joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ea50
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x1d8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x43]
xor edx, edx
mov r8d, 0x101
call sub.msvcrt.dll_memset
mov dword [rsp + 0x144], 0x101
lea rax, [rsp + 0x43]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], 0x101
lea rcx, [rsp + 0x43]
lea rdx, [rsp + 0x144]
call sub.ADVAPI32.dll_GetUserNameA
cmp eax, 0
jne 0x14000eabc
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
jmp 0x14000eadc
mov eax, dword [rsp + 0x144]
mov ecx, eax
sub ecx, 1
mov dword [rsp + 0x2c], ecx
cmp eax, 1
setb al
test al, 1
jne 0x14000ebae
jmp 0x14000eae9
mov rax, qword [rsp + 0x38]
add rsp, 0x1d8
ret
mov eax, dword [rsp + 0x2c]
mov eax, eax
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], rax
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
lea rcx, [rsp + 0x43]
lea r9, [0x14020f828]
call dbg.index<i8, core::ops::range::Range<usize>, 257>
mov rcx, rax
call dbg.iter<i8>
mov rcx, rax
call dbg.map<core::slice::iter::Iter<i8>, u8, winutil::get_user_name::{closure_env#0}>
mov qword [rsp + 0x20], rax
mov r8, rdx
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x148]
call dbg.collect<core::iter::adapters::map::Map<core::slice::iter::Iter<i8>, winutil::get_user_name::{closure_env#0}>, alloc::vec::Vec<u8, alloc::alloc::Global>>
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0x170]
lea rdx, [rsp + 0x198]
call dbg.alloc::string::String::from_utf8::hacce05a9c2eda219
mov eax, 1
xor ecx, ecx
cmp byte [rsp + 0x190], 2
cmove rax, rcx
cmp rax, 0
je 0x14000ebc8
jmp 0x14000ec22
lea rcx, [0x14020f800]
lea r8, [0x14020f7e0]
mov edx, 0x21
call dbg.panic
ud2
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x1b0], rcx
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x1b8], rcx
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x1c0], rcx
mov rcx, qword [rsp + 0x1b0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b8]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x1c0]
mov qword [rax + 0x10], rcx
jmp 0x14000ec2e
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov eax, 1
xor ecx, ecx
cmp byte [rsp + 0x190], 2
cmove rax, rcx
cmp rax, 0
je 0x14000eadc
lea rcx, [rsp + 0x170]
call dbg.drop_in_place<core::result::Result<alloc::string::String, alloc::string::FromUtf8Error>>
jmp 0x14000eadc
Function at 0x140046dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov qword [rsp + 0x40], rdx
mov rbp, rcx
lea rax, str.maskcxyhbmfmtlParamiImageiOrder_typepvFilterstate
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x148], rbp
mov qword [rsp + 0x150], rdx
mov r13, rbp
add r13, 8
mov r12, rbp
add r12, 0x10
mov r15, rbp
add r15, 0x14
mov r14, rbp
add r14, 0x18
mov rbx, rbp
add rbx, 0x20
mov rdi, rbp
add rdi, 0x24
mov rsi, rbp
add rsi, 0x28
mov r11, rbp
add r11, 0x2c
mov r10, rbp
add r10, 0x30
mov r9, rbp
add r9, 0x38
mov r8, rbp
add r8, 0x3c
mov rdx, rbp
add rdx, 0x40
mov rax, rbp
add rax, 0x48
mov rcx, rbp
add rcx, 0x4c
mov qword [rsp + 0x140], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbp
lea rbp, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r13
lea r13, str.02_v_
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r12
lea r12, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], r15
lea r15, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r14
lea r14, sym.core::ptr::drop_in_place_mut_i8_::h637949a8ae805704
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], rbx
lea rbx, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rdi
lea rdi, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
lea rsi, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], r11
lea r11, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xd8], r11
mov qword [rsp + 0xe0], r10
lea r10, sym.core::ptr::drop_in_place_i64_::h9d9b7f1e2d53d204
mov qword [rsp + 0xe8], r10
mov qword [rsp + 0xf0], r9
