joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b3d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14007b3f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14007b3f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400b1ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14016f540
nop
test rbx, rbx
je 0x1400b1b26
add rbx, 0xc
mov rdx, rbx
jmp 0x1400b1b28
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140004f00
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140004f50
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1400b1ba5
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14016f580
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400dd9e0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.140004f00
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140004f50
test ebx, ebx
jne 0x1400dda54
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
jne 0x1400dda7b
lea rcx, [0x140281bc8]
call fcn.140003dd0
mov rbx, rax
mov rcx, rbx
call fcn.140101af0
mov rcx, rbx
call fcn.140004350
lea rcx, [0x140281380]
call fcn.140003dd0
mov rbx, rax
mov rcx, rbx
call fcn.1400fc080
mov rcx, rbx
call fcn.140004350
int3
Function at 0x1400de080
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov eax, dword [rbx + 0x38]
cmp eax, 0xffffffff
je 0x1400de09d
add rsp, 0x48
pop rbx
pop rbp
ret
mov dword [rsp + 0x20], 0x10
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 4
call fcn.1401972e0
mov ecx, eax
test ecx, ecx
jne 0x1400de12a
xor eax, eax
mov ecx, 0x40000000
test byte [rbp - 0x10], 0x30
cmove eax, ecx
mov ecx, eax
or ecx, 0x80000000
test byte [rbp - 0x10], 2
cmovne eax, ecx
mov ecx, eax
or ecx, 0x10000000
test dword [rbp - 0x10], 0x800
cmovne eax, ecx
mov ecx, eax
or ecx, 0x8000000
test byte [rbp - 0x10], 4
cmovne eax, ecx
mov ecx, eax
or ecx, 0x4000000
test dword [rbp - 0x10], 0x1000
cmovne eax, ecx
mov ecx, eax
or ecx, 0x20000000
test byte [rbp - 0x10], 8
cmovne eax, ecx
mov dword [rbx + 0x38], eax
add rsp, 0x48
pop rbx
pop rbp
ret
call fcn.140197190
mov ecx, eax
lea rdx, [0x140240ab0]
call fcn.140160c20
mov rcx, rax
call fcn.140004350
int3
Function at 0x1401103e0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rbx, rcx
lea rsi, [0x14026ffc0]
cmp qword [rsi - 8], 0
jne 0x14011060d
cmp byte [rsi], 0
jne 0x14011061b
movzx r8d, word [rbp + 0x20]
mov rcx, rbx
mov rdx, qword [rbp + 0x18]
call fcn.14010f040
mov esi, eax
test esi, esi
je 0x1401105e6
cmp byte [rbx + 0x90], 0
je 0x1401105e6
movzx eax, word [rbp + 0x20]
add eax, 0xfffffff3
cmp eax, 8
ja case.default.0x14011047a
lea rcx, [0x140373140]
mov ecx, dword [rcx + rax*4]
lea rdx, [0x140110417]
add rcx, rdx
jmp rcx
lea rcx, [rbp + 0x20]
lea rdx, [rbp + 0x18]
call fcn.140110a20
mov rcx, qword [rbp + 0x18]
movzx edx, word [rbp + 0x20]
mov qword [rbp + 0x10], rbx
lea r8, [rbx + 0x88]
mov qword [rbp - 0x40], r8
test rcx, rcx
je 0x1401105ff
add rcx, 0xc
mov qword [rbp - 0x48], rcx
xor r9d, r9d
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], r8
mov qword [rbp - 0x68], rcx
mov dword [rbp - 0x5c], edx
xor r8d, r8d
mov qword [rbp - 0x70], r8
