joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bc520
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov r9d, dword [rcx + 0x300]
test r9, r9
je 0x1400bc67e
mov rcx, qword [rcx + 0x2f8]
shl r9, 4
add r9, rcx
movabs r8, 0xcbf29ce484222325
movabs r11, 0x100000001b3
mov r10d, 0x9e3779b9
xor eax, eax
nop word cs:[rax + rax]
nop
movsxd rbx, dword [rcx]
mov r12d, ebx
movzx ebp, bh
mov esi, ebx
mov rdx, rbx
mov r15, rbx
mov r14, rbx
movzx edi, bl
shr ebx, 0x10
movzx ebx, bl
shr r12, 0x18
sar esi, 0x1f
shr rdx, 0x28
shr r15, 0x30
shr r14, 0x38
xor rdi, r8
imul rdi, r11
xor rdi, rbp
imul rdi, r11
xor rdi, rbx
imul rdi, r11
xor rdi, r12
imul rdi, r11
movzx esi, sil
xor rsi, rdi
imul rsi, r11
movzx edx, dl
xor rdx, rsi
imul rdx, r11
movzx esi, r15b
xor rsi, rdx
imul rsi, r11
xor rsi, r14
imul rsi, r11
mov rdx, rax
shl rdx, 6
mov rdi, rax
shr rdi, 2
add rdx, r10
add rdx, rdi
add rdx, rsi
xor rdx, rax
movzx eax, byte [rcx + 8]
xor rax, r8
imul rax, r11
movzx esi, byte [rcx + 9]
xor rsi, rax
imul rsi, r11
movzx eax, byte [rcx + 0xa]
xor rax, rsi
imul rax, r11
movzx esi, byte [rcx + 0xb]
xor rsi, rax
imul rsi, r11
movzx eax, byte [rcx + 0xc]
xor rax, rsi
imul rax, r11
movzx esi, byte [rcx + 0xd]
xor rsi, rax
imul rsi, r11
movzx edi, byte [rcx + 0xe]
xor rdi, rsi
imul rdi, r11
movzx eax, byte [rcx + 0xf]
xor rax, rdi
imul rax, r11
mov rsi, rdx
shl rsi, 6
mov rdi, rdx
shr rdi, 2
add rax, r10
add rax, rsi
add rax, rdi
xor rax, rdx
add rcx, 0x10
cmp rcx, r9
jne 0x1400bc570
jmp 0x1400bc680
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400c8b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp byte [rcx + 4], 0
je 0x1400c8b7f
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400c9020
mov r9d, dword [rbx]
cmp r9d, edx
jne 0x1400c8b99
movzx edi, byte [rbx + 8]
add edi, 0xffffffff
mov rcx, qword [rbx + rdi*8 + 0x10]
mov esi, edx
sub esi, dword [rcx]
jmp 0x1400c8bb2
xor eax, eax
mov edi, 0xffffffff
mov esi, eax
add edi, 1
mov rcx, qword [rbx + rdi*8 + 0x10]
mov eax, dword [rcx]
add eax, esi
cmp eax, edx
jb 0x1400c8ba0
mov eax, dword [r8 + 0xc]
sub eax, dword [r8 + 8]
add eax, r9d
mov dword [rbx], eax
sub edx, esi
call fcn.1400c8b60
test rax, rax
je 0x1400c8bdf
mov rcx, rbx
mov edx, edi
mov r8, rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400c9420
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400ed5f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0xab8]
cmp qword [rcx + 0xab0], rax
je 0x1400ed622
mov rax, qword [rax - 0x10]
cmp rax, qword [rdi + 0x3e0]
jne 0x1400ed622
mov rcx, rdi
call fcn.14010a2a0
mov eax, dword [rdi + 0x8dc]
cmp rax, 8
jne 0x1400ed647
mov rbx, qword [rdi + 0x3e0]
mov qword [rdi + 0x3e0], 0
test rbx, rbx
jne 0x1400ed67b
jmp 0x1400ed68b
lea rcx, [rdi + 0x3e0]
lea edx, [rax + 1]
mov dword [rdi + 0x8dc], edx
lea rax, [rdi + rax*8]
add rax, 0x8e0
cmp rcx, rax
je 0x1400ed68b
mov rdx, qword [rcx]
mov qword [rcx], 0
mov rbx, qword [rax]
mov qword [rax], rdx
test rbx, rbx
je 0x1400ed68b
mov rcx, rbx
call fcn.1401112e0
mov rcx, rbx
call fcn.14016a7e0
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400eb440
Function at 0x14000be30
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x280], rbx
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x298], rdi
mov rax, qword [0x140167020]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
lea r13, str.lpa___0
movabs r12, 0xffffffffffffff0
lea r15, [0x140149448]
nop dword [rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000bec0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000bf77
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000beef
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401179f0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
jne 0x14000bf15
mov qword [rsp + 0x28], r13
mov r8d, 0x24e
jmp 0x14000bf59
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x2c]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14000bf7a
lea rax, [0x140149450]
mov r8d, 0x258
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822_atlmfcinclude_atlconv.h
lea ecx, [r9 + 2]
call fcn.1400ac9b0
cmp eax, 1
jne 0x14000bf77
int3
mov rbx, r14
mov rcx, rdi
call fcn.140008ed0
sub rax, rbx
movzx edx, byte [rbx]
movzx ecx, byte [rbx + rax]
sub edx, ecx
jne 0x14000bf97
inc rbx
test ecx, ecx
jne 0x14000bf85
mov rcx, rsi
test edx, edx
je 0x14000bffe
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000beb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400028a0