lea r9, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xf8], r9
mov qword [rsp + 0x100], r8
lea r8, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x108], r8
mov qword [rsp + 0x110], rdx
lea rdx, sym.core::ptr::drop_in_place_mut_winapi::windef::HWND___::h45fac1da600c2187
mov qword [rsp + 0x118], rdx
mov qword [rsp + 0x120], rax
lea rax, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x130], rax
lea rax, sym.core::ptr::drop_in_place_i32_::h884b84434b97c36d
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], 0xf
lea rdx, str.TVITEMEXATVITEMEXWTVINSERTSTRUCTAhParenthInsertAfteritemex
mov r8d, 9
lea r9, str.maskcxyhbmfmtlParamiImageiOrder_typepvFilterstate
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], 0xf
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0xf
call dbg.debug_struct_fields_finish
and al, 1
movzx eax, al
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140047060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov qword [rsp + 0x40], rdx
mov rbp, rcx
lea rax, str.maskcxyhbmfmtlParamiImageiOrder_typepvFilterstate
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x148], rbp
mov qword [rsp + 0x150], rdx
mov r13, rbp
add r13, 8
mov r12, rbp
add r12, 0x10
mov r15, rbp
add r15, 0x14
mov r14, rbp
add r14, 0x18
mov rbx, rbp
add rbx, 0x20
mov rdi, rbp
add rdi, 0x24
mov rsi, rbp
add rsi, 0x28
mov r11, rbp
add r11, 0x2c
mov r10, rbp
add r10, 0x30
mov r9, rbp
add r9, 0x38
mov r8, rbp
add r8, 0x3c
mov rdx, rbp
add rdx, 0x40
mov rax, rbp
add rax, 0x48
mov rcx, rbp
add rcx, 0x4c
mov qword [rsp + 0x140], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbp
lea rbp, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r13
lea r13, str.02_v_
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r12
lea r12, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], r15
lea r15, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r14
lea r14, sym.core::ptr::drop_in_place_mut_u16_::ha9bbd9f4c618736e
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], rbx
lea rbx, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rdi
lea rdi, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
lea rsi, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], r11
lea r11, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xd8], r11
mov qword [rsp + 0xe0], r10
lea r10, sym.core::ptr::drop_in_place_i64_::h9d9b7f1e2d53d204
mov qword [rsp + 0xe8], r10
mov qword [rsp + 0xf0], r9
lea r9, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xf8], r9
mov qword [rsp + 0x100], r8
lea r8, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x108], r8
mov qword [rsp + 0x110], rdx
lea rdx, sym.core::ptr::drop_in_place_mut_winapi::windef::HWND___::h45fac1da600c2187
mov qword [rsp + 0x118], rdx
mov qword [rsp + 0x120], rax
lea rax, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x130], rax
lea rax, sym.core::ptr::drop_in_place_i32_::h884b84434b97c36d
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], 0xf
lea rdx, [0x14021c169]
mov r8d, 9
lea r9, str.maskcxyhbmfmtlParamiImageiOrder_typepvFilterstate
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], 0xf
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0xf
call dbg.debug_struct_fields_finish
and al, 1
movzx eax, al
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140049700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
mov qword [rsp + 0x40], rdx
mov r15, rcx
mov rcx, qword [rsp + 0x40]
lea rax, str.cbSizehimlihdcDstxycxcyxBitmapyBitmaprgbBkrgbFgfStyledwRopfStateFramecrEffect
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x118], r15
mov qword [rsp + 0x120], rcx
mov r14, r15
add r14, 4
mov rbx, r15
add rbx, 8
mov rdi, r15
add rdi, 0xc
mov rsi, r15
add rsi, 0x10
mov r11, r15
add r11, 0x14
mov r10, r15
add r10, 0x18
mov r9, r15
add r9, 0x1c
mov r8, r15
add r8, 0x2c
mov rdx, r15
add rdx, 0x3c
mov rax, r15
add rax, 0x50
mov r12, r15
add r12, 0x58
