joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e495
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r8, [0x1402e8503]
mov r9d, 3
mov rcx, rdx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e4ca
mov byte [rsi + 1], 0
jmp 0x14004e5bf
lea r8, [0x140278ce4]
mov r9d, 9
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e4ef
mov byte [rsi + 1], 1
jmp 0x14004e5bf
lea r8, [0x140278ced]
mov r9d, 0xd
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e514
mov byte [rsi + 1], 2
jmp 0x14004e5bf
lea r8, [0x14027716b]
mov r9d, 7
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e539
mov byte [rsi + 1], 3
jmp 0x14004e5bf
lea r8, [0x140278cfa]
mov r9d, 0x13
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e55b
mov byte [rsi + 1], 4
jmp 0x14004e5bf
lea r8, [0x140278d0d]
mov r9d, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e57d
mov byte [rsi + 1], 5
jmp 0x14004e5bf
lea r8, [0x140278d2d]
mov r9d, 0xd
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e59f
mov byte [rsi + 1], 6
jmp 0x14004e5bf
lea r8, [0x140278d3a]
mov r9d, 3
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14004e5cb
mov byte [rsi + 1], 7
xor eax, eax
mov byte [rsi], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x140278d40]
mov r9d, 8
mov rcx, rbx
mov rdx, rdi
call fcn.14026d27d
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14004e5c1

Function at 0x140050105
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r8, [0x1402e96e6]
mov r9d, 8
mov rcx, rdx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x140050137
mov byte [rsi + 1], 0
jmp 0x14005017f
lea r8, [0x1402e96ee]
mov r9d, 7
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x140050159
mov byte [rsi + 1], 1
jmp 0x14005017f
lea r8, [0x1402e96f5]
mov r9d, 8
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005017b
mov byte [rsi + 1], 2
jmp 0x14005017f
mov byte [rsi + 1], 3
mov byte [rsi], 0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005d61a
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r8, [0x140278de7]
mov r9d, 0x10
mov rcx, rdx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d64f
mov byte [rsi + 1], 0
jmp 0x14005d7fd
lea r8, [0x140278df7]
mov r9d, 8
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d674
mov byte [rsi + 1], 1
jmp 0x14005d7fd
lea r8, [0x140278dff]
mov r9d, 0xe
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d699
mov byte [rsi + 1], 2
jmp 0x14005d7fd
lea r8, [0x140278e0d]
mov r9d, 0xd
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d6be
mov byte [rsi + 1], 3
jmp 0x14005d7fd
lea r8, [0x140278e1a]
mov r9d, 0x11
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d6e3
mov byte [rsi + 1], 4
jmp 0x14005d7fd
lea r8, [0x1402e87f7]
mov r9d, 7
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d708
mov byte [rsi + 1], 5
jmp 0x14005d7fd
lea r8, [0x140278e2b]
mov r9d, 0xc
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d72d
mov byte [rsi + 1], 6
jmp 0x14005d7fd
lea r8, [0x140278e37]
mov r9d, 0xe
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d752
mov byte [rsi + 1], 7
jmp 0x14005d7fd
lea r8, [0x140278e45]
mov r9d, 0x10
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d777
mov byte [rsi + 1], 8
jmp 0x14005d7fd
lea r8, [0x140278e55]
mov r9d, 0x15
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d799
mov byte [rsi + 1], 9
jmp 0x14005d7fd
lea r8, [0x140278e6a]
mov r9d, 0x1a
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d7bb
mov byte [rsi + 1], 0xa
jmp 0x14005d7fd
lea r8, [0x1402e8724]
mov r9d, 0xc
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d7dd
mov byte [rsi + 1], 0xb
jmp 0x14005d7fd
lea r8, [0x1402e9615]
mov r9d, 5
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005d809
mov byte [rsi + 1], 0xc
xor eax, eax
mov byte [rsi], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x140278e88]
mov r9d, 0xd
mov rcx, rbx
mov rdx, rdi
call fcn.14026d27d
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14005d7ff

