joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21e5c
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [rdx]
mov rbp, r9
mov rdi, rcx
mov r8, qword [rax + 0x20]
mov rbx, rdx
lea rsi, [0x00039da0]
mov qword [r11 - 0x30], r8
lea r9, [r11 - 0x34]
lea rcx, [r11 - 0x30]
lea r8, [0x00039900]
mov rdx, rsi
mov dword [rsp + 0x24], 0xc6
call fcn.0001fe90
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
lea r8, [0x00039c00]
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.0001fe90
and dword [rsp + 0x68], 0
lea r9, [rsp + 0x68]
lea r8, [0x00039bf0]
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.0001fe90
or dword [rsp + 0x60], 0xffffffff
lea r9, [rsp + 0x60]
lea r8, [0x00039e10]
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.0001fe90
mov rax, qword [rbx + 0xa8]
mov ecx, dword [rsp + 0x68]
mov esi, dword [rsp + 0x60]
mov qword [rdi + 0x68], rax
lea rdx, [0x00041ce0]
lea rax, [0x00032ea4]
mov r14d, 1
cmp esi, 0xffffffff
mov qword [rdi + 0x58], rax
cmove esi, r14d
lea rax, [0x00026818]
mov qword [rdi + 0x60], rax
mov rax, rcx
mov r8d, 0x74786e43
add rax, rax
mov eax, dword [rdx + rax*8]
mov dword [rdi + 0x78], ecx
lea edx, [r14 + 0x37]
mov dword [rdi + 0x74], eax
mov eax, dword [rsp + 0x20]
xor ecx, ecx
imul eax, eax, 0xf4240
mov dword [rdi + 0x70], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x21fa1
and qword [rbx + 8], 0
and dword [rbx + 0x28], 0
lea rax, [0x0003dd40]
mov qword [rbx], rax
mov al, byte [rsp + 0x24]
mov qword [rbx + 0x18], rbp
mov byte [rbx + 0x21], 0
mov dword [rbx + 0x24], r14d
mov dword [rbx + 0x30], esi
mov byte [rbx + 0x20], al
jmp 0x21fa3
xor ebx, ebx
test rbx, rbx
je 0x21fb1
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x68]
mov rbp, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x220c8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov r12, r8
mov rdi, rdx
mov rbx, rcx
call fcn.00020fb0
and qword [rbx + 0x58], 0
mov byte [rbx + 0x60], 0
lea rcx, [0x0003d678]
mov qword [rbx], rcx
mov rax, qword [rdx]
mov rsi, qword [rax + 0x20]
mov dword [rbx + 0x20], 0x25
cmp byte [rdx + 0x350], 3
mov qword [rsp + 0x30], rsi
jne 0x22127
mov dl, 3
mov rcx, rdi
call fcn.00017420
and qword [rsp + 0x20], 0
lea rcx, [rdi + 0x1f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [rbx + 0x20]
mov r9, r12
mov rdx, rdi
mov rcx, rbx
call fcn.00022324
lea rcx, [rdi + 0x1f8]
xor edx, edx
mov qword [rbx + 0x30], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
lea r9, [rbx + 0x20]
lea r8, [0x00039e00]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
test eax, eax
jne 0x221c7
and qword [rsp + 0x20], 0
lea rcx, [rdi + 0x1f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [rbx + 0x20]
mov r9, r12
mov rdx, rdi
mov rcx, rbx
call fcn.00022324
lea rcx, [rdi + 0x1f8]
xor edx, edx
mov qword [rbx + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov edx, dword [rdi + 0x140]
mov rcx, rsi
call fcn.00021764
lea r9, [rbx + 0x18]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
cmp byte [rdi + 0x350], 3
jne 0x22204
mov dl, 1
mov rcx, rdi
call fcn.00017420
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
lea r8, [0x00039e30]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
mov r11b, byte [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov byte [rbx + 0x40], r11b
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x22324
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r13
sub rsp, 0x40
mov rax, qword [rdx]
mov rsi, r9
mov rbx, rdx
mov rcx, qword [rax + 0x20]
lea r9, [r11 - 0x28]
lea r8, [0x00039900]
mov qword [r11 - 0x20], rcx
lea rdx, [0x00039da0]
lea rcx, [r11 - 0x20]
mov dword [rsp + 0x20], 0xc2
call fcn.0001fe90
and dword [rbx + 0x230], 0
