joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409100
Capabilities:
Create directory

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov rsi, rdx
lea rcx, [rbp + 0xb8]
call fcn.00403ff0
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xb8]
call fcn.00402b20
cmp qword [rbp - 0x28], 7
lea rdx, [rbp - 0x40]
cmova rdx, qword [rbp - 0x40]
xor ecx, ecx
xor r8d, r8d
call sub.SHELL32_SHCreateDirectoryExW
mov edi, eax
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x409172
mov rcx, qword [rbp - 0x40]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x40916d
mov rcx, qword [rcx - 8]
call fcn.00410390
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], 0
mov word [rbp - 0x40], 0
mov rax, qword [rbp + 0xd8]
cmp rax, 8
jb 0x4091b2
mov rcx, qword [rbp + 0xc0]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x4091ad
mov rcx, qword [rcx - 8]
call fcn.00410390
test edi, edi
je 0x4091c2
call sub.KERNEL32_GetLastError
xor eax, eax
jmp 0x409336
lea rcx, [rbp + 0xb8]
mov rdx, rsi
call fcn.00403ff0
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0xb8]
mov r8d, 0x80
mov r9d, 0x1b6
call fcn.00405250
mov rax, qword [rbp + 0xd8]
cmp rax, 8
jb 0x409217
mov rcx, qword [rbp + 0xc0]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x409212
mov rcx, qword [rcx - 8]
call fcn.00410390
cmp qword [rbp + 0x40], 0
je 0x409344
mov ecx, 0x2ad
call fcn.00413760
mov rbx, rax
lea rdx, [0x00433420]
mov r8d, 0x2ad
mov rcx, rbx
call fcn.0041ac90
mov qword [rbp + 0xd8], 7
mov qword [rbp + 0xd0], 0
mov word [rbp + 0xc0], 0
lea rcx, [rbp + 0xb8]
mov edx, 0x2ad
mov r8d, 1
call fcn.00403cb0
mov r8, rbx
add r8, 0x2ad
test al, al
je 0x4092af
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], 0
mov word [rax], 0
lea rcx, [rbp + 0xb8]
mov rdx, rbx
call fcn.00404ac0
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0xb8]
call fcn.00405410
mov rax, qword [rbp + 0xd8]
cmp rax, 8
jb 0x4092f8
mov rcx, qword [rbp + 0xc0]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x4092f3
mov rcx, qword [rcx - 8]
call fcn.00410390
lea rcx, [rbp - 0x48]
call fcn.004056e0
mov rcx, rbx
call fcn.00410390
lea rax, [0x00438478]
mov qword [rbp - 0x48], rax
lea rsi, [rbp + 0x58]
lea rax, [0x004384a0]
mov qword [rbp + 0x58], rax
lea rcx, [rbp - 0x40]
call fcn.00408cf0
mov rcx, rsi
call fcn.00410540
mov al, 1
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 0x38
call fcn.0042ffc0
mov rbx, rax
call sub.KERNEL32_GetLastError
lea r8, [0x004336f8]
lea rcx, [rbp - 0x60]
mov edx, 0x15
mov r9d, eax
call fcn.0041f400
test eax, eax
jg 0x409391
mov qword [rbp + 0xd8], 0xf
mov qword [rbp + 0xd0], 0
mov byte [rbp + 0xc0], 0
jmp 0x4093c1
movsxd r8, eax
mov qword [rbp + 0xd8], 0xf
mov qword [rbp + 0xd0], 0
mov byte [rbp + 0xc0], 0
lea rcx, [rbp + 0xb8]
lea rdx, [rbp - 0x60]
call fcn.00409a40
lea rax, [0x004336fc]
mov qword [rbx + 8], rax
lea rax, [0x00438720]
mov qword [rbx], rax
mov rcx, rbx
add rcx, 0x10
mov qword [rbx + 0x30], 0xf
mov qword [rbx + 0x28], 0
mov byte [rbx + 0x18], 0
lea rdx, [rbp + 0xb8]
xor r8d, r8d