Function at 0x14005d8f1
Capabilities:
Get geographical location

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
lea r8, [0x1402e9615]
mov r9d, 5
mov rcx, rdx
mov rdx, rax
call fcn.140111920
xor al, 1
mov byte [rsi + 1], al
mov byte [rsi], 0
add rsp, 0x20
pop rsi
ret

Function at 0x14005d949
Capabilities:
Get geographical location

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
lea r8, [0x1402e88e5]
mov r9d, 4
mov rcx, rdx
mov rdx, rax
call fcn.140111920
xor al, 1
mov byte [rsi + 1], al
mov byte [rsi], 0
add rsp, 0x20
pop rsi
ret
Function at 0x14005da94
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r8, [0x1402e88e5]
mov r9d, 4
mov rcx, rdx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005dac6
mov byte [rsi + 1], 0
jmp 0x14005db30
lea r8, [0x1402e9a48]
mov r9d, 0xa
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005dae8
mov byte [rsi + 1], 1
jmp 0x14005db30
lea r8, [0x1402e9a52]
mov r9d, 6
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005db0a
mov byte [rsi + 1], 2
jmp 0x14005db30
lea r8, [0x1402e9a58]
mov r9d, 0xb
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005db2c
mov byte [rsi + 1], 3
jmp 0x14005db30
mov byte [rsi + 1], 4
mov byte [rsi], 0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005db92
Capabilities:
Get geographical location

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
lea r8, [0x1402e8724]
mov r9d, 0xc
mov rcx, rdx
mov rdx, rax
call fcn.140111920
xor al, 1
mov byte [rsi + 1], al
mov byte [rsi], 0
add rsp, 0x20
pop rsi
ret

Function at 0x14005de37
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r8, [0x1402e88e5]
mov r9d, 4
mov rcx, rdx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005de6c
mov byte [rsi + 1], 0
jmp 0x14005def8
lea r8, [0x1402e9a48]
mov r9d, 0xa
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005de8e
mov byte [rsi + 1], 1
jmp 0x14005def8
lea r8, [0x1402e9a8a]
mov r9d, 0xc
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005deb0
mov byte [rsi + 1], 2
jmp 0x14005def8
lea r8, [0x1402e9a52]
mov r9d, 6
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005ded2
mov byte [rsi + 1], 3
jmp 0x14005def8
lea r8, [0x1402e9a58]
mov r9d, 0xb
mov rcx, rbx
mov rdx, rdi
call fcn.140111920
test al, al
je 0x14005def4
mov byte [rsi + 1], 4
jmp 0x14005def8
mov byte [rsi + 1], 5
mov byte [rsi], 0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005e00c
Capabilities:
Get geographical location

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
lea r8, [0x1402e890f]
mov r9d, 0x18
mov rcx, rdx
mov rdx, rax
call fcn.140111920
xor al, 1
mov byte [rsi + 1], al
mov byte [rsi], 0
add rsp, 0x20
pop rsi
ret
Function at 0x1400628d8
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, qword [rcx]
cmp r14, 2
je 0x1400629fe
mov rsi, rcx
cmp byte [rcx + 0x60], 0
je 0x140062915
mov rdi, qword [rsi + 0x30]
mov rcx, rdi
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14006291b
mov byte [rsi + 0x60], 0
xor ebx, ebx
jmp 0x140062961
mov rdi, qword [rsi + 0x30]
jmp 0x14006296e
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp eax, 5
jne 0x140062959
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14006293f
cmp eax, 0x102
je 0x14006290d
jmp 0x140062954
lea rdx, [rsp + 0x28]
and dword [rdx], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14006290d
call sub.KERNEL32.dll_GetLastError
shl rbx, 0x20
or rbx, 2
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
call fcn.1401877c2
mov rcx, rdi
call fcn.1400d7669
mov rcx, qword [rsi + 0x38]
call fcn.1400d7669
test r14, r14
je 0x14006298d
mov rcx, qword [rsi + 8]
call fcn.1400d7669
cmp qword [rsi + 0x10], 0
je 0x14006299d
mov rcx, qword [rsi + 0x18]
call fcn.1400d7669
cmp qword [rsi + 0x20], 0
je 0x1400629ad
mov rcx, qword [rsi + 0x28]
call fcn.1400d7669
cmp qword [rsi + 0x40], 0
je 0x1400629fe
mov rcx, qword [rsi + 0x50]
mov rdx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
test eax, eax
je 0x140062a09
mov rdi, qword [rsi + 0x58]
add rsi, 0x48
cmp qword [rdi], 0
je 0x1400629e0
lea rcx, [rdi + 8]
call fcn.1401865d4
mov edx, 8
mov rcx, rdi
call fcn.140164ec0
mov rcx, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14006409b
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14005e85d
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
lea rax, [rsp + 0x58]
mov qword [rax], rcx
lea rdx, [0x1402eb5d8]
lea rcx, [rsp + 0x28]
mov qword [rcx], rdx
mov edx, 1
mov qword [rcx + 8], rdx
and qword [rcx + 0x20], 0
lea r8, [fcn.14016c1f0]
mov qword [rax + 8], r8
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
lea rdx, str.C:Users_ramzi.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.32.0_srcprocesswindows.rsfailed_to_unregister:
call fcn.14026e460
ud2