mov r9d, 0x20000030
mov dword [rbp - 0x60], r9d
lea rcx, [rbp - 0x98]
call fcn.140004f00
mov rcx, qword [rbp - 0x68]
mov edx, dword [rbp - 0x5c]
mov r8, qword [rbp - 0x70]
mov r9d, dword [rbp - 0x60]
call sub.KERNEL32.dll_GetCalendarInfoEx
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140004f50
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
xor ecx, ecx
test ebx, ebx
setne cl
and esi, ecx
mov rcx, qword [rbp + 0x18]
xor r8d, r8d
mov dword [rbp - 0x50], r8d
test rcx, rcx
je 0x140110606
add rcx, 0xc
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x70], rcx
lea r8, [rbp - 0x50]
mov qword [rbp - 0x68], r8
mov edx, 0x20001009
mov dword [rbp - 0x60], edx
mov r9d, 4
mov dword [rbp - 0x5c], r9d
lea rcx, [rbp - 0x98]
call fcn.140004f00
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov edx, dword [rbp - 0x60]
mov r9d, dword [rbp - 0x5c]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x98]
call fcn.140004f50
xor ecx, ecx
mov qword [rbp - 0x58], rcx
movzx ecx, word [rbp - 0x50]
movzx edx, word [rbp + 0x20]
cmp ecx, edx
jne 0x1401105e6
mov rcx, qword [rbp + 0x18]
mov edx, 0x1f
call fcn.140119830
mov rcx, rax
call fcn.140119aa0
mov rbx, rax
mov rcx, qword [rbp + 0x18]
mov edx, 0x20
call fcn.140119830
mov rcx, rax
call fcn.140119aa0
mov rdi, rax
mov rdx, qword [rbp + 0x10]
add rdx, 0x10
mov rcx, rbx
call fcn.140110650
mov rbx, qword [rbp + 0x10]
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.140110650
mov ecx, esi
movzx eax, cl
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x1401104ad
xor ecx, ecx
jmp 0x140110534
call fcn.14000120a
cmp byte [rsi], 0
je 0x140110432
movzx r8d, word [rbp + 0x20]
mov rcx, rbx
mov rdx, qword [rbp + 0x18]
call fcn.140110750
mov ecx, eax
jmp 0x1401105e8
insb byte [rdi], dx
out 0xfb, eax
test eax, 0x406e01
add byte [rax], al
add byte [rax], al
in al, 0x9a
insd dword [rdi], dx
invalid
Function at 0x140110ae0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov r14d, edx
mov esi, r8d
mov edi, r9d
lea rcx, [0x1402a4af8]
call fcn.140003dd0
mov r15, rax
mov rcx, qword [0x14043b940]
mov rdx, qword [rcx + 8]
lea rcx, [r15 + 8]
call fcn.140003fe0
mov qword [rbp - 0x40], r15
test edi, edi
je 0x140110c2f
test edi, 0x80000000
jne 0x140110c2f
xor ecx, ecx
mov dword [rbp - 0x50], ecx
test rbx, rbx
je 0x140110b67
mov qword [rbp + 0x10], rbx
lea rcx, [rbx + 0xc]
jmp 0x140110b6d
xor ecx, ecx
mov qword [rbp + 0x10], rbx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x70], rcx
lea r8, [rbp - 0x50]
mov qword [rbp - 0x78], r8
mov edx, 0x20001009
mov dword [rbp - 0x64], edx
mov r9d, 4
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0xa8]
call fcn.140004f00
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
mov edx, dword [rbp - 0x64]
mov r9d, dword [rbp - 0x68]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0xa8]
call fcn.140004f50
xor ecx, ecx
mov qword [rbp - 0x58], rcx
movzx ecx, word [rbp - 0x50]
movzx edx, r14w
cmp ecx, edx
jne 0x140110c1d
mov rcx, qword [rbp + 0x10]
mov edx, edi
call fcn.140119830
test rax, rax
je 0x140110c17
mov qword [rbp - 0x48], rax