mov r8, qword [rdi + 0x20]
cmp r8, 0x10
jb 0x14000bfda
mov rdx, qword [rdi + 8]
inc r8
mov rcx, rdi
call fcn.1400034a0
mov qword [rdi + 0x18], r14
mov edx, 0x10
mov qword [rdi + 0x20], 0xf
mov byte [rdi + 8], r14b
mov rcx, qword [rdi]
mov qword [rdi], r14
call fcn.1400a0a20
xor eax, eax
jmp 0x14000c04a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 8]
mov rcx, rdi
call fcn.1400028a0
mov r8, qword [rdi + 0x20]
cmp r8, 0x10
jb 0x14000c028
mov rdx, qword [rdi + 8]
inc r8
mov rcx, rdi
call fcn.1400034a0
mov qword [rdi + 0x18], r14
mov edx, 0x10
mov qword [rdi + 0x20], 0xf
mov byte [rdi + 8], r14b
mov rcx, qword [rdi]
mov qword [rdi], r14
call fcn.1400a0a20
mov eax, ebx
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.1400a0130
mov rbx, qword [rbp + 0x280]
mov rsi, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x298]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140017830
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001788d
lea rbx, [0x14014b330]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140017874
cmp r10, 2
jb 0x140017874
cmp byte [r9], r8b
jne 0x140017874
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140017850
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400178cf
lea rbx, [0x14014b330]
cmp r8b, 0x23
jne 0x1400178b3
cmp byte [r9], r8b
jne 0x1400178b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400178a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140017a10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140017a2a
mov qword [r8], 0
lea rdx, [0x14014ae90]
call fcn.1400178e0
mov rbx, rax
test rax, rax
jne 0x140017a4a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1400c97e0
mov esi, eax
cmp eax, 0xffffffff
je 0x140017b18
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400cb140
test eax, eax
jne 0x140017b18
mov rcx, rbx
call fcn.1400c97e0
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140017b18
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400cb140
test eax, eax
jne 0x140017b18
cmp rdi, 0xffffffffffffffff
je 0x140017b18
mov rax, qword [0x14016b740]
test rax, rax
je 0x140017aba
inc dword [rax + 0xf4]
mov rcx, rdi
call fcn.1400d2ac0
mov rsi, rax
test rax, rax
je 0x140017b18
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400cd510
mov rcx, rbx
cmp rax, rdi
je 0x140017b06
call fcn.1400ca930
mov rax, qword [0x14016b740]
test rax, rax
je 0x140017afc
dec dword [rax + 0xf4]
mov rcx, rsi
call fcn.1400c8530
jmp 0x140017b20
call fcn.1400ca930
test r14, r14
je 0x140017b13
mov qword [r14], rdi
mov rax, rsi
jmp 0x140017b22
mov rcx, rbx
call fcn.1400ca930
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14001b350
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14014b330]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x14001b3e6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14002f9e0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14001b3f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x14014b330]
vmovss xmm3, dword [rcx + 0x110]
vmovss xmm4, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
vmovss xmm0, dword [rdx]
vmovss xmm2, dword [rdx + 4]
vsubss xmm1, xmm0, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
vmovss dword [rsp], xmm1
movzx eax, byte [rsp]
xor rcx, rax
movzx eax, byte [rsp + 1]
vmovss xmm1, dword [rdx + 8]
vsubss xmm0, xmm2, xmm4
vmovss dword [rsp + 4], xmm0
xor r8d, dword [r9 + rcx*4]
vmovss xmm0, dword [rdx + 0xc]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 8], xmm2
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
vsubss xmm1, xmm0, xmm4
vmovss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x1400282d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140167020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14016b740]
mov edi, ecx
cmp byte [rbx + 0x4a9d], 0
jne 0x140028331
cmp byte [rbx + 0x4a9e], 0
jne 0x140028331
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140017690
test dil, 1
je 0x14002845f
jmp 0x1400283b9
vmovss xmm1, dword [rbx + 0x389c]
vmovss xmm0, dword [0x1401509fc]
vfmadd213ss xmm0, xmm1, dword [rbx + 0xe0c]
vmovss xmm2, dword [0x140150a24]
vfmadd213ss xmm2, xmm1, dword [rbx + 0xe08]
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
xor eax, eax
mov dword [rbx + 0x47d4], 1
vmovss dword [rbx + 0x47e0], xmm2
vmovss dword [rbx + 0x47e4], xmm0
mov qword [rbx + 0x47e8], rax
