joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422fac
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r14d, 0xffffffff
cmp r9, r14
cmovb r14, r9
mov r12, qword [rsp + 0xc0]
lea r15, [rsp + 0x2c]
xorps xmm6, xmm6
lea r13, [rsp + 0x30]
cmp byte [r12 + 8], 0
je 0x423013
mov rax, qword [r12]
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x40], eax
shr rax, 0x20
mov dword [rsp + 0x44], eax
and qword [rsp + 0x48], 0
mov rax, r13
jmp 0x423015
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov r8d, r14d
mov r9, r15
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x423051
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x3e3
je 0x422feb
movzx eax, ax
cmp eax, 0x26
je 0x42304c
cmp eax, 0x40
je 0x42305f
cmp eax, 0x6d
jne 0x42306b
xorps xmm0, xmm0
jmp 0x423066
mov eax, dword [rsp + 0x2c]
and word [rsi + 8], 0
mov qword [rsi], rax
jmp 0x423071
movups xmm0, xmmword [0x004c97c0]
movups xmmword [rsi], xmm0
jmp 0x423071
mov word [rsi + 8], 0x2d
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x423161
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rax, r8
mov rsi, rcx
mov rcx, qword [rsp + 0x80]
cmp byte [rcx + 8], 0
je 0x42319b
mov r8, qword [rcx]
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
mov dword [rcx + 0x10], r8d
shr r8, 0x20
mov dword [rcx + 0x14], r8d
and qword [rcx + 0x18], 0
jmp 0x42319d
xor ecx, ecx
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x2c]
mov rcx, rdx
mov rdx, rax
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4231d1
mov eax, dword [rsp + 0x2c]
and word [rsi + 8], 0
mov qword [rsi], rax
jmp 0x423247
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x42323d
movzx eax, ax
cmp eax, 8
je 0x423208
cmp eax, 0x21
je 0x423234
cmp eax, 0x40
je 0x42322b
cmp eax, 0x6d
je 0x423211
cmp eax, 0x3e3
je 0x42321a
cmp eax, 0x6f8
je 0x423208
cmp eax, 0x718
jne 0x423223
movups xmm0, xmmword [0x004c9770]
jmp 0x423244
movups xmm0, xmmword [0x004c9790]
jmp 0x423244
movups xmm0, xmmword [0x004c9780]
jmp 0x423244
mov word [rsi + 8], 0x2d
jmp 0x423247
movups xmm0, xmmword [0x004c97c0]
jmp 0x423244
movups xmm0, xmmword [0x004c97b0]
jmp 0x423244
movups xmm0, xmmword [0x004c97a0]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x42360b
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1b8
cmp byte [0x004d400a], 0
jne 0x423622
mov byte [0x004d400a], 1
lea rdx, [rsp + 0x20]
mov cx, 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x423666
mov byte [0x004d400a], 0
cmp ax, 0x2734
je 0x423660
movzx ecx, ax
cmp ecx, 0x2753
je 0x423671
cmp ecx, 0x276c
je 0x423660
mov ax, 0x3d
cmp ecx, 0x276b
je 0x423675
mov ax, 0x2d
jmp 0x423675
mov byte [0x004d400a], 0
xor eax, eax
jmp 0x423675
mov ax, 0x3a
add rsp, 0x1b8
ret
Function at 0x450c26
Capabilities:
Authenticate hmac
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.0046bf16
lea rcx, [rsp + rsi]
add rcx, 0x20
mov r8d, 0x40
sub r8, rsi
xor esi, esi
xor edx, edx
call fcn.0046bf36
cmp rsi, 0x40
je 0x450c74
mov al, byte [rsp + rsi + 0x20]
xor al, 0x5c
mov byte [rsp + rsi + 0x110], al
inc rsi
jmp 0x450c5c
xor eax, eax
cmp rax, 0x40
je 0x450c8c
mov cl, byte [rsp + rax + 0x20]
xor cl, 0x36
mov byte [rsp + rax + 0x60], cl
inc rax
jmp 0x450c76
lea rsi, [0x004c7e30]
lea r14, [rsp + 0xa0]
mov ecx, 0xe
mov rdi, r14
rep movsq qword [rdi], qword [rsi]
lea rdx, [rsp + 0x60]
mov r8d, 0x40
mov rcx, r14
call fcn.0041cb3a
mov r8d, 0xb0
mov rcx, rbx
mov rdx, r14
call fcn.0046bf16
mov rax, rbx
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x450cda
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rbx, rdx
mov r14, rcx
lea r15, [rsp + 0x20]
mov rdx, r15
call fcn.00449b2a
lea rsi, [0x004c7e30]
lea r12, [rsp + 0x40]
mov ecx, 0xe
mov rdi, r12
rep movsq qword [rdi], qword [rsi]
add r14, 0x70
mov r8d, 0x40
mov rcx, r12
mov rdx, r14
call fcn.0041cb3a
mov r8d, 0x20
mov rcx, r12
mov rdx, r15
call fcn.0041cb3a
mov rcx, r12
mov rdx, rbx
call fcn.00449b2a
nop
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x450d57
Capabilities:
Authenticate hmac