mov r9, 0xffffffffffffffff
call fcn.00406260
lea rdx, [0x00438570]
lea r8, [0x00406e60]
xor r9d, r9d
mov rcx, rbx
call fcn.004300c0
ud2
Function at 0x40ffe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r13, r8
mov rbx, rdx
mov r14, rcx
lea rax, [r14 + 8]
mov qword [rbp], rax
movabs r15, 0x7fffffffffffffff
xor r12d, r12d
jmp 0x41002c
mov qword [rbx], 0
mov al, 1
mov byte [rbx + 8], al
mov rcx, qword [rbx]
test rcx, rcx
mov edi, 0
je 0x410074
mov rax, qword [rcx + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x410060
mov rdx, qword [rcx + 0x50]
cmp dword [rdx], 0
jle 0x410060
movzx eax, word [rax]
jmp 0x410066
mov rax, qword [rcx]
call qword [rax + 0x38]
movzx eax, ax
xor edi, edi
cmp eax, 0xffff
setne dil
mov rcx, qword [r13]
test rcx, rcx
je 0x4100f0
mov rax, qword [rcx + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x4100a0
mov rdx, qword [rcx + 0x50]
cmp dword [rdx], 0
jle 0x4100a0
movzx eax, word [rax]
jmp 0x4100a6
mov rax, qword [rcx]
call qword [rax + 0x38]
movzx ecx, ax
xor eax, eax
cmp ecx, 0xffff
setne al
cmp edi, eax
je 0x4101ce
cmp byte [rbx + 8], 0
jne 0x41012b
mov rcx, qword [rbx]
test rcx, rcx
je 0x410120
mov rax, qword [rcx + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x4100fb
mov rdx, qword [rcx + 0x50]
cmp dword [rdx], 0
jle 0x4100fb
movzx eax, word [rax]
jmp 0x410101
xor eax, eax
cmp edi, eax
jne 0x4100bc
jmp 0x4101ce
mov rax, qword [rcx]
call qword [rax + 0x38]
movzx ecx, ax
cmp ecx, 0xffff
je 0x410120
mov word [rbx + 0xa], ax
jmp 0x410127
mov qword [rbx], 0
mov byte [rbx + 8], 1
movzx edi, word [rbx + 0xa]
mov rax, qword [r14 + 0x10]
cmp rax, qword [r14 + 0x18]
jne 0x41016d
sub rax, qword [r14 + 8]
sar rax, 1
mov rdx, rax
shr rdx, 1
mov rcx, rdx
xor rcx, r15
add rdx, rax
cmp rcx, rax
lea rax, [rax + 1]
cmovb rdx, r12
cmp rdx, rax
cmovb rdx, rax
mov rcx, r14
call fcn.00410250
mov rax, qword [r14 + 0x10]
mov word [rax], di
add rax, 2
mov qword [r14 + 0x10], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x410020
mov rax, qword [rcx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x4101b0
mov rdi, qword [rcx + 0x50]
mov esi, dword [rdi]
test esi, esi
jle 0x4101b0
dec esi
mov dword [rdi], esi
lea rcx, [rdx + 2]
mov qword [rax], rcx
movzx eax, word [rdx]
jmp 0x4101b6
mov rax, qword [rcx]
call qword [rax + 0x40]
movzx eax, ax
cmp eax, 0xffff
je 0x410020
xor eax, eax
mov byte [rbx + 8], al
jmp 0x41002c
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x415cc0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
test rsi, rsi
je 0x415e02
test rbx, rbx
je 0x415e02
test r15, r15
je 0x415e02
lea rcx, [0x00434990]
call sub.KERNEL32_GetModuleHandleA
mov rdi, rax
test rdi, rdi
je 0x415e02
mov r13, qword [rbp + 0x78]
mov r12, qword [rbp + 0x70]
lea rdx, [0x00434999]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [rsi], rax
lea rdx, [0x004349b2]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [rbx], rax
lea rdx, [0x004349cd]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r15], rax
lea rdx, [0x004349ec]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r14], rax