lea rcx, [rsp + 0x20]
vmovss xmm0, dword [rbx + 0x3904]
vmulss xmm1, xmm0, dword [0x140150898]
or dword [rbx + 0x47d0], 0x41
lea edx, [rax + 0x10]
vmovss dword [rbx + 0x4830], xmm1
call fcn.140017690
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140028410
lea r11, [0x14014b330]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400283f3
cmp byte [r8], r9b
jne 0x1400283f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400283e0
not ecx
call fcn.14001f1f0
test rax, rax
je 0x14002845f
cmp byte [rax + 0xb6], 0
je 0x14002845f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bc2]
movsx r9d, word [rbx + 0x5bc2]
call fcn.140017690
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400219c0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a0130
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14002e810
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14016b740]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14002e873
mov qword [rsp], rbx
lea rbx, [0x14014b330]
nop dword [rax]
cmp r9b, 0x23
jne 0x14002e853
cmp byte [r8], r9b
jne 0x14002e853
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14002e840
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c20]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14002e8a7
mov r10, qword [r10 + 0x5c28]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14002e8ae
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14002e894
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14009f240
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.14009f230
mov dword [rsp + 0x28], eax
call fcn.1400d62e0
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov edx, 0x22
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x20]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x30
je 0x14009f2bf
cmp dword [rsp + 0x24], 0x31
je 0x14009f2c6
cmp dword [rsp + 0x24], 0x32
je 0x14009f2cd
jmp 0x14009f2d4
mov eax, 2
jmp 0x14009f2d6
mov eax, 1
jmp 0x14009f2d6
mov eax, 3
jmp 0x14009f2d6
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x1400ab770
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400ab250
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400ab7af
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140128570]
jmp 0x1400ab7b9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400e8ce0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x1400f20e0
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1400f15c0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400f2147
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140128578]
jmp 0x1400f2169
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400f2540
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x1400f7930
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401179f0
sub rsp, rax
mov rax, qword [0x140167020]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14016adc0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400f7b22
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1400f7a76
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400f7a76
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400f7a5b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1400f79f8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400f7ae2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400f7b41
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1400f7b1d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400f7b41
jmp 0x1400f79ce
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400a0130
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400f7b60
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401179f0
sub rsp, rax
mov rax, qword [0x140167020]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14016adc0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400f7d6d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1400f7cb9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400f7cb9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1400f7c99
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400f7c28
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400f7d2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400f7d8c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1400f7d68
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400f7d8c
jmp 0x1400f7bfe
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400a0130
add rsp, 0x1498
pop rdi
pop rsi
ret