mov rcx, qword [rbp - 0x40]
inc dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov r8d, dword [rcx + 0x10]
mov r10d, dword [rdx + 8]
cmp r10d, r8d
jbe 0x140110c23
lea r10d, [r8 + 1]
mov dword [rcx + 0x10], r10d
mov ecx, r8d
lea rcx, [rdx + rcx*8 + 0x10]
mov rdx, rax
call fcn.140003fe0
mov rbx, qword [rbp + 0x10]
jmp 0x140110c2f
mov rbx, qword [rbp + 0x10]
jmp 0x140110c2f
mov rbx, qword [rbp + 0x10]
jmp 0x140110c2f
mov rdx, rax
call fcn.1401f76b0
mov rbx, qword [rbp + 0x10]
xor r9d, r9d
test rbx, rbx
je 0x140110c3d
add rbx, 0xc
jmp 0x140110c3f
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov rdx, rbx
mov dword [rsp + 0x20], esi
lea r8, [rbp - 0x48]
mov qword [rsp + 0x28], r8
mov qword [rbp - 0x78], rdx
movzx r8d, r14w
mov dword [rbp - 0x68], r8d
mov qword [rbp - 0x70], r9
lea rcx, [0x140110280]
mov qword [rbp - 0x80], rcx
lea rcx, [rbp - 0xa8]
call fcn.140004f00
mov rdx, qword [rbp - 0x78]
mov r8d, dword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
call sub.KERNEL32.dll_EnumCalendarInfoExEx
lea rcx, [rbp - 0xa8]
call fcn.140004f50
xor ecx, ecx
mov qword [rbp - 0x60], rcx
mov rcx, qword [rbp - 0x40]
cmp dword [rcx + 0x10], 0
jne 0x140110cb6
xor ecx, ecx
mov rbx, qword [rbp + 0x30]
mov qword [rbx], rcx
jmp 0x140110cf8
mov rbx, qword [rbp + 0x30]
mov rcx, qword [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401f7d30
mov rdi, rax
cmp esi, 0x39
je 0x140110cd2
cmp esi, 4
jne 0x140110ce8
mov r9d, dword [rdi + 8]
mov rdx, rdi
lea rcx, [0x14026d498]
xor r8d, r8d
call fcn.140235880
mov rcx, rbx
mov rdx, rdi
call fcn.140004050
mov ecx, 1
movzx eax, cl
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140110e60
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x58], rax
mov rax, qword [0x14043d380]
mov qword [rbp + 0x48], rax
mov rsi, rcx
mov edi, edx
mov rbx, r8
lea r14, [0x14026ffc0]
cmp qword [r14 - 8], 0
jne 0x140111092
cmp byte [r14], 0
je 0x140110ebd
movzx edx, dil
mov rcx, rsi
mov r8, rbx
call fcn.1401110c0
jmp 0x140111066
mov rcx, rsi
mov qword [rbp + 0xc0], rbx
mov rdx, rbx
call fcn.14010f360
mov r14d, eax
test dil, dil
je 0x140111063
xor ecx, ecx
mov dword [rbp + 0x60], ecx
test rsi, rsi
je 0x140110ef5
add rsi, 0xc
jmp 0x140110ef7
xor esi, esi
mov qword [rbp + 0x58], rsi
mov rcx, rsi
mov qword [rbp + 0x38], rcx
lea r8, [rbp + 0x60]
mov qword [rbp + 0x30], r8
mov edx, 0x20001009
mov dword [rbp + 0x44], edx
mov r9d, 4
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.140004f00
mov rcx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
mov edx, dword [rbp + 0x44]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp + 8]
call fcn.140004f50
xor eax, eax
mov qword [rbp + 0x58], rax
mov eax, dword [rbp + 0x60]
test eax, eax
je 0x140111063
movzx r8d, ax
mov rbx, qword [rbp + 0xc0]
mov edi, dword [rbx + 8]
test edi, edi
je 0x1401110a8
movzx eax, word [rbx + 0x10]
cmp r8d, eax
je 0x140111063
mov edx, 1
cmp edi, 1
jle 0x140110f92
mov ecx, edx
movzx ecx, word [rbx + rcx*2 + 0x10]
cmp ecx, r8d
je 0x140110fa2
inc edx
cmp edi, edx
jg 0x140110f80
lea ecx, [r14 + 1]
cmp edi, r14d
cmovle ecx, r14d