lea rdx, [0x00434a07]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r12], rax
lea rdx, [0x00434a35]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r13], rax
mov rax, qword [rsi]
mov qword [0x00446370], rax
cmp qword [r14], 0
je 0x415dde
cmp qword [r12], 0
jne 0x415dac
lea rax, [0x00415c70]
mov qword [r12], rax
mov rcx, qword [r13]
test rcx, rcx
je 0x415df1
cmp qword [rsi], 0
je 0x415e02
cmp qword [rbx], 0
je 0x415e02
cmp qword [r15], 0
je 0x415e02
cmp qword [r14], 0
je 0x415e02
cmp qword [r12], 0
je 0x415e02
xor eax, eax
test rcx, rcx
setne al
jmp 0x415e04
lea rax, [0x00415c80]
mov qword [r14], rax
cmp qword [r12], 0
jne 0x415dac
jmp 0x415da1
lea rcx, [0x00415c70]
mov qword [r13], rcx
cmp qword [rsi], 0
jne 0x415dbb
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x417ba0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
cmp dword [0x004467c0], 0
jg 0x417c0c
mov eax, dword [0x004467c0]
test eax, eax
jg 0x417c0c
mov esi, 0xffffffff
nop word cs:[rax + rax]
test eax, eax
jne 0x417be0
xor eax, eax
lock cmpxchg dword [0x004467c0], esi
je 0x417bf5
xor ecx, ecx
xor edx, edx
call sub.KERNEL32_SleepEx
mov eax, dword [0x004467c0]
test eax, eax
jle 0x417bd0
jmp 0x417c0c
lea rcx, [0x004467c8]
call fcn.00432660
mov eax, 1
xchg dword [0x004467c0], eax
lea rcx, [0x004467c8]
call fcn.00432528
cmp qword [0x004463c0], 0
jne 0x417c9a
lea rcx, [rbp - 0x28]
call sub.KERNEL32_GetSystemInfo
mov eax, dword [rbp]
lea ecx, [rax - 1]
test rcx, rax
jne 0x417cae
mov edx, 0xffffffff
mov ecx, dword [rbp - 0x24]
add edx, ecx
test rdx, rcx
jne 0x417cae
mov qword [0x004463d0], rax
mov qword [0x004463c8], rcx
movaps xmm0, xmmword [0x00434b60]
movups xmmword [0x004463d8], xmm0
mov dword [0x004463e8], 7
mov dword [0x00446760], 7
lea rcx, [0x00446768]
mov edx, 0x80000fa0
call sub.KERNEL32_InitializeCriticalSectionAndSpinCount
call sub.KERNEL32_GetTickCount
and eax, 0xfffffff0
xor eax, 0x55555558
mov qword [0x004463c0], rax
lea rcx, [0x004467c8]
call fcn.00432690
nop
add rsp, 0x58
pop rsi
pop rbp
ret
call fcn.0042b5e0
ud2
Function at 0x41b9b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, edx
call sub.KERNEL32_GetFileAttributesA
mov ecx, eax
cmp ecx, 0xffffffff
je 0x41b9ed
xor eax, eax
test sil, 2
je 0x41b9e6
and ecx, 1
je 0x41b9e6
call fcn.0042adc0
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x28
pop rsi
pop rbp
ret
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.0041e360
jmp 0x41b9b0

Function at 0x41bdd0
Capabilities:
Check if file exists

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov ebx, edx
mov r14, rcx
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x40], r8
call fcn.0041d800
test bh, 0xc0
jne 0x41be06
mov rax, qword [0x00443bb0]
mov ecx, 0xc000
and ecx, dword [rax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
shr eax, 8
mov edi, 3
cmp eax, 6
ja 0x41be31
shl rax, 0x28
sar rax, 0x28
lea rcx, [0x00434bc0]
mov edi, dword [rcx + rax*4]
test bh, 1
je 0x41be56
lea rax, [rbp + 0x48]
mov qword [rbp - 0x18], rax
mov al, byte [0x0043e380]