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x50], r15
lea r15, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r14
lea r14, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rbx
lea rbx, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rdi
lea rdi, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
lea rsi, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r11
lea r11, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xa8], r11
mov qword [rsp + 0xb0], r10
lea r10, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xc0], r9
lea r9, sym.core::ptr::drop_in_place_winapi::minwinbase::SYSTEMTIME_::h57cbe601f5cc33fb
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0xd0], r8
lea r8, sym.core::ptr::drop_in_place_winapi::minwinbase::SYSTEMTIME_::h57cbe601f5cc33fb
mov qword [rsp + 0xd8], r8
mov qword [rsp + 0xe0], rdx
lea rdx, sym.core::ptr::drop_in_place_winapi::windef::RECT_::hadc7b32d5d770aa8
mov qword [rsp + 0xe8], rdx
mov qword [rsp + 0xf0], rax
lea rax, sym.core::ptr::drop_in_place_mut_u16_::ha9bbd9f4c618736e
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x100], rax
lea rax, dbg.drop_in_place_u64_
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 0xc
lea rdx, str.MCGRIDINFONMSELCHANGEnmhdrstSelStartstSelEnd
mov r8d, 0xa
lea r9, str.cbSizehimlihdcDstxycxcyxBitmapyBitmaprgbBkrgbFgfStyledwRopfStateFramecrEffect
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], 0xc
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0xc
call dbg.debug_struct_fields_finish
and al, 1
movzx eax, al
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400657d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0xf8
mov qword [rsp + 0x40], rdx
mov rsi, rcx
mov rcx, qword [rsp + 0x40]
lea rax, [0x1402231e0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rcx
mov r11, rsi
add r11, 0x1c
mov r10, rsi
add r10, 0x24
mov r9, rsi
add r9, 0x28
mov r8, rsi
add r8, 0x30
mov rdx, rsi
add rdx, 0x38
mov rax, rsi
add rax, 0x3c
mov rdi, rsi
add rdi, 0x40
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0x50], rsi
lea rsi, dbg.drop_in_place_winapi::dxgitype::DXGI_MODE_DESC_
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r11
lea r11, sym.core::ptr::drop_in_place_winapi::dxgitype::DXGI_SAMPLE_DESC_::h52603a704c3cf4f4
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], r10
lea r10, dbg.drop_in_place_winapi::dxgitype::DXGI_USAGE_
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x80], r9
lea r9, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r8
lea r8, sym.core::ptr::drop_in_place_mut_winapi::windef::HWND___::h45fac1da600c2187
mov qword [rsp + 0x98], r8
mov qword [rsp + 0xa0], rdx
lea rdx, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], rax
lea rax, dbg.drop_in_place_winapi::dxgi::DXGI_SWAP_EFFECT_
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xc0], rax
lea rax, sym.core::ptr::drop_in_place_u32_::hf7347687f97a7eae
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], 8
lea rdx, str.DXGI_SWAP_CHAIN_DESCC:UsersKAVIN_STUDIO.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_0.2.8_srcdxgi.rs
mov r8d, 0x14
lea r9, [0x1402231e0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 8
call dbg.debug_struct_fields_finish
and al, 1
movzx eax, al
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x1400a2310
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov qword [rsp + 0x58], rdx
mov rdi, rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rcx
mov rax, rdi
add rax, 8
mov qword [rsp + 0x60], rax
lea rdx, str.SR_SECURITY_DESCRIPTORSecurityDescriptorLastLogonLastLogoffPasswordLastSetAccountExpiresPasswordCanChangePasswordMustChangeUserNameFullNameHomeDirectoryHomeDirectoryDriveScriptPathProfilePathAdminCommentWorkStationsUserCommentParametersLmPasswordNtPasswordPrivateDataUserIdPrimaryGroupIdUserAccountControlWhichFieldsBadPasswordCountLogonCountCountryCodeCodePageLmPasswordPresentNtPasswordPresentPasswordExpiredPrivateDataSensitive
