joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ec440
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180583020]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov dword [0x1805d57bc], ebx
lea ecx, [rbx + 8]
call fcn.1800f15d0
lea rcx, [0x1800ec080]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1800eae30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800ec501
cmp dword [rsp + 0x38], ebx
je 0x1800ec4f5
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1800ec4f5
mov dword [0x1805d57b8], ebx
lea rax, [0x18054645c]
mov qword [0x18059e768], rax
mov byte [0x18059daa4], 1
mov byte [0x18059da86], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800f15b0
add rsp, 0x60
pop rbx
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800ed310
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1800ed371
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800ed330
mov ecx, dword [r9]
jmp 0x1800ed458
cmp ecx, 0x4e0
jb 0x1800ed458
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800ed390
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800ed3e0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800eda80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800edcd0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800edb9a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800edae4
mov rax, qword [0x180583008]
cmp qword [rsp + 0x20], rax
ja 0x1800edae4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800edaa6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800edb15
jmp 0x1800edb9a
cmp dword [rsp + 0x50], 0x10000
jne 0x1800edb7d
cmp qword [rsp + 0x48], 0x10000
jb 0x1800edb7d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800edb5b
mov rax, qword [rsp + 0x28]
jmp 0x1800edb9c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800edb6b
xor eax, eax
jmp 0x1800edb9c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800edb95
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800edcd0
mov qword [rsp + 0x20], rax
jmp 0x1800edaa6
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800edbb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800edd10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800edcc6
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800edc0b
mov rax, qword [0x180583008]
cmp qword [rsp + 0x20], rax
ja 0x1800edc0b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800edbcd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800edc3c
jmp 0x1800edcc6
cmp dword [rsp + 0x50], 0x10000
jne 0x1800edca4
cmp qword [rsp + 0x48], 0x10000
jb 0x1800edca4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800edc82
mov rax, qword [rsp + 0x28]
jmp 0x1800edcc8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800edc92
xor eax, eax
jmp 0x1800edcc8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800edcc1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800edd10
mov qword [rsp + 0x20], rax
jmp 0x1800edbcd
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800edd60
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800ee2f0
mov qword [rsp + 0x28], 0
cmp qword [0x18059f548], 0
jne 0x1800edda8
cmp qword [0x18059f540], 0
je 0x1800edda8
mov rax, qword [0x18059f540]
mov qword [0x18059f548], rax
cmp qword [0x18059f548], 0
je 0x1800ede4e
mov rax, qword [0x18059f548]
cmp qword [rax + 0x10], 0
je 0x1800ede4e
mov rax, qword [0x18059f548]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800ede4e
mov rax, qword [0x18059f548]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800ede4e
mov rax, qword [0x18059f548]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800ede14
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800ede1b
xor eax, eax
jmp 0x1800edfc9
mov rax, qword [0x18059f548]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800edfc9
mov rax, qword [0x18059f540]
mov qword [0x18059f548], rax
jmp 0x1800ede70
mov rax, qword [0x18059f548]
mov rax, qword [rax + 8]
mov qword [0x18059f548], rax
cmp qword [0x18059f548], 0
je 0x1800edebd
cmp qword [0x18059f548], 0
je 0x1800edebb
mov rax, qword [0x18059f548]
cmp qword [rax + 0x10], 0
je 0x1800edebb
mov rax, qword [0x18059f548]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800edebb
mov rax, qword [0x18059f548]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800edebb
jmp 0x1800eddec
jmp 0x1800ede5e
mov rcx, qword [rsp + 0x60]
call fcn.1800f0190
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800edfd0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800edfc7
mov rax, qword [rsp + 0x48]
mov qword [0x18059f548], rax
mov rax, qword [0x18059f548]
mov dword [rax], 0x52727464
mov rax, qword [0x18059f548]
mov qword [rax + 0x10], 0
mov rax, qword [0x18059f548]
mov rcx, qword [0x18059f540]
mov qword [rax + 8], rcx
mov rax, qword [0x18059f548]
mov qword [0x18059f540], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18059f548]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800edf78
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800edfb2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800edf6e
mov rax, qword [0x18059f548]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800eddec
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800eece0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800eed27
xor al, al
jmp 0x1800eedc9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800eed51
xor al, al
jmp 0x1800eedc9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1800eedc1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1800eedc1
mov al, 1
jmp 0x1800eedc9
jmp 0x1800eedc7
xor al, al
add rsp, 0x78
ret

Function at 0x1800ef0d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18059f540]
mov qword [rsp + 0x28], rax
jmp 0x1800ef0f0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800ef11f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800ef11d
call sub.KERNEL32.dll_GetLastError
jmp 0x1800ef121
jmp 0x1800ef0e2
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800ef7e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18059f558], eax
je 0x1800ef80d
mov eax, 0x10dd
jmp 0x1800efa26
cmp dword [0x18059f55c], 0
je 0x1800ef821
mov eax, dword [0x18059f55c]
jmp 0x1800efa26
cmp qword [rsp + 0x78], 0