Function at 0x140066af3
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x140066dd3
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx + 0x10]
and qword [rdx + 0x10], 0
mov rcx, rdi
call fcn.1400666c6
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140087855

Function at 0x1400670da
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx + 0x10]
and qword [rdx + 0x10], 0
mov rcx, rdi
call fcn.1400666c6
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001f446
Function at 0x140071f21
Capabilities:
Get geographical location

Disassembly:
push rsi
sub rsp, 0x20
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx + 0x10]
and qword [rax + 0x10], 0
test rdx, rdx
je 0x140071f47
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14002000c
lea rcx, str.value_is_missingexpected__false___found__true_rgb_value_doesnt_fit_u32MapAccess::next_value_called_before_next_keyC:Users_ramzi.cargo_registry_srcindex.crates.io_6f17d22bba15001f_serde_1.0.188_srcde_value.rs
mov edx, 0x10
call fcn.14026d36d
mov qword [rsi + 8], rax
mov qword [rsi], 5
add rsp, 0x20
pop rsi
ret

Function at 0x1400724d3
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rdx, [0x1402e8503]
mov r8d, 3
call fcn.1400a14a0
mov rcx, qword [rbx]
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400a14eb
Function at 0x1400806bf
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsp
movzx eax, byte [rdx]
cmp rax, 0x10
je 0x14009e568
cmp eax, 0x11
je 0x14009e56f
cmp eax, 0x12
jne 0x14009e573
mov dword [rcx], 2
ret
mov rdx, qword [rdx + 8]
jmp 0x1400806bf
Function at 0x140086a9e
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
mov rsi, rcx
movzx eax, byte [rdx]
cmp rax, 0x14
je 0x140086d25
cmp eax, 0x15
jne 0x140086f96
mov r14, qword [rdx + 8]
mov rdi, qword [rdx + 0x18]
shl rdi, 6
add rdi, r14
lea rax, [rsp + 0xa8]
and qword [rax], 0
lea rbx, [rsp + 0x78]
and qword [rbx - 8], 0
mov al, 1
mov dword [rsp + 0x24], eax
xor eax, eax
mov qword [rsp + 0x28], rax
lea rbp, [0x14031b6fc]
mov r15d, 3
xor r12d, r12d
mov rax, qword [rdx + 8]
mov rcx, qword [rdx + 0x18]
shl rcx, 5
add rcx, rax
lea rdx, [rsp + 0x90]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
and qword [rdx + 0x10], 0
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.140067cca
cmp qword [rdi], 0
je 0x140086dd7
mov rdi, qword [rsp + 0x78]
jmp 0x140086eac
mov rbx, qword [rsp + 0x78]
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xf0], xmm0
test rbx, rbx
je 0x140087020
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xa8], rbx
mov rdx, qword [rsp + 0x90]
xor ebp, ebp
test rdx, rdx
je 0x140086e61
cmp rdx, qword [rsp + 0x98]
je 0x140086e61
lea rax, [rdx + 0x20]
mov qword [rsp + 0x90], rax
inc qword [rsp + 0xa0]
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.14002f441
cmp byte [rdi], 0
jne 0x140086e9a
movzx eax, word [rsp + 0x71]
movzx ecx, byte [rsp + 0x73]
and al, 0x73
shl ecx, 0x18
shl eax, 8
lea ebp, [rcx + rax]
inc ebp
mov eax, ebp
and eax, 1
neg eax
fadd dword [rcx - 0xff1b]
invalid
or ebp, 1
and ebp, eax
test bpl, bpl
je case.0x1400781a1.586
lea rdi, [rsp + 0x70]
lea rdx, [rsp + 0x90]
xchg esp, eax
and al, 0x90
add byte [rax], al
add byte [rax - 0x77], cl
stc
call fcn.1400676ce
mov rcx, qword [rdi]
cmp rcx, 2
jne 0x140086f07
mov rdi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xc0], xmm0
test rcx, rcx
je 0x14008706b
test byte [rsi + 1], al
add byte [rax], al
shr ebp, 8
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rsp + 0xb0]
adc byte [rsp + 0xb0], al
lea r8, [0x1402750b8]
lea rax, [rsp + 0x90]
mov rcx, rdx
mov rdx, rax
call fcn.14026d339
mov qword [rsi + 8], rax
jmp 0x140086eb0
lea rdx, str.struct_ForumTopicCreated_with_3_elementsp
lea r8, [0x140273eb8]
add byte [rcx], dh
leave
lea rdx, str.struct_ForumTopicCreated_with_3_elementsp
lea rdx, str.struct_ForumTopicCreated_with_3_elementsp
lea r8, [0x140273eb8]
mov ecx, 2