mov r14d, ecx
jmp 0x140110fb3
mov word [rbx + 0x10], r8w
mov edx, edx
mov word [rbx + rdx*2 + 0x10], ax
jmp 0x140111063
mov eax, r14d
mov ecx, 2
mul rcx
jb 0x14011108d
mov rsi, rax
test rsi, rsi
je 0x140111003
mov rcx, rsi
add rcx, 0xf
and rcx, 0xfffffffffffffff0
add rsp, 0x20
neg rcx
add rcx, rsp
jb 0x140110fe5
xor ecx, ecx
test dword [rsp], esp
sub rsp, 0x1000
cmp rsp, rcx
jae 0x140110fe5
mov rsp, rcx
test dword [rsp], esp
sub rsp, 0x20
lea rsi, [rsp + 0x20]
test r14d, r14d
jl 0x14011109c
mov ecx, r14d
test r14d, r14d
je 0x1401110a8
mov word [rsi], r8w
dec ecx
cmp edi, ecx
jb 0x14011109c
lea rdx, [rbx + 0x10]
cmp r14d, 1
jb 0x14011109c
lea r8, [rsi + 2]
lea eax, [r14 - 1]
mov qword [rbp + 0x50], r8
cmp ecx, eax
ja 0x1401110a2
lea r8, [rcx + rcx]
mov rcx, qword [rbp + 0x50]
call fcn.1400e1980
add rbx, 0x10
mov rcx, rbx
cmp r14d, edi
ja 0x1401110a2
mov r8d, r14d
add r8, r8
mov rdx, rsi
call fcn.1400e1980
mov eax, r14d
lea rcx, [0x14043d380]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x14011107b
call fcn.1400052d0
nop
lea rsp, [rbp + 0x68]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140192810
call fcn.14000120a
jmp 0x140110ea3
call fcn.140103f10
int3
call fcn.140103f40
int3
call fcn.140192840
int3
Function at 0x1401110c0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x20], r8
mov rsi, rcx
mov edi, edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea rcx, [0x1402b0668]
call fcn.140003dd0
mov r14, rax
mov rcx, qword [0x14043bac0]
mov rdx, qword [rcx + 8]
lea rcx, [r14 + 8]
call fcn.140003fe0
mov qword [rbp - 0x48], r14
test dil, dil
je 0x1401111e0
xor ecx, ecx
mov dword [rbp - 0x50], ecx
test rsi, rsi
je 0x140111140
mov qword [rbp + 0x10], rsi
lea rcx, [rsi + 0xc]
jmp 0x140111146
xor ecx, ecx
mov qword [rbp + 0x10], rsi
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x70], rcx
lea r8, [rbp - 0x50]
mov qword [rbp - 0x78], r8
mov edx, 0x20001009
mov dword [rbp - 0x64], edx
mov r9d, 4
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0xa8]
call fcn.140004f00
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
mov edx, dword [rbp - 0x64]
mov r9d, dword [rbp - 0x68]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0xa8]
call fcn.140004f50
xor ecx, ecx
mov qword [rbp - 0x58], rcx
mov edx, dword [rbp - 0x50]
test edx, edx
je 0x1401111d1
mov dword [rbp - 0x40], edx
mov rcx, qword [rbp - 0x48]
inc dword [rcx + 0x14]
mov rax, qword [rcx + 8]
mov r8d, dword [rcx + 0x10]
mov r10d, dword [rax + 8]
cmp r10d, r8d
jbe 0x1401111d7
lea r10d, [r8 + 1]
mov dword [rcx + 0x10], r10d
mov ecx, r8d
mov dword [rax + rcx*4 + 0x10], edx
mov rsi, qword [rbp + 0x10]
jmp 0x1401111e0
mov rsi, qword [rbp + 0x10]
jmp 0x1401111e0
call fcn.1401cf010
mov rsi, qword [rbp + 0x10]
xor r9d, r9d
test rsi, rsi
je 0x1401111ee
add rsi, 0xc
jmp 0x1401111f0
xor esi, esi
mov qword [rbp - 0x60], rsi
mov rdx, rsi
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x70], r9
lea rcx, [0x140110350]
mov qword [rbp - 0x80], rcx
mov r8d, 0xffffffff
mov dword [rbp - 0x68], r8d
lea rcx, [rbp - 0xa8]
call fcn.140004f00