or dword [rsp + 0x58], 0xffffffff
lea r9, [rsp + 0x58]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x28]
call fcn.0001fe90
mov edi, dword [rsp + 0x58]
mov rcx, qword [rbx + 0x20]
cmp edi, 0xffffffff
mov r13d, 1
cmove edi, r13d
test rcx, rcx
jne 0x223b4
xor eax, eax
jmp 0x22409
mov rax, qword [rcx]
call qword [rax]
mov edx, 0x38
xor ecx, ecx
mov r8d, 0x74786e43
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r11, rax
test rax, rax
je 0x22403
and qword [r11 + 8], 0
and dword [r11 + 0x28], 0
lea rax, [0x0003dd40]
mov qword [r11], rax
mov al, byte [rsp + 0x20]
mov qword [r11 + 0x18], rsi
mov byte [r11 + 0x21], 0
mov dword [r11 + 0x24], r13d
mov dword [r11 + 0x30], edi
mov byte [r11 + 0x20], al
jmp 0x22406
xor r11d, r11d
mov rax, r11
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r13
ret
Function at 0x22570
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov r12, r8
mov rdi, rdx
mov rbx, rcx
call fcn.00020fb0
and qword [rbx + 0x58], 0
mov byte [rbx + 0x60], 0
lea rcx, [0x0003d6b0]
mov qword [rbx], rcx
mov rax, qword [rdx]
mov rsi, qword [rax + 0x20]
mov dword [rbx + 0x20], 0x2b
cmp byte [rdx + 0x350], 3
mov qword [rsp + 0x30], rsi
jne 0x225cf
mov dl, 3
mov rcx, rdi
call fcn.00017420
and qword [rsp + 0x20], 0
lea rcx, [rdi + 0x1f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [rbx + 0x20]
mov r9, r12
mov rdx, rdi
mov rcx, rbx
call fcn.000226fc
lea rcx, [rdi + 0x1f8]
xor edx, edx
mov qword [rbx + 0x30], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
lea r9, [rbx + 0x20]
lea r8, [0x00039e00]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
test eax, eax
jne 0x2266f
and qword [rsp + 0x20], 0
lea rcx, [rdi + 0x1f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [rbx + 0x20]
mov r9, r12
mov rdx, rdi
mov rcx, rbx
call fcn.000226fc
lea rcx, [rdi + 0x1f8]
xor edx, edx
mov qword [rbx + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov edx, dword [rdi + 0x140]
mov rcx, rsi
call fcn.00021764
lea r9, [rbx + 0x18]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
cmp byte [rdi + 0x350], 3
jne 0x226ac
mov dl, 1
mov rcx, rdi
call fcn.00017420
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
lea r8, [0x00039e30]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
mov r11b, byte [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov byte [rbx + 0x40], r11b
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x226fc
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [rdx]
mov rsi, r9
mov rbp, rdx
mov r8, qword [rax + 0x20]
mov rbx, rcx
lea r9, [r11 - 0x38]
mov qword [r11 - 0x30], r8
lea rdx, [0x00039da0]
lea rcx, [r11 - 0x30]
lea r8, [0x00039900]
mov dword [rsp + 0x20], 0xc2
call fcn.0001fe90
and dword [rbp + 0x230], 0
or dword [rsp + 0x68], 0xffffffff
lea r9, [rsp + 0x68]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x28]
call fcn.0001fe90
mov edi, dword [rsp + 0x68]
mov rcx, qword [rbp + 0x20]
cmp edi, 0xffffffff
mov r14d, 1
cmove edi, r14d
test rcx, rcx
jne 0x2278d
xor eax, eax
jmp 0x227fd
mov rax, qword [rcx]
call qword [rax]
mov r11, qword [rbp + 0xa8]
and qword [rbx + 0x70], 0
lea rax, [0x00032ea4]
mov edx, 0x38
xor ecx, ecx
mov r8d, 0x74786e43
mov qword [rbx + 0x78], r11
mov qword [rbx + 0x68], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r11, rax
test rax, rax
je 0x227f7
and qword [r11 + 8], 0
and dword [r11 + 0x28], 0
lea rax, [0x0003dd40]
mov qword [r11], rax
mov al, byte [rsp + 0x20]
mov qword [r11 + 0x18], rsi
mov byte [r11 + 0x21], 0
mov dword [r11 + 0x24], r14d
mov dword [r11 + 0x30], edi
mov byte [r11 + 0x20], al
jmp 0x227fa
xor r11d, r11d
mov rax, r11
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x22a48