Function at 0x14008717e
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi

Function at 0x140087855
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x438
mov rsi, rcx
cmp byte [rdx], 0x15
jne 0x1400881e3
test dword [rdi + 9], ebp
add byte [rax], al
invalid
mov qword [rsp + 0x30], rsi
lea r8, [0x1402749d8]
lea rax, [rsp + 0x3f]
lea eax, [rsp + 0x3f]
Function at 0x14008b4be
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x428
mov rsi, rcx
cmp byte [rdx], 0x15
jne 0x14008c360
mov qword [rsp + 0x68], rsi
mov rcx, qword [rdx + 8]
mov rax, qword [rdx + 0x18]
shl rax, 6
add rax, rcx
lea rdx, [rsp + 0x48]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
lea rdx, [rsp + 0x1f0]
and qword [rdx - 8], 0
lea rdx, [rsp + 0x138]
and qword [rdx - 8], 0
lea rdx, [rsp + 0x288]
mov qword [rdx - 0x10], 3
add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x88
add dword [rax], eax
invalid
mov qword [rdx], 8
movups xmmword [rdx + 8], xmm0
mov dword [rsp + 0x24], 0
lea r8, [0x140274818]
lea rax, [rsp + 0xe0]
and al, 0xe0
add byte [rax], al
add byte [rax - 0x77], cl
ror dword [rax - 0x77], 1
ret 0xbfe8
nop dword [rax]
mov qword [rsi + 8], rax
jmp 0x14008c4a9
Function at 0x1400910a6
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x208
mov rsi, rcx
cmp byte [rdx], 0x15
jne 0x1400916e6
mov qword [rsp + 0x28], rsi
mov r12, qword [rdx + 8]
mov rbp, qword [rdx + 0x18]
shl rbp, 6
add rbp, r12
lea rax, [rsp + 0x168]
mov qword [rax - 0x10], 3
lea rax, [rsp + 0x48]
mov qword [rax], 8
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
lea r13, [rsp + 0xe1]
lea r15, [rsp + 0xa1]
mov dword [rsp + 0x34], 0
mov eax, 3
mov qword [rsp + 0x38], rax
lea r8, [0x1402749b8]
lea rax, [rsp + 0x80]
mov rcx, rdx
mov rdx, rax
call fcn.14026d339
mov qword [rsi + 8], rax
mov qword [rsi], 3
jmp 0x1400916d2
Function at 0x140091dc4
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
movzx eax, byte [rdx]
cmp rax, 0x14
je 0x140091f15
cmp eax, 0x15
jne 0x140092004
mov rdi, qword [rdx + 8]
mov r14, qword [rdx + 0x18]
shl r14, 6
add r14, rdi
mov r12b, 6
mov r13b, 1
lea r15, [0x14031bdd4]
xor ebp, ebp
lea rbx, [rsp + 0x20]
cmp rdi, r14
je 0x140091f87
movzx eax, byte [rdi]
dec rax
cmp rax, 0xe
ja case.0x140091e30.2
movsxd rax, dword [r15 + rax*4]
add rax, r15
jmp rax
mov al, byte [rdi + 1]
cmp al, 1
sete cl
mov dl, 2
sub dl, cl
test al, al
jmp 0x140091e54
mov rax, qword [rdi + 8]
cmp rax, 1
sete cl
mov dl, 2
sub dl, cl
test rax, rax
movzx eax, dl
cmove eax, ebp
jmp 0x140091ea1
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x18]
jmp 0x140091e6e
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call fcn.14003d118
jmp 0x140091e92