mov rdx, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
mov r8d, dword [rbp - 0x68]
call sub.KERNEL32.dll_EnumCalendarInfoExEx
lea rcx, [rbp - 0xa8]
call fcn.140004f50
xor eax, eax
mov qword [rbp - 0x60], rax
mov rbx, qword [rbp + 0x20]
mov ecx, dword [rbx + 8]
jmp 0x140111288
mov rdx, qword [rbp - 0x48]
cmp eax, r8d
jae 0x1401112bb
mov r8, qword [rdx + 8]
cmp eax, dword [r8 + 8]
jae 0x1401112c1
mov edx, eax
movzx r8d, word [r8 + rdx*4 + 0x10]
cmp eax, ecx
jae 0x1401112c1
mov word [rbx + rdx*2 + 0x10], r8w
inc eax
mov edx, ecx
mov r8, qword [rbp - 0x48]
mov r8d, dword [r8 + 0x10]
mov r10d, r8d
cmp edx, r10d
jle 0x14011129c
jmp 0x14011129f
mov r10d, edx
cmp eax, r10d
jl 0x140111261
mov eax, r8d
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140103fd0
int3
call fcn.140192840
int3
Function at 0x140116bb0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
cmp dword [rbx + 0x198], 0xffffffff
jne 0x140116cc1
lea rsi, [0x140270368]
cmp qword [rsi - 8], 0
jne 0x140116cdf
cmp byte [rsi], 0
jne 0x140116cc1
lea rdi, [0x14026ffc0]
cmp qword [rdi - 8], 0
jne 0x140116ce9
cmp byte [rdi], 0
jne 0x140116cf7
movzx r14d, byte [rbx + 0x1b8]
mov qword [rbp + 0x10], rbx
mov rax, rbx
test r14d, r14d
je 0x140116d0d
mov rcx, qword [rax + 8]
cmp byte [rax + 0x1b8], 0
je 0x140116d26
xor edx, edx
or edx, 0x2000100c
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x140116cd8
add rcx, 0xc
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140004f00
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140004f50
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
inc eax
xor ecx, ecx
cmp eax, 6
cmovg eax, ecx
mov ecx, eax
mov rbx, qword [rbp + 0x10]
mov dword [rbx + 0x198], ecx
mov eax, dword [rbx + 0x198]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x140116c59
call fcn.14000146b
jmp 0x140116bf0
call fcn.14000120a
cmp byte [rdi], 0
je 0x140116c14
mov r14d, 1
mov rax, rbx
test r14d, r14d
mov qword [rbp + 0x10], rbx
jne 0x140116c2c
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
mov edx, 0x100c
call fcn.1401191d0
mov ecx, eax
mov qword [rbp + 0x10], rbx
jmp 0x140116cb7
mov edx, 0x80000000
jmp 0x140116c3f
Function at 0x140119830
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x14043d380]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rbx, [rsp + 0x20]
test rcx, rcx
je 0x1401198ef
add rcx, 0xc
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rbx
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.140004f00
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov esi, eax
lea rcx, [rbp + 8]
call fcn.140004f50
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test esi, esi
jle 0x1401198f6
mov rcx, rbx
call fcn.1400e6ce0
lea rcx, [0x14043d380]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1401198dd
call fcn.1400052d0
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x140119872
xor eax, eax
jmp 0x1401198c8

Function at 0x140119900
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x140119936
add rcx, 0xc
jmp 0x140119938
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140004f00