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rdi, r8
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.0046bf16
lea rcx, [rsp + rdi]
add rcx, 0x20
mov r8d, 0x80
sub r8, rdi
xor edi, edi
xor edx, edx
call fcn.0046bf36
cmp rdi, 0x80
je 0x450da5
mov al, byte [rsp + rdi + 0x20]
xor al, 0x5c
mov byte [rsp + rdi + 0x200], al
inc rdi
jmp 0x450d8a
xor eax, eax
cmp rax, 0x80
je 0x450dc2
mov cl, byte [rsp + rax + 0x20]
xor cl, 0x36
mov byte [rsp + rax + 0xa0], cl
inc rax
jmp 0x450da7
lea rdx, [0x004c7ea0]
lea rdi, [rsp + 0x120]
mov r8d, 0xe0
mov rcx, rdi
call fcn.0046bf16
lea rdx, [rsp + 0xa0]
mov r8d, 0x80
mov rcx, rdi
call fcn.0041ce40
mov r8d, 0x160
mov rcx, rsi
mov rdx, rdi
call fcn.0046bf16
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret

Function at 0x450e8e
Capabilities:
Authenticate hmac

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rdi, r8
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.0046bf16
lea rcx, [rsp + rdi]
add rcx, 0x20
mov r8d, 0x80
sub r8, rdi
xor edi, edi
xor edx, edx
call fcn.0046bf36
cmp rdi, 0x80
je 0x450edc
mov al, byte [rsp + rdi + 0x20]
xor al, 0x5c
mov byte [rsp + rdi + 0x200], al
inc rdi
jmp 0x450ec1
xor eax, eax
cmp rax, 0x80
je 0x450ef9
mov cl, byte [rsp + rax + 0x20]
xor cl, 0x36
mov byte [rsp + rax + 0xa0], cl
inc rax
jmp 0x450ede
lea rdx, [0x004c7f80]
lea rdi, [rsp + 0x120]
mov r8d, 0xe0
mov rcx, rdi
call fcn.0046bf16
lea rdx, [rsp + 0xa0]
mov r8d, 0x80
mov rcx, rdi
call fcn.0041ce40
mov r8d, 0x160
mov rcx, rsi
mov rdx, rdi
call fcn.0046bf16
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret
Function at 0x45aec9
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
movdqa xmmword [rsp + 0xc0], xmm10
movdqa xmmword [rsp + 0xb0], xmm9
movdqa xmmword [rsp + 0xa0], xmm8
movdqa xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov ebx, dword [r8]
movq xmm6, qword [r8 + 4]
lea rdi, [rsp + 0x60]
mov rcx, rdi
call fcn.00456135
movdqa xmm0, xmmword [rdi]
movdqa xmm1, xmmword [rdi + 0x10]
xor eax, eax
movd xmm2, ebx
movdqa xmm3, xmmword [str.expand_32_byte_k]
xor ecx, ecx
cmp rax, 0x1c0
ja 0x45b0e1
add rax, 0x40
movd xmm4, ecx
punpckldq xmm4, xmm2
punpcklqdq xmm4, xmm6
movdqa xmm7, xmm4
movdqa xmm8, xmm1
movdqa xmm5, xmm0
movdqa xmm9, xmm3
xor edx, edx
cmp rdx, 7
ja 0x45b091
paddd xmm9, xmm5
pxor xmm7, xmm9
movdqa xmm10, xmm7
psrld xmm10, 0x10
pslld xmm7, 0x10
por xmm7, xmm10
paddd xmm8, xmm7
pxor xmm5, xmm8
movdqa xmm10, xmm5
psrld xmm10, 0x14
pslld xmm5, 0xc
por xmm5, xmm10
paddd xmm9, xmm5
pxor xmm7, xmm9
pshufd xmm9, xmm9, 0x93
movdqa xmm10, xmm7
psrld xmm10, 0x18
pslld xmm7, 8
por xmm7, xmm10
paddd xmm8, xmm7
pshufd xmm7, xmm7, 0x4e
pxor xmm5, xmm8
pshufd xmm8, xmm8, 0x39
movdqa xmm10, xmm5
psrld xmm10, 0x19
pslld xmm5, 7
por xmm5, xmm10
paddd xmm9, xmm5
pxor xmm7, xmm9
movdqa xmm10, xmm7
psrld xmm10, 0x10
pslld xmm7, 0x10
por xmm7, xmm10
paddd xmm8, xmm7
pxor xmm5, xmm8
movdqa xmm10, xmm5
psrld xmm10, 0x14
pslld xmm5, 0xc
por xmm5, xmm10
paddd xmm9, xmm5
pxor xmm7, xmm9
pshufd xmm9, xmm9, 0x39
movdqa xmm10, xmm7
psrld xmm10, 0x18
pslld xmm7, 8
por xmm7, xmm10
paddd xmm8, xmm7
pshufd xmm7, xmm7, 0x4e
pxor xmm5, xmm8
pshufd xmm8, xmm8, 0x93
movdqa xmm10, xmm5
psrld xmm10, 0x19
pslld xmm5, 7
por xmm5, xmm10
add rdx, 2
jmp 0x45af64
paddd xmm9, xmm3
paddd xmm5, xmm0
paddd xmm8, xmm1
paddd xmm7, xmm4
movdqa xmmword [rsp + 0x20], xmm9
movdqa xmmword [rsp + 0x30], xmm5
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm7
xor edx, edx
cmp rdx, 0x40
je 0x45b0d6
movdqa xmm4, xmmword [rsp + rdx + 0x20]
movdqu xmmword [rsi + rdx], xmm4
add rdx, 0x10
jmp 0x45b0bf
inc ecx
add rsi, 0x40
jmp 0x45af34
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm9, xmmword [rsp + 0xb0]
movaps xmm10, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001ba90
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14001bb73
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14001bb73
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14001bb91
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x14001bb63
cmp word [rcx], 0x5c
jne 0x14001bb5c
lea rdx, [rcx + 2]
cmp rdx, rax
je 0x14001bb5c
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14001bb47
movzx eax, word [rdx]
sub ax, 0x28
cmp ax, 1
jbe 0x14001bb59
test r8b, 0x10
jne 0x14001bb5c
movzx eax, word [rdx]
sub ax, 0x7b
test bp, ax
jne 0x14001bb5c
mov rcx, rdx
lea rax, [rcx + 2]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140015570
test edi, edi
jne 0x14001bac0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140015560
int3