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x18]
jmp 0x140091e8a
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call fcn.14003d0c4
cmp byte [rsp + 0x20], 0
jne 0x140091faa
mov al, byte [rsp + 0x21]
add rdi, 0x40
lea rdx, [rdi - 0x40]
test al, al
je 0x140091eea
movzx eax, al
cmp eax, 1
jne 0x140091e10
test r13b, 1
je 0x140092087
add rdx, 0x20
mov rcx, rbx
call fcn.14006ca8e
cmp dword [rsp + 0x20], 0
jne 0x140091faa
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x3c], eax
xor r13d, r13d
jmp 0x140091e10
cmp r12b, 6
jne 0x140092090
add rdx, 0x20
mov rcx, rbx
call fcn.140094e07
cmp byte [rsp + 0x20], 0
jne 0x140091faa
mov r12b, byte [rsp + 0x21]
jmp 0x140091e10
mov rax, qword [rdx + 8]
mov rcx, qword [rdx + 0x18]
mov rdx, rcx
shl rdx, 5
add rdx, rax
mov qword [rsp + 0x48], rdx
test rcx, rcx
je 0x140092020
lea rcx, [rax + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], 1
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov rdx, rax
call fcn.140094e07
cmp byte [rdi], 0
jne 0x140091f76
lea rdi, [rsp + 0x20]
mov bl, byte [rdi + 1]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140067a1b
cmp dword [rdi], 0
je 0x140091fcb
mov rax, qword [rsp + 0x28]
cmp r12b, 6
je 0x14009203a
test r13b, 1
jne 0x140092043
invalid
mov eax, dword [rsp + 0x3c]
mov dword [rsi + 4], eax
mov byte [rsi + 8], r12b
mov rax, qword [rsp + 0x28]
cmp dword [rsp + 0x24], 0
je 0x140092059
lea rcx, [rsp + 0x20]
mov edi, dword [rcx + 8]
mov rax, qword [rsp + 0x50]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rcx], xmm0
call fcn.14006ff44
test rax, rax
jne 0x140091f7b
mov dword [rsi + 4], edi
mov byte [rsi + 8], bl
and dword [rsi], 0
jmp 0x140091fba
lea r8, [0x140274ff8]
lea rax, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.14026d339
jmp 0x140091f7b
lea rdx, [0x1402795f8]
lea r8, [0x140273eb8]
xor ecx, ecx
lea rcx, [0x1402e8748]
jmp 0x14009204a
lea rcx, [0x1402e8c54]
mov edx, 5
call fcn.14026d161
jmp 0x140091faf
lea rdx, [0x1402795f8]
lea r8, [0x140276138]
lea rcx, [0x1402e8c54]
jmp 0x140092097
lea rcx, [0x1402e8748]
mov edx, 5
call fcn.14026d227
sbb eax, 0xff09e900
invalid
invalid
Function at 0x140026040
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002615e
xchg rbx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rbx
xchg rbx, rbp
mov qword [rsp + 0x18], rbx
xchg rbx, rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg rsi, rdi
mov qword [rsp + 0x30], rsi
xchg rsi, rdi
xchg rdx, r11
mov rbx, r11
xchg rdx, r11
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
xchg rsi, rcx
mov rbp, rsi
xchg rcx, rsi
add rdi, 0xf0
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
xchg rdi, rbx
movups xmm0, xmmword [rdi]
xchg rdi, rbx
xchg r12, rdx