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140004f50
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401199a0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov r8d, edx
or r8d, 0x80000000
cmp byte [rcx + 0x1b8], 0
cmove edx, r8d
mov rcx, qword [rcx + 8]
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x140119a50
add rcx, 0xc
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140004f00
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140004f50
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x1401199ed
Function at 0x140119fd0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x14043d380]
mov qword [rbp + 0x48], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0xb0
lea rsi, [rsp + 0x20]
lea rdi, [0x14026ffc0]
cmp qword [rdi - 8], 0
jne 0x14011a20e
cmp byte [rdi], 0
jne 0x14011a0d0
mov rcx, rbx
call fcn.140118bd0
test eax, eax
je 0x14011a0cc
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14011a0c5
add rcx, 0xc
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov r8, rsi
mov qword [rbp + 0x30], r8
mov edx, 0x5c
mov dword [rbp + 0x44], edx
mov r9d, 0x55
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.140004f00
mov rcx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
mov edx, dword [rbp + 0x44]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov ebx, eax
lea rcx, [rbp + 8]
call fcn.140004f50
xor eax, eax
mov qword [rbp + 0x50], rax
test ebx, ebx
setne bl
movzx ebx, bl
movzx eax, bl
lea rcx, [0x14043d380]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x14011a0b3
call fcn.1400052d0
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x14011a044
xor ebx, ebx
jmp 0x14011a09b
mov rcx, qword [rbx + 8]
mov r8, rsi
mov edx, 0x5c
mov r9d, 0x55
call fcn.140192c50
mov r8d, eax
test r8d, r8d
je 0x14011a0cc
dec r8d
mov rcx, rsi
xor edx, edx
call fcn.1400e6d50
lea rcx, [rbx + 8]
mov rdx, rax
call fcn.140003fe0
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov r8, rsi
mov edx, 0x20000071
mov r9d, 2
call fcn.140192c50
test eax, eax
je 0x14011a0cc
cmp dword [rsi], 0
setne cl
mov byte [rbx + 0x1ba], cl
lea rcx, [rbx + 0x10]
mov rdx, rdi
call fcn.140003fe0
cmp byte [rbx + 0x1ba], 0
je 0x14011a18b
lea rcx, [rbx + 0x18]
mov rdx, rdi
call fcn.140003fe0
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x55
call fcn.140192d60
mov r8d, eax
test r8d, r8d
jle 0x14011a0cc
dec r8d
mov rcx, rsi
xor edx, edx
call fcn.1400e6d50
lea rcx, [rbx + 0x38]
mov rdx, rax
call fcn.140003fe0
jmp 0x14011a204
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.140003fe0
lea rcx, [rbx + 0x18]
mov rdx, rdi
call fcn.140003fe0
mov rcx, rdi
mov r8, rsi
mov edx, 0x20000001
mov r9d, 2
call fcn.140192c50
test eax, eax
je 0x14011a0cc
mov ecx, dword [rsi]
mov dword [rbx + 0x1b4], ecx
mov ecx, dword [rbx + 0x1b4]
call fcn.1401175d0
test eax, eax
jne 0x14011a204
mov rcx, rdi
mov edx, 0x5f
cmp dword [rcx], ecx
call fcn.1400ea690
test eax, eax
jle 0x14011a204
mov rcx, rdi
mov r8d, eax
xor edx, edx
call fcn.1400ea360
lea rcx, [rbx + 0x18]
mov rdx, rax
call fcn.140003fe0
mov ebx, 1
jmp 0x14011a09b
call fcn.14000120a
jmp 0x14011a01a