mov r8d, 0x16
lea r9, [0x1402315de]
lea rsi, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
lea r11, [0x1402316be]
lea r10, [rsp + 0x60]
lea rax, dbg.drop_in_place_mut_u8_
mov qword [rsp + 0x20], 6
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], 0x12
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], rax
call sym.core::fmt::Formatter::debug_struct_field2_finish::h7d49d4c02ee361f5
and al, 1
movzx eax, al
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400a2c70
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov qword [rsp + 0xc0], rdx
mov rax, rcx
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rcx
mov rbp, rax
add rbp, 0x10
mov r15, rax
add r15, 0x14
mov rdi, rax
add rdi, 0x20
add rax, 0x30
mov qword [rsp + 0xe0], rax
lea rdx, [0x140231b99]
mov r8d, 0x1c
lea r9, [0x140231bb5]
lea rsi, sym.core::ptr::drop_in_place_winapi::subauth::UNICODE_STRING_::hd59723cba062139a
lea rax, [0x140231bc4]
mov qword [rsp + 0xd0], rax
lea r13, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
lea r12, [0x140231bd4]
lea r14, dbg.drop_in_place_winapi::subauth::OLD_LARGE_INTEGER_
lea rbx, [0x140231723]
lea r11, str.Workstation
lea r10, [rsp + 0xe0]
lea rax, dbg.drop_in_place_winapi::subauth::UNICODE_STRING_
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], 0xf
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x40], 0x10
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], 8
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r11
mov qword [rsp + 0xa0], 0xb
mov qword [rsp + 0xa8], r10
mov qword [rsp + 0xb0], rax
call dbg.debug_struct_field5_finish
and al, 1
movzx eax, al
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400e6ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov qword [rsp + 0x40], rdx
mov r13, rcx
mov rcx, qword [rsp + 0x40]
lea rax, [0x1402425d0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x140], rcx
mov r12, r13
add r12, 4
mov r15, r13
add r15, 8
mov r14, r13
add r14, 0xc
mov rbx, r13
add rbx, 0x10
mov rdi, r13
add rdi, 0x14
mov rsi, r13
add rsi, 0x18
mov r11, r13
add r11, 0x20
mov r10, r13
add r10, 0x28
mov r9, r13
add r9, 0x2c
mov r8, r13
add r8, 0x30
mov rdx, r13
add rdx, 0x34
mov rax, r13
add rax, 0x38
mov rbp, r13
add rbp, 0x3c
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x50], r13
lea r13, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r12
lea r12, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
lea r15, sym.core::ptr::drop_in_place_winapi::d3d9types::D3DFORMAT_::h1abc133792dfc7d8
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], r14
lea r14, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], rbx
lea rbx, dbg.drop_in_place_winapi::d3d9types::D3DMULTISAMPLE_TYPE_
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rdi
lea rdi, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rsi
lea rsi, dbg.drop_in_place_winapi::d3d9types::D3DSWAPEFFECT_
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], r11
lea r11, sym.core::ptr::drop_in_place_mut_winapi::windef::HWND___::h45fac1da600c2187
mov qword [rsp + 0xc8], r11
mov qword [rsp + 0xd0], r10
lea r10, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0xe0], r9
lea r9, sym.core::ptr::drop_in_place_i32_::he7e22d3b42bf9176
mov qword [rsp + 0xe8], r9
mov qword [rsp + 0xf0], r8
lea r8, sym.core::ptr::drop_in_place_winapi::d3d9types::D3DFORMAT_::h1abc133792dfc7d8
mov qword [rsp + 0xf8], r8
mov qword [rsp + 0x100], rdx
lea rdx, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x108], rdx
mov qword [rsp + 0x110], rax
lea rax, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x120], rax
lea rax, sym.core::ptr::drop_in_place_u32_::hf7347687f97a7eae
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 0xe
lea rdx, str.D3DPRESENT_PARAMETERSD3DBACKBUFFER_TYPED3DRESOURCETYPED3DCUBEMAP_FACESPoolSizeFVF
mov r8d, 0x15