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov r13, r8
mov rdi, rdx
mov rbx, rcx
call fcn.00020fb0
and qword [rbx + 0x58], 0
and qword [rsp + 0x20], 0
lea rcx, [0x0003d6e8]
xor r9d, r9d
xor r8d, r8d
mov qword [rbx], rcx
mov rax, qword [rdx]
lea rcx, [rdi + 0x1f8]
mov r12, qword [rax + 0x20]
xor edx, edx
mov dword [rbx + 0x20], 0x1a
mov qword [rsp + 0x30], r12
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [rbx + 0x20]
mov r9, r13
mov rdx, rdi
mov rcx, rbx
call fcn.00022c34
lea rcx, [rdi + 0x1f8]
xor edx, edx
mov qword [rbx + 0x30], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
lea r9, [rbx + 0x20]
lea r8, [0x00039e00]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
test eax, eax
jne 0x22b30
and qword [rsp + 0x20], 0
lea rcx, [rdi + 0x1f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [rbx + 0x20]
mov r9, r13
mov rdx, rdi
mov rcx, rbx
call fcn.00022c34
lea rcx, [rdi + 0x1f8]
xor edx, edx
mov qword [rbx + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov edx, dword [rdi + 0x140]
mov rcx, r12
call fcn.00021764
lea r9, [rbx + 0x18]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
lea r8, [0x00039e30]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
mov r11b, byte [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov byte [rbx + 0x40], r11b
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x22c34
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r13
sub rsp, 0x40
mov rax, qword [rdx]
mov rsi, r9
mov rbx, rdx
mov rcx, qword [rax + 0x20]
lea r9, [r11 - 0x28]
lea r8, [0x00039900]
mov qword [r11 - 0x20], rcx
lea rdx, [0x00039da0]
lea rcx, [r11 - 0x20]
mov dword [rsp + 0x20], 0xc2
call fcn.0001fe90
and dword [rbx + 0x230], 0
or dword [rsp + 0x58], 0xffffffff
lea r9, [rsp + 0x58]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x28]
call fcn.0001fe90
mov rcx, qword [rbx + 0x20]
mov edi, dword [rsp + 0x58]
mov rax, qword [rcx]
mov r13d, 1
cmp edi, 0xffffffff
cmove edi, r13d
call qword [rax]
lea edx, [r13 + 0x37]
xor ecx, ecx
mov r8d, 0x74786e43
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r11, rax
test rax, rax
je 0x22d09
and qword [r11 + 8], 0
and dword [r11 + 0x28], 0
lea rax, [0x0003dd40]
mov qword [r11], rax
mov al, byte [rsp + 0x20]
mov qword [r11 + 0x18], rsi
mov byte [r11 + 0x21], 0
mov dword [r11 + 0x24], r13d
mov dword [r11 + 0x30], edi
mov byte [r11 + 0x20], al
jmp 0x22d0c
xor r11d, r11d
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rax, r11
add rsp, 0x40
pop r13
ret

Function at 0x22ed8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rdi, r8
mov rbp, rdx
mov r12, rcx
call fcn.00020fb0
mov byte [r12 + 0x58], 0
lea rcx, [0x0003d720]
mov qword [r12], rcx
mov rax, qword [rdx]
mov dl, 3
mov rsi, qword [rax + 0x20]
mov rcx, rbp
call fcn.00017420
mov eax, dword [rbp + 0x2d8]
xor edx, edx
lea rcx, [r12 + 0x60]
lea r8d, [rdx + 0x20]
mov qword [rsp + 0x30], rsi
mov dword [r12 + 0x20], eax
call fcn.00039700
and qword [rsp + 0x20], 0
lea rcx, [rbp + 0x1f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [r12 + 0x20]
mov r9, rdi
mov rdx, rbp
mov rcx, r12
call fcn.000230ec
lea rcx, [rbp + 0x1f8]
xor edx, edx
mov qword [r12 + 0x30], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov dl, 1
mov rcx, rbp
call fcn.00017420
mov edx, dword [rbp + 0x140]
mov rcx, rsi
call fcn.00021764
lea r9, [r12 + 0x18]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
lea r8, [0x00039e30]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
mov r11b, byte [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov byte [r12 + 0x40], r11b
mov rax, r12
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x230ec
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [rdx]