mov r12, rbp
xchg r12, rdx
mov rcx, rbx
call fcn.140026840
mov ecx, 0x92a9eb6
sub ecx, 0x875b13c
add ecx, 0x5ed9a933
sub ecx, 0x1e82c5d7
add ecx, 0x3ecec01b
sub ecx, 0x177f13f2
xor ecx, 0x7854ec5e
xor ecx, 0x1c195447
xor ecx, 0xc16c4f6
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140026106
sub rdi, 0x10
xchg r14, rbp
movups xmmword [r14 + 0xf0], xmm0
xchg rbp, r14
sub rsi, 1
jne 0x1400260aa
xchg r12, rdi
mov r12, qword [rsp + 0x30]
xchg rdi, r12
mov rbx, qword [rsp + 0x38]
xchg r12, rbp
mov r12, qword [rsp + 0x40]
xchg r12, rbp
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026170
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
xchg r13, rbp
mov qword [rsp + 0x10], r13
xchg rbp, r13
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, r10
mov r10, rdx
xchg rbx, r10
lea r9, [rcx + 0xf0]
xchg rbp, rsi
mov rbp, rcx
xchg rsi, rbp
test r8d, r8d
je 0x140026255
dec rdi
shr rdi, 1
shr rdi, 3
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
sub r9, rbx
mov edx, 0x4765aef4
add edx, 0x18703308
sub edx, 0x2d4fc0a6
sub edx, 0x14a860b9
xor edx, 0x4bffae29
sub edx, 0x17665421
xor edx, 0x2e43d4b3
xor edx, 0x3c0ffc8a
sub edx, 0x2cf0329a
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140026213
mov rdx, rsi
xchg rcx, r8
mov r8, rbx
xchg rcx, r8
call fcn.140026300
mov r9, rbx
nop
add rbx, 0x45515bab
sub rbx, 0x45515b9b
sub rdi, 1
jne 0x1400261cf
xchg r9, r13
movups xmm0, xmmword [r13]
xchg r9, r13
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
mov rbp, qword [rsp + 0x38]
xchg rsi, r13
movups xmmword [r13 + 0xf0], xmm0
xchg rsi, r13
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400279b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
push rdi
sub rsp, 0x10
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
xchg r10, r14
mov r14, rcx
xchg r14, r10
test r8b, 0xf
je 0x1400279f1
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027aac
movdqa xmm2, xmmword [rsp]
nop
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027a1d
xchg r10, rsi
movdqu xmm2, xmmword [rsi + 0x200]
xchg r10, rsi
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x358a9428
add ecx, 0x36d4020d
xor ecx, 0x1347a7d4
sub ecx, 0x6fd550b6
xor ecx, 0x690f2c9d
xor ecx, 0x7a2979ed
xor ecx, 0x394466bc
sub ecx, 0x2521d2da
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a65
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rdx, r13
movups xmmword [r13 + r9], xmm0
xchg rdx, r13
nop
sub edx, 0x17c79f5c
add edx, 0x17c79f6c
cmp edx, r8d
jb 0x140027a02
mov rbx, qword [rsp + 0x20]
mov al, 0x31
xor al, 0x43
sub al, 0x27
sub al, 0x3a
xor al, 1
add al, 0x60
sub al, 0x59
sub al, 0x16
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]