lea r9, [0x1402425d0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], 0xe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0xe
call dbg.debug_struct_fields_finish
and al, 1
movzx eax, al
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ee1d0
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0xf8
mov qword [rsp + 0x40], rdx
mov rsi, rcx
mov rcx, qword [rsp + 0x40]
lea rax, str.usri1_nameusri1_passwordusri1_password_ageusri1_privusri1_home_dirusri1_commentusri1_flagsusri1_script_path
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rcx
mov r11, rsi
add r11, 8
mov r10, rsi
add r10, 0x10
mov r9, rsi
add r9, 0x14
mov r8, rsi
add r8, 0x18
mov rdx, rsi
add rdx, 0x20
mov rax, rsi
add rax, 0x28
mov rdi, rsi
add rdi, 0x30
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0x50], rsi
lea rsi, sym.core::ptr::drop_in_place_mut_u16_::ha9bbd9f4c618736e
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r11
lea r11, sym.core::ptr::drop_in_place_mut_u16_::ha9bbd9f4c618736e
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], r10
lea r10, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x80], r9
lea r9, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r8
lea r8, sym.core::ptr::drop_in_place_mut_u16_::ha9bbd9f4c618736e
mov qword [rsp + 0x98], r8
mov qword [rsp + 0xa0], rdx
lea rdx, sym.core::ptr::drop_in_place_mut_u16_::ha9bbd9f4c618736e
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], rax
lea rax, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xc0], rax
lea rax, dbg.drop_in_place_mut_u16_
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], 8
lea rdx, str.USER_INFO_1usri2_nameusri2_passwordusri2_password_ageusri2_privusri2_home_dirusri2_commentusri2_flagsusri2_script_pathusri2_auth_flagsusri2_full_nameusri2_usr_commentusri2_parmsusri2_workstationsusri2_last_logonusri2_last_logoffusri2_acct_expiresusri2_max_storageusri2_units_per_weekusri2_logon_hoursusri2_bad_pw_countusri2_num_logonsusri2_logon_serverusri2_country_codeusri2_code_page
mov r8d, 0xb
lea r9, str.usri1_nameusri1_passwordusri1_password_ageusri1_privusri1_home_dirusri1_commentusri1_flagsusri1_script_path
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 8
call dbg.debug_struct_fields_finish
and al, 1
movzx eax, al
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x1400ef690
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov qword [rsp + 0xb8], rdx
mov rax, rcx
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rcx
mov r13, rax
add r13, 8
mov r15, rax
add r15, 0x10
mov rdi, rax
add rdi, 0x18
add rax, 0x1c
mov qword [rsp + 0xd0], rax
lea rdx, [0x140245fb4]
mov r8d, 0xc
lea r9, [0x140245fc0]
lea r14, sym.core::ptr::drop_in_place_mut_u16_::ha9bbd9f4c618736e
lea rbp, [0x140245fcb]
lea r12, [0x140245fdb]
lea rbx, [0x140245fe9]
lea rsi, sym.core::ptr::drop_in_place_u32_::h4db1cdf69998b8ae
lea r11, [0x140245ff5]
lea r10, [rsp + 0xd0]
lea rax, sym.core::ptr::drop_in_place_u32_::hf7347687f97a7eae
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], 0xb
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], 0x10
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xe
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], 0xc
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r11
mov qword [rsp + 0xa0], 0xe
mov qword [rsp + 0xa8], r10
mov qword [rsp + 0xb0], rax
call dbg.debug_struct_field5_finish
and al, 1
movzx eax, al
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400ef820
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov rax, rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
lea rdx, [0x140246003]
mov r8d, 0xc
lea r9, [0x14024600f]
lea r10, [rsp + 0x40]
lea rax, dbg.drop_in_place__u8__16__
mov qword [rsp + 0x20], 0xf
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], rax
call sym.core::fmt::Formatter::debug_struct_field1_finish::hf679e78d2528e98a
and al, 1
movzx eax, al
add rsp, 0x58
ret