Function at 0x14002722c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140042100]
test rax, rax
je 0x140027276
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140027276
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140027276
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140027276
cmp dword [rcx + 0x84], 0xe
jbe 0x140027276
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140027278
xor al, al
add rsp, 0x28
ret

Function at 0x14002fce4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002fafc
Function at 0x1400b3978
Capabilities:
Terminate process

Disassembly:
jmp 0x1402167e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400b3d56
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400f9cc0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ac5ee]
call fcn.1400b4e3b
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400b3f04
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400f9c50
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ac5ee]
call fcn.1400b4e3b
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400b3f1d
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400fbb40
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ac5ee]
call fcn.1400b4e3b
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140227ee0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1400fbc85
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1400fbbd9
mov dword [rbp + 0x160], 1
jmp 0x1400fbbe3
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1400fbc80
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400fbc5a
cmp qword [rbp + 0x198], 2
jb 0x1400fbc5a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fbc5a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fbc5a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400fbba4
jmp 0x1400fbd1f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400fbd1f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1400fbcf6
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fbcf6
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fbcf6
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400fbc85
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400b403f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140218980
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402189a0
xor al, al
jmp 0x140218a21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402189b3
xor al, al
jmp 0x140218a21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402189dd
xor al, al
jmp 0x140218a21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402189f1
xor al, al
jmp 0x140218a21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140218a03
xor al, al
jmp 0x140218a21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140218a1f
xor al, al
jmp 0x140218a21
mov al, 1
add rsp, 0x38
ret
Function at 0x1400b4aa3
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400fba20
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ac5ee]
call fcn.1400b4e3b
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140227ee0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400fba9f
mov dword [rbp + 0x120], 1
jmp 0x1400fbaa9
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400fbaf2
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400fba6a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1401a15f0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ac7b9]
call fcn.1400b4e3b
call fcn.14019f9c0
mov qword [rbp + 8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 8]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1401a1662
mov rax, qword [rbp + 8]
mov dword [rax + 0x2c], 0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140211250
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402930c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ac972]
call fcn.1400b4e3b
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140212d20
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140211c10
nop
lea rax, [0x140210e10]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140212f70
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14021132a
lea rcx, [rbp + 8]
call fcn.1402130e0
jmp 0x140211343
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a0a
nop
lea rcx, [rbp + 8]
call fcn.140212240
lea rcx, [rbp - 0x30]
lea rdx, [0x140276880]
call fcn.1400b4620
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35db
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x1402113c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402930c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ac972]
call fcn.1400b4e3b
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140212d60
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140211ce0
nop
lea rax, [0x140210f20]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140212fb0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14021149a
lea rcx, [rbp + 8]
call fcn.140213140
jmp 0x1402114b3
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a0a
nop
lea rcx, [rbp + 8]
call fcn.1402122d0
lea rcx, [rbp - 0x30]
lea rdx, [0x140276900]
call fcn.1400b4620
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35db
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140211530
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402930c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ac972]
call fcn.1400b4e3b
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140212da0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140211db0
nop
lea rax, [0x140211030]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140212ff0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14021160a
lea rcx, [rbp + 8]
call fcn.1402131a0
jmp 0x140211623
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a0a
nop
lea rcx, [rbp + 8]
call fcn.140212360
lea rcx, [rbp - 0x30]
lea rdx, [0x140276980]
call fcn.1400b4620
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35db
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x1402116a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402930c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ac972]
call fcn.1400b4e3b
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140212de0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140211e80
nop
lea rax, [0x140211140]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140213030
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14021177a
lea rcx, [rbp + 8]
call fcn.140213200
jmp 0x140211793
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a0a
nop
lea rcx, [rbp + 8]
call fcn.1402123f0
lea rcx, [rbp - 0x30]
lea rdx, [0x140276a00]
call fcn.1400b4620
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35db
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret