
mov byte [rax + 0x50], 1
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
mov rcx, qword [0x140054fc8]
lea r8, [rbp + 0xd0]
mov r9d, 0x100
mov edx, ebx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140007ace
mov rcx, qword [0x140054fc8]
lea r8, [rbp + 0x2d0]
mov r9d, 0x100
mov edx, esi
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140007ace
mov r9d, 0x7d
lea r8, [rbp - 0x30]
mov ecx, edi
lea ebx, [r9 - 0x7b]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140007a11
lea r8, [0x14003f468]
lea rcx, [rbp + 0xd0]
call fcn.1400085d4
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0xd0]
call fcn.1400085d4
mov rcx, qword [0x140054fc8]
mov dword [rsp + 0x30], LoadRegTypeLib
mov dword [rsp + 0x44], 8
mov rax, qword [rcx]
mov qword [rsp + 0x3c], rax
mov rax, qword [rcx + 0x268]
xor ecx, ecx
mov qword [rsp + 0x34], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x4c], rax
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x54], 0xffff
mov dword [rbp - 0x34], 0xe6
mov dword [rsp + 0x48], r14d
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140007ace
mov r9b, 1
mov byte [rsp + 0x20], 1
mov r8b, r9b
lea rdx, [0x140000000]
mov ecx, 0xe
call qword [sym.imp.DUI70.dll_InitProcessPriv]
test eax, eax
js 0x140007ac8
mov ecx, ebx
call qword [sym.imp.DUI70.dll_InitThread]
test eax, eax
js 0x140007abb
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
call qword [sym.imp.DUI70.dll_UnInitThread]
lea rcx, [0x140000000]
call qword [sym.imp.DUI70.dll_UnInitProcessPriv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.140031020
add rsp, 0x5e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140007af4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x6e0]
sub rsp, 0x7e0
mov rax, qword [0x1400543a8]
xor rax, rsp
mov qword [rbp + 0x6d0], rax
mov rcx, qword [0x140054fc8]
mov esi, r9d
mov ebx, r8d
mov edi, edx
call fcn.1400078d8
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, LoadRegTypeLib
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rbp + 0x2d0]
mov r8d, 0x200
call sub.msvcrt.dll_memset
mov rcx, qword [0x140054fc8]
lea r8, [rbp + 0xd0]
mov r9d, 0x100
mov edx, 0x54
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140007ce9
mov rcx, qword [0x140054fc8]
lea r8, [rbp + 0x4d0]
mov r9d, 0x100
mov edx, edi
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140007ce9
test ebx, ebx
je 0x140007bcc
mov rcx, qword [0x140054fc8]
lea r8, [rbp + 0x2d0]
mov r9d, 0x100
mov edx, ebx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_LoadStringW]
jmp 0x140007bd1
mov eax, 1
test eax, eax
je 0x140007ce9
mov ecx, dword [rbp + 0x728]
lea r8, [rbp - 0x30]
mov r9d, 0x7d
lea ebx, [r9 - 0x7b]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140007c1c
lea r8, [0x14003f468]
lea rcx, [rbp + 0xd0]
call fcn.1400085d4
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0xd0]
call fcn.1400085d4
mov rcx, qword [0x140054fc8]
mov dword [rsp + 0x30], LoadRegTypeLib
mov dword [rsp + 0x44], 9
mov rax, qword [rcx]
mov qword [rsp + 0x3c], rax
mov rax, qword [rcx + 0x268]
xor ecx, ecx
and qword [rbp - 0x44], 0
mov qword [rsp + 0x34], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x4c], rax
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x5c], rax
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x54], 0xffff
mov dword [rbp - 0x34], 0xe6
mov dword [rsp + 0x48], esi
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140007ce9
mov r9b, 1
mov byte [rsp + 0x20], 1
mov r8b, r9b
lea rdx, [0x140000000]
mov ecx, 0xe
call qword [sym.imp.DUI70.dll_InitProcessPriv]
test eax, eax
js 0x140007ce3
mov ecx, ebx
call qword [sym.imp.DUI70.dll_InitThread]
test eax, eax
js 0x140007cd6
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
call qword [sym.imp.DUI70.dll_UnInitThread]
lea rcx, [0x140000000]
call qword [sym.imp.DUI70.dll_UnInitProcessPriv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x6d0]
xor rcx, rsp
call fcn.140031020
mov rbx, qword [rsp + 0x800]
add rsp, 0x7e0
pop rdi
pop rsi
pop rbp
ret