and al, byte [rbp + 0x40]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x41be66
mov rcx, r14
call sub.KERNEL32_GetFileAttributesA
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x41be7f
cmp al, 2
je 0x41be86
cmp al, 1
jne 0x41bf68
mov edx, 0x40000000
jmp 0x41be8b
mov edx, 0x80000000
jmp 0x41be8b
mov edx, 0xc0000000
mov eax, ebx
and eax, 0x70
add eax, 0xfffffff0
shr eax, 4
cmp eax, 3
mov esi, 3
cmovb esi, eax
xor r8d, r8d
cmp edx, 0x80000000
sete r8b
test bl, 4
cmove r8d, esi
mov dword [rbp - 0x18], 0x18
mov qword [rbp - 0x10], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [rbp - 8], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x30], 0
lea r9, [rbp - 0x18]
mov rcx, r14
call sub.KERNEL32_CreateFileA
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x41bf48
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov rcx, rsi
call fcn.0041bd20
mov edx, edi
or edx, 0x2000
test eax, eax
cmove edx, edi
and edx, 0xfffff8ff
mov rcx, rsi
call fcn.0041d9f0
mov edi, eax
cmp edi, 0xffffffff
jne 0x41bf74
mov ecx, 4
call fcn.0041e2a0
mov rcx, rsi
call sub.KERNEL32_CloseHandle
mov edi, 0xffffffff
jmp 0x41bf74
call sub.KERNEL32_GetLastError
movzx eax, ax
test bh, 1
mov edx, 0x50
mov ecx, 2
cmovne ecx, edx
cmp eax, 0x6e
cmovne ecx, eax
jmp 0x41bf6d
mov ecx, 1
call fcn.0041e2a0
mov edi, eax
call fcn.0041d860
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x41c1b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov ebx, edx
mov r14, rcx
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x40], r8
call fcn.0041d800
test bh, 0xc0
jne 0x41c1e6
mov rax, qword [0x00443bb0]
mov ecx, 0xc000
and ecx, dword [rax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
shr eax, 8
mov edi, 3
cmp eax, 6
ja 0x41c211
shl rax, 0x28
sar rax, 0x28
lea rcx, [0x00434be0]
mov edi, dword [rcx + rax*4]
test bh, 1
je 0x41c236
lea rax, [rbp + 0x48]
mov qword [rbp - 0x18], rax
mov al, byte [0x0043e380]
and al, byte [rbp + 0x40]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x41c246
mov rcx, r14
call sub.KERNEL32_GetFileAttributesW
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x41c25f
cmp al, 2
je 0x41c266
cmp al, 1
jne 0x41c348
mov edx, 0x40000000
jmp 0x41c26b
mov edx, 0x80000000
jmp 0x41c26b
mov edx, 0xc0000000
mov eax, ebx
and eax, 0x70
add eax, 0xfffffff0
shr eax, 4
cmp eax, 3
mov esi, 3
cmovb esi, eax
xor r8d, r8d
cmp edx, 0x80000000
sete r8b
test bl, 4
cmove r8d, esi
mov dword [rbp - 0x18], 0x18
mov qword [rbp - 0x10], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [rbp - 8], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x30], 0
lea r9, [rbp - 0x18]
mov rcx, r14
call sub.KERNEL32_CreateFileW
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x41c328
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov rcx, rsi
call fcn.0041bd20
mov edx, edi
or edx, 0x2000
test eax, eax
cmove edx, edi
and edx, 0xfffff8ff
mov rcx, rsi
call fcn.0041d9f0
mov edi, eax
cmp edi, 0xffffffff
jne 0x41c354
mov ecx, 4
call fcn.0041e2a0
mov rcx, rsi
call sub.KERNEL32_CloseHandle