mov rbp, r9
mov rbx, rdx
mov r8, qword [rax + 0x20]
mov rdi, rcx
lea r9, [r11 + 0x10]
mov qword [r11 - 0x28], r8
lea rdx, [0x00039da0]
lea rcx, [r11 - 0x28]
lea r8, [0x00039900]
mov dword [rsp + 0x58], 0xc0
call fcn.0001fe90
or dword [rsp + 0x50], 0xffffffff
lea r9, [rsp + 0x50]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x20]
call fcn.0001fe90
mov rax, qword [rbx + 0xa8]
mov esi, dword [rsp + 0x50]
mov r14d, 1
mov qword [rdi + 0x70], rax
lea rax, [0x00032ea4]
cmp esi, 0xffffffff
lea edx, [r14 + 0x37]
mov r8d, 0x74786e43
cmove esi, r14d
and qword [rdi + 0x68], 0
xor ecx, ecx
mov qword [rdi + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x231c9
and qword [rbx + 8], 0
and dword [rbx + 0x28], 0
lea rax, [0x0003dd40]
mov qword [rbx], rax
mov al, byte [rsp + 0x58]
mov qword [rbx + 0x18], rbp
mov byte [rbx + 0x21], 0
mov dword [rbx + 0x24], r14d
mov dword [rbx + 0x30], esi
mov byte [rbx + 0x20], al
jmp 0x231cb
xor ebx, ebx
test rbx, rbx
je 0x231ed
lea r9, [rsp + 0x50]
lea r8, [0x00039e50]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x20]
call fcn.0001fe90
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x232b8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
call fcn.00020fb0
mov byte [rsi + 0x58], 0
lea rcx, [0x0003d758]
mov qword [rsi], rcx
mov rax, qword [rdx]
mov dl, 3
mov r12, qword [rax + 0x20]
mov rcx, rdi
call fcn.00017420
xor edx, edx
lea rcx, [rsi + 0x60]
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x30], r12
mov dword [rsi + 0x20], 0x2c
call fcn.00039700
cmp byte [rdi + 0x350], 3
jne 0x23325
mov dl, 3
mov rcx, rdi
call fcn.00017420
and qword [rsp + 0x20], 0
lea rcx, [rdi + 0x1f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8d, dword [rsi + 0x20]
mov r9, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.00023500
lea rcx, [rdi + 0x1f8]
xor edx, edx
mov qword [rsi + 0x30], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov dl, 1
mov rcx, rdi
call fcn.00017420
mov edx, dword [rdi + 0x140]
mov rcx, r12
call fcn.00021764
lea r9, [rsi + 0x18]
lea r8, [0x00039e10]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
lea r8, [0x00039e30]
lea rdx, [0x00039da0]
lea rcx, [rsp + 0x30]
call fcn.0001fe90
mov r11b, byte [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov byte [rsi + 0x40], r11b
mov rax, rsi
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x23500
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [rdx]
mov rbp, r9
mov rdi, rcx
mov r8, qword [rax + 0x20]
mov rbx, rdx
lea rsi, [0x00039da0]
mov qword [r11 - 0x30], r8
lea r9, [r11 - 0x38]
lea rcx, [r11 - 0x30]
lea r8, [0x00039900]
mov rdx, rsi
mov dword [rsp + 0x20], 0xc6
call fcn.0001fe90
and dword [rsp + 0x68], 0
lea r9, [rsp + 0x68]
lea r8, [0x00039c00]
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.0001fe90
or dword [rsp + 0x60], 0xffffffff
lea r9, [rsp + 0x60]
lea r8, [0x00039e10]
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.0001fe90
mov rax, qword [rbx + 0xa8]
mov esi, dword [rsp + 0x60]
mov qword [rdi + 0x70], rax
lea rax, [0x00032fb0]
mov r14d, 1
mov qword [rdi + 0x60], rax
lea rax, [0x00026818]
cmp esi, 0xffffffff
mov qword [rdi + 0x68], rax
mov eax, dword [rsp + 0x68]
cmove esi, r14d
lea edx, [r14 + 0x37]
xor ecx, ecx
mov r8d, 0x74786e43
imul eax, eax, 0xf4240
mov dword [rdi + 0x78], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x2360d
and qword [rbx + 8], 0
and dword [rbx + 0x28], 0
lea rax, [0x0003dd40]
mov qword [rbx], rax
mov al, byte [rsp + 0x20]
mov qword [rbx + 0x18], rbp
mov byte [rbx + 0x21], 0
mov dword [rbx + 0x24], r14d
mov dword [rbx + 0x30], esi
mov byte [rbx + 0x20], al
jmp 0x2360f
xor ebx, ebx
test rbx, rbx
je 0x2361d