jne 0x1800ef833
mov eax, 0x57
jmp 0x1800efa26
cmp qword [rsp + 0x70], 0
jne 0x1800ef845
mov eax, 6
jmp 0x1800efa26
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800ef877
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x18059f55c], eax
mov rax, qword [rsp + 0x70]
mov qword [0x18059f560], rax
mov eax, dword [rsp + 0x20]
jmp 0x1800efa26
mov ecx, 0x30
call fcn.1800f15d0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800ef8e9
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x18059f55c], eax
cmp qword [rsp + 0x30], 0
je 0x1800ef8d4
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x50]
call fcn.1800f19a0
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x18059f560], rax
mov eax, dword [rsp + 0x20]
jmp 0x1800efa26
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.1800ef7b0
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.1800ef7b0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x1800ef946
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x1800ef963
mov dword [rsp + 0x20], 9
cmp dword [0x18059f550], 0
je 0x1800ef95e
jmp 0x1800ef8aa
jmp 0x1800ef8a0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x1800ef990
mov dword [rsp + 0x20], 9
cmp dword [0x18059f550], 0
je 0x1800ef98b
jmp 0x1800ef8aa
jmp 0x1800ef8a0
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800ef9c7
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800ef8a0
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x18059f570]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x18059f570], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800efa30
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18059f558], eax
je 0x1800efa4b
mov eax, 0x10dd
jmp 0x1800efb70
mov rax, qword [0x18059f570]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800efaf5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800efac0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1800efac0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800ee430
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.1800f19a0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800efa57
mov qword [0x18059f570], 0
call fcn.1800eee90
mov rax, qword [0x18059f568]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800efb59
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.1800f19a0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1800efb11
mov qword [0x18059f568], 0
mov dword [0x18059f558], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800f00a0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18059f55c], 0
je 0x1800f00bd
mov eax, dword [0x18059f55c]
jmp 0x1800f0183
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x1800f00d0
xor eax, eax
jmp 0x1800f0183
mov ecx, 0x10
call fcn.1800f15d0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800f013e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x1800f0123
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.1800f19a0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18059f55c], eax
mov qword [0x18059f560], 0
mov eax, dword [rsp + 0x20]
jmp 0x1800f0183
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1800f0158
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800f00f9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x18059f568]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x18059f568], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x1800f27e0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800f2864
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800f6e30]
cmp byte [rcx + rax], 0
je 0x1800f2864
dec r8
sub rdx, 1
jne 0x1800f284a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x4175c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417766
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433b20
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41762b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417640
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417665
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417679
cmp rbx, 0x1000
jae 0x417635
nop dword [rax]
jmp 0x4176e9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41768d
xor edx, edx
jmp 0x4176e0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433b20
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41766f
jmp 0x417654
call fcn.00466860
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438260
lea rax, [0x006c4edf]
mov ebx, 0x18
call fcn.00438b60
mov rax, qword [rsp + 0x38]
call fcn.00438860
lea rax, [0x006c502f]
mov ebx, 0x19
call fcn.00438b60
mov rax, qword [rsp + 0x30]
nop
call fcn.00438860
call fcn.004384c0
call fcn.004382e0
lea rax, [0x006c9886]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004175c0
Function at 0x4177a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4179ca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433ba0
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417819
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41782c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417850
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417864
cmp rbx, 0x1000
jae 0x417823
jmp 0x4178e5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417876
xor esi, esi
jmp 0x4178d6
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433ba0
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41785a
nop
jmp 0x417842
call fcn.00466860
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417965
call fcn.00438260
lea rax, [0x006c5818]
mov ebx, 0x19
call fcn.00438b60
mov rax, qword [rsp + 0x68]
call fcn.00438860
lea rax, [0x006c502f]
mov ebx, 0x19
call fcn.00438b60
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438860
call fcn.004384c0
call fcn.004382e0
lea rax, [0x006bddda]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436920
cmp eax, 0x5af
je 0x417908
call fcn.00438260
lea rax, [0x006c5818]
mov ebx, 0x19
nop dword [rax]
call fcn.00438b60
mov rax, qword [rsp + 0x38]
call fcn.00438860
lea rax, [0x006c502f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438b60
mov eax, dword [rsp + 0x34]
call fcn.00438860
call fcn.004384c0
call fcn.004382e0
lea rax, [0x006c898b]
mov ebx, 0x1f
call fcn.00436920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004177a0