mov edi, 0xffffffff
jmp 0x41c354
call sub.KERNEL32_GetLastError
movzx eax, ax
test bh, 1
mov edx, 0x50
mov ecx, 2
cmovne ecx, edx
cmp eax, 0x6e
cmovne ecx, eax
jmp 0x41c34d
mov ecx, 1
call fcn.0041e2a0
mov edi, eax
call fcn.0041d860
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x41c830
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x00443390], ecx
jbe 0x41c86c
movsxd rax, ecx
lea rcx, [0x00447010]
mov rcx, qword [rcx + rax*8]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call sub.KERNEL32_ReadFile
cmp eax, 1
jne 0x41c87d
mov eax, dword [rbp - 4]
jmp 0x41c876
mov ecx, 6
call fcn.0041e2a0
nop
add rsp, 0x30
pop rbp
ret
call sub.KERNEL32_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x41c876
jmp 0x41c871

Function at 0x41c8c0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x00443390], ecx
jbe 0x41c8fc
movsxd rax, ecx
lea rcx, [0x00447010]
mov rcx, qword [rcx + rax*8]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call sub.KERNEL32_WriteFile
cmp eax, 1
jne 0x41c908
mov eax, dword [rbp - 4]
jmp 0x41c90d
mov ecx, 6
call fcn.0041e2a0
jmp 0x41c90d
call fcn.0041e360
nop
add rsp, 0x30
pop rbp
ret
Function at 0x41fec0
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call sub.KERNEL32_DeleteFileA
cmp eax, 1
jne 0x41fedc
xor eax, eax
add rsp, 0x20
pop rbp
ret
add rsp, 0x20
pop rbp
jmp fcn.0041e360

Function at 0x420160
Capabilities:
Timestomp file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rdi, rdx
call fcn.0041ecb0
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x4201a7
test rdi, rdi
je 0x4201ae
mov rcx, qword [rdi]
lea rdx, [rbp - 8]
call fcn.0041fef0
cmp eax, 1
jne 0x4201e1
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x10]
call fcn.0041fef0
cmp eax, 1
je 0x4201ce
jmp 0x4201e1
mov ecx, 0xffffffff
jmp 0x4201ee
lea rdi, [rbp - 0x20]
mov rcx, rdi
call sub.KERNEL32_GetLocalTime
lea rdx, [rbp - 8]
mov rcx, rdi
call sub.KERNEL32_SystemTimeToFileTime
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
lea r8, [rbp - 8]
lea rdx, [rbp - 0x10]
mov rcx, rsi
mov r9, rdx
call sub.KERNEL32_SetFileTime
xor ecx, ecx
test eax, eax
jne 0x4201ee
call fcn.0041e360
mov ecx, eax
mov eax, ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x422cf0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, edx
call sub.KERNEL32_GetFileAttributesA
mov ecx, eax
cmp ecx, 0xffffffff
je 0x41b9ed
xor eax, eax
test sil, 2
je 0x41b9e6
and ecx, 1
je 0x41b9e6
call fcn.0042adc0
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x28
pop rsi
pop rbp
ret
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.0041e360
jmp 0x41b9b0
Function at 0x424780
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov r14, rdx
mov r15, rcx
mov ecx, dword [r15 + 4]
lea rbx, [rbp - 0x60]
mov edi, pe_nt_image_headers64
mov edx, 0x1001
mov r9d, pe_nt_image_headers64
mov r8, rbx
call sub.KERNEL32_GetLocaleInfoA
mov rcx, rbx
call fcn.0041b6a0
mov word [rbp + rax - 0x60], 0x5f
mov esi, dword [r15 + 4]
mov rcx, rbx
call fcn.0041b6a0
lea r8, [rbp + rax - 0x60]
sub edi, eax
mov edx, 0x1002
mov ecx, esi