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x68]
mov rbp, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x36c78
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0xb0
mov rbp, rdx
lea rcx, [rax - 0x58]
lea rdx, str._systemroot_system32driverscx416enc.rom
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x88], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xe0], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 1
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
mov edx, 0x120089
mov dword [rsp + 0x80], 0x30
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rax
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edx, 0x100
xor ecx, ecx
mov r8d, 0x74786e43
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x36d63
mov eax, 0xc000009a
jmp 0x36ee3
xor r12d, r12d
xor esi, esi
test ebx, ebx
jne 0x36eca
mov r15d, 0x1400
xor edx, edx
mov r8d, 0x100
mov rcx, rdi
call fcn.00039700
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0x100
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x36eba
mov rax, qword [rsp + 0x68]
mov r8, rdi
add esi, eax
test eax, eax
je 0x36eba
lea r9d, [rax - 1]
lea rdx, [rbp + 0x34]
mov r10d, 0xff00
shr r9d, 2
inc r9d
mov ecx, dword [r8]
add r8, 4
movzx eax, cl
shl eax, 0x12
or eax, 0x20800
mov dword [rbp], eax
or eax, r15d
add rbp, 0x50
mov dword [rdx - 0x30], eax
mov eax, ecx
and eax, r10d
or eax, 0x8a
shl eax, 0xa
mov dword [rdx - 0x2c], eax
or eax, r15d
mov dword [rdx - 0x28], eax
mov eax, ecx
and ecx, 0xff9a003f
and eax, 0xff0000
or ecx, 0x9a0000
or eax, 0x9200
shr ecx, 6
shl eax, 2
mov dword [rdx - 0x24], eax
or eax, r15d
mov dword [rdx - 0x20], eax
mov dword [rdx - 0x1c], ecx
mov eax, r12d
and eax, 0x3f0000
or ecx, r15d
or eax, 0x40a200
mov dword [rdx - 0x18], ecx
shl eax, 2
mov dword [rdx - 0x14], eax
or eax, r15d
mov dword [rdx - 0x10], eax
mov eax, r12d
and eax, r10d
or eax, 0xaa
shl eax, 0xa
mov dword [rdx - 0xc], eax
or eax, r15d
mov dword [rdx - 8], eax
movzx eax, r12b
inc r12d
shl eax, 0x12
or eax, 0x2c800
mov dword [rdx - 4], eax
or eax, r15d
mov dword [rdx], eax
or rax, 0xffffffffffffffff
add rdx, 0x50
sub r9, 1
mov qword [rdx - 0x4c], rax
mov qword [rdx - 0x44], rax
mov qword [rdx - 0x3c], rax
jne 0x36df0
cmp esi, 0x3e800
jae 0x36eca
test ebx, ebx
je 0x36d76
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
Function at 0x414480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41460b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x005451d8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004302e0
xorps xmm15, xmm15
mov r14, qword [0x005a49e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4144e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4144f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414513
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414523
cmp rbx, 0x1000
jae 0x4144eb
jmp 0x41458d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414535
xor edx, edx
jmp 0x414584
mov rcx, qword [0x005451d8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004302e0
xorps xmm15, xmm15
mov r14, qword [0x005a49e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414519
jmp 0x414508
call fcn.0045ec20
xorps xmm15, xmm15
mov r14, qword [0x005a49e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004346e0
lea rax, [0x004b68af]
mov ebx, 0x18
nop dword [rax]
call fcn.00434f60
mov rax, qword [rsp + 0x38]
call fcn.00434ca0
lea rax, [0x004b6d46]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434f60
mov rax, qword [rsp + 0x30]
call fcn.00434ca0
call fcn.00434920
call fcn.00434740
lea rax, [0x004b8cfe]
mov ebx, 0x21
call fcn.00432d40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414480