mov r9d, edi
call sub.KERNEL32_GetLocaleInfoA
mov rcx, rbx
call fcn.0041b6a0
mov word [rbp + rax - 0x60], 0x2e
mov esi, dword [r15]
mov rcx, rbx
call fcn.0041b6a0
lea rdx, [rbp + rax - 0x60]
mov r8d, 0xa
mov ecx, esi
call fcn.00428540
mov rbx, qword [r15 + 0x38]
test rbx, rbx
je 0x424863
mov rcx, rbx
call fcn.0041b6a0
mov rsi, rax
mov rcx, r14
call fcn.0041b6a0
mov rdi, rax
lea rcx, [rbp - 0x60]
call fcn.0041b6a0
add rdi, rsi
lea rdx, [rax + rdi + 3]
mov rcx, rbx
call fcn.004160f0
mov rbx, rax
mov qword [r15 + 0x38], rbx
test rbx, rbx
jne 0x4248a7
jmp 0x4248ea
mov rcx, r14
call fcn.0041b6a0
mov rsi, rax
lea rcx, [rbp - 0x60]
call fcn.0041b6a0
mov rdi, rax
lea rcx, [rsi + rdi + 3]
call fcn.004160d0
mov rbx, rax
mov qword [r15 + 0x38], rbx
test rbx, rbx
je 0x4248ea
mov rcx, r14
call fcn.0041b6a0
lea r8, [rdi + rax + 3]
xor edx, edx
mov rcx, rbx
call fcn.0041af60
mov rcx, rbx
mov rdx, r14
call fcn.0041b730
mov rsi, qword [r15 + 0x38]
mov rcx, rsi
call fcn.0041b6a0
mov word [rsi + rax], 0x3d
mov rcx, qword [r15 + 0x38]
lea rdx, [rbp - 0x60]
call fcn.0041b730
mov rsi, qword [r15 + 0x38]
mov rcx, rsi
call fcn.0041b6a0
mov word [rsi + rax], 0xa
mov eax, 1
jmp 0x4248ec
xor eax, eax
add rsp, 0x228
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x424900
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov rdi, rdx
mov r12, rcx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x60], 0x656e6f6e
mov dword [rbp + 0xc], 0x303030
mov rcx, rdi
call fcn.00426a20
xor esi, esi
mov r13d, 1
lea r14, [rbp - 0x60]
lea rbx, [rbp + 0xc]
mov r15d, 1
mov qword [rbp + 0x10], rdi
nop word cs:[rax + rax]
mov edi, r15d
and edi, 0xfbff
or edi, 0x400
mov edx, 0x1001
mov r9d, 0x40
mov ecx, edi
mov r8, r14
call sub.KERNEL32_GetLocaleInfoA
mov edx, 3
mov r9d, 4
mov ecx, edi
mov rdi, qword [rbp + 0x10]
mov r8, rbx
call sub.KERNEL32_GetLocaleInfoA
mov rcx, r14
call fcn.00426a20
mov rcx, rbx
call fcn.00426a20
mov rcx, rdi
mov rdx, r14
call fcn.0041a920
test rax, rax
jne 0x424a47
mov rcx, rbx
call fcn.0041b6a0
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.0041b210
xor ecx, ecx
test eax, eax
setne cl
cmove esi, r13d
add r15d, ecx
cmp r15d, 0x38
jg 0x4249ff
test esi, esi
je 0x424970
test esi, esi
jne 0x424a47
mov edx, 0x5f
mov rcx, rdi
call fcn.0041b850
test rax, rax
jne 0x424a2b
mov edx, 0x2e
mov rcx, rdi
call fcn.0041b850
test rax, rax
je 0x424b57
mov r15d, dword [r12 + 4]
test r15d, r15d
je 0x424a3e
and r15d, 0x3ff
jmp 0x424a47
call sub.KERNEL32_GetSystemDefaultLangID
movzx r15d, ax
mov edx, 0x5f
mov rcx, rdi
call fcn.0041b850
test rax, rax
je 0x424b05
mov qword [rbp], r12
inc rax
mov edx, 0x2e
mov qword [rbp - 0x10], rax
mov rcx, rax
call fcn.0041b850
test rax, rax
je 0x424a7d
mov byte [rax], 0
mov qword [rbp - 8], rax
xor ebx, ebx
lea rdi, [rbp - 0x60]
mov r13d, 1
xor r12d, r12d
mov eax, r13d
shl eax, 0xa
or eax, r15d
movzx esi, ax
mov edx, 0x1002
mov r9d, 0x40
mov ecx, esi
mov r8, rdi
call sub.KERNEL32_GetLocaleInfoA
mov r14d, eax
mov rcx, rdi
call fcn.00426a20
mov rcx, rdi
mov rdx, qword [rbp - 0x10]
call fcn.0041b7c0
xor ecx, ecx
test eax, eax
setne al
mov edx, 1
cmove r12d, edx
cmove ebx, esi
test r14d, r14d
je 0x424aea
mov cl, al
add r13d, ecx
test r12d, r12d
je 0x424a90
test r12d, r12d
je 0x424b57
mov rax, qword [rbp - 8]
test rax, rax
je 0x424afb
mov byte [rax], 0x2e
mov r12, qword [rbp]
mov rdi, qword [rbp + 0x10]
jmp 0x424b16
and r15d, 0xfbff
or r15d, 0x400
mov ebx, r15d
mov edx, 0x2e
mov rcx, rdi
call fcn.0041b850
mov rsi, rax
test rsi, rsi
je 0x424b30
inc rsi
jmp 0x424b49
lea rsi, [rbp - 0x17]
mov edx, 0xb
mov r9d, 7
mov ecx, ebx
mov r8, rsi
call sub.KERNEL32_GetLocaleInfoA
mov rcx, rsi
call fcn.00427900
mov dword [r12], eax
jmp 0x424b63
mov ecx, 0x20000101
call sub.KERNEL32_SetLastError
xor ebx, ebx
mov eax, ebx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x4266c0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r13, rdx
mov r14d, ecx
mov r8, qword [r13 + 8]
xor r12d, r12d
mov edx, 0xe
xor r9d, r9d
call sub.KERNEL32_GetLocaleInfoA
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.004160d0
mov qword [r13 + 8], rax
mov edx, 0xe
mov ecx, r14d
mov r8, rax
mov r9d, edi
call sub.KERNEL32_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
mov r8, qword [r13]
mov edx, 0xf
xor r9d, r9d
mov ecx, r14d
call sub.KERNEL32_GetLocaleInfoA
mov edi, eax
inc edi
movsxd rcx, edi
call fcn.004160d0
mov qword [r13], rax
test r13, r13
je 0x426761
mov edx, 0xf
mov ecx, r14d
mov r8, rax
mov r9d, edi
call sub.KERNEL32_GetLocaleInfoA
xor r12d, r12d
test eax, eax
setne r12b
jmp 0x42676b
mov ecx, 0xe
call sub.KERNEL32_SetLastError
and r12d, ebx
mov r8, qword [r13 + 0x10]
xor r15d, r15d
mov edx, 0x10
xor r9d, r9d
mov ecx, r14d
call sub.KERNEL32_GetLocaleInfoA
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.004160d0
mov qword [r13 + 0x10], rax
mov edx, 0x10
mov ecx, r14d
mov r8, rax
mov r9d, edi
call sub.KERNEL32_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
mov r8, qword [r13 + 0x18]
mov edx, 0x50
xor r9d, r9d
mov ecx, r14d
call sub.KERNEL32_GetLocaleInfoA
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.004160d0
mov qword [r13 + 0x18], rax
mov edx, 0x50
mov ecx, r14d
mov r8, rax
mov r9d, edi
call sub.KERNEL32_GetLocaleInfoA
xor esi, esi
test eax, eax
setne sil
and esi, ebx
and esi, r12d
mov r8, qword [r13 + 0x20]
mov edx, 0x51
xor r9d, r9d
mov ecx, r14d
call sub.KERNEL32_GetLocaleInfoA
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.004160d0
mov qword [r13 + 0x20], rax
mov edx, 0x51
mov ecx, r14d
mov r8, rax
mov r9d, edi
call sub.KERNEL32_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, esi
mov ecx, 4
call fcn.004160d0
mov rdi, rax
test rdi, rdi
je 0x42687f
mov edx, 0x11
mov r9d, 4
mov ecx, r14d
mov r8, rdi
call sub.KERNEL32_GetLocaleInfoA
test eax, eax
je 0x42688b
mov rcx, rdi
call fcn.00427900
mov word [r13 + 0x28], ax
mov rcx, rdi
call fcn.004160e0
mov r15d, 1
jmp 0x426896
mov ecx, 0xe
call sub.KERNEL32_SetLastError
jmp 0x426896
mov rcx, rdi
call fcn.004160e0
xor r15d, r15d
and ebx, r15d
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret