joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401927c0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rdx
mov r14, rcx
xor sil, sil
xor edi, edi
call fcn.140189bd0
test al, al
je 0x140192878
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.1401897e0
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x10]
movzx ecx, word [rcx + rdx]
call fcn.1400bf4f0
lea ecx, [rax - 0x41]
mov ebx, 1
shl ebx, cl
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax]
test ecx, ecx
je 0x140192851
cmp ecx, 0xffffffff
je 0x140192866
mov rax, qword [rsp + 0x68]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140192866
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400affb0
and ebx, edi
setne sil
neg ebx
sbb edi, edi
and edi, 0x14
jmp 0x140192964
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.140189eb0
nop
mov dword [rsp + 0x20], 7
lea rax, str._UNC
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.1400be7a0
test al, al
je 0x14019292c
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 0x10]
mov r9d, ebx
mov r8d, 7
movzx edx, word [rax + rdx]
lea rcx, [rsp + 0x68]
call fcn.1400ba9a0
mov r8d, eax
test eax, eax
jle 0x140192916
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 0x10]
inc r8d
mov r9d, ebx
movzx edx, word [rax + rdx]
lea rcx, [rsp + 0x68]
call fcn.1400ba9a0
test eax, eax
jle 0x140192916
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx + 4]
dec edx
cmp eax, edx
jne 0x14019292c
lea rcx, [rsp + 0x68]
call fcn.140192ba0
test al, al
je 0x14019292c
mov edi, select
movzx esi, bl
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax]
test ecx, ecx
je 0x14019294f
cmp ecx, 0xffffffff
je 0x140192964
mov rax, qword [rsp + 0x68]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140192964
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400affb0
test sil, sil
je 0x14019298e
mov dword [rbp + 0x10], edi
test dil, 0x10
mov ecx, 0x20000
mov eax, 0x40000
cmovne ecx, eax
or ecx, dword [rbp + 4]
bts ecx, 0x16
mov dword [rbp + 4], ecx
or dword [rbp], 0x560000
movzx eax, sil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401929b0
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r15, rdx
mov r13, rcx
xor edi, edi
mov dword [rbp + 0x50], edi
mov dword [rbp + 0x58], edi
mov dword [rbp - 0x2c], edi
mov dword [rbp - 0x30], edi
mov rbx, qword [rbp - 8]
mov rcx, r13
call fcn.1400c02d0
mov rcx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp - 0x10]
mov edx, 1
call sub.NETAPI32.dll_NetShareEnum
mov r12d, eax
test eax, eax
je 0x140192a30
cmp eax, 0xea
jne 0x140192b5d
mov rsi, qword [rbp - 0x10]
mov r14d, 1
cmp dword [rbp + 0x58], r14d
jb 0x140192b5d
lea r13, [0x140484d90]
nop dword [rax + rax]
test r15, r15
je 0x140192b48
cmp dword [rsi + 8], 0
jne 0x140192b48
mov r8d, 0xffffffff
mov rdx, qword [rsi]
lea rcx, [rbp - 0x18]
call fcn.1400ba830
nop
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
mov qword [rax], r13
or edi, 5
mov dword [rbp + 0x50], edi
test dil, 2
je 0x140192ac1
and edi, 0xfffffffd
mov dword [rbp + 0x50], edi
mov eax, dword [rbx]
test eax, eax
je 0x140192aab
cmp eax, 0xffffffff
je 0x140192abe
mov eax, 0xffffffff
lock xadd dword [rbx], eax
cmp eax, 1
jne 0x140192abe
mov edx, 2
mov r8d, 8
mov rcx, rbx
call fcn.1400affb0
mov edi, dword [rbp + 0x50]
test dil, 1
je 0x140192b03
and edi, 0xfffffffe
mov dword [rbp + 0x50], edi
mov rax, qword [rbp - 0x18]
mov ecx, dword [rax]
test ecx, ecx
je 0x140192aee
cmp ecx, 0xffffffff
je 0x140192b03
mov rax, qword [rbp - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140192b03
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.1400affb0
nop
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.1400018b0
nop
mov rax, qword [rbp - 0x20]
mov ecx, dword [rax]
test ecx, ecx
je 0x140192b31
cmp ecx, 0xffffffff
je 0x140192b45
mov rax, qword [rbp - 0x20]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140192b45
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x20]
call fcn.1400affb0
mov edi, dword [rbp + 0x50]
add rsi, 0x18
inc r14d
cmp r14d, dword [rbp + 0x58]
jbe 0x140192a50
mov r13, qword [rbp + 0x40]
mov rcx, qword [rbp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r12d, 0xea
je 0x1401929e4
test r12d, r12d
sete al
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140193780
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1401937ba
mov edi, dword [rsp + 0x40]
jmp 0x1401937cc
cmp byte [rbx + 0x6b], dil
jne 0x1401937cc
mov byte [rbx + 0x6b], 1
mov rcx, rbx
call fcn.1401d2120
mov eax, 0x1000
cmp edi, eax
cmovb edi, eax
cmp byte [rbx + 0x6b], 0
jne 0x1401938d0
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1401937fe
sub rax, qword [rbx + 0x50]
cmp rdi, rax
jle 0x1401937fe
mov rdi, rax
test rax, rax
jle 0x1401938d0
lea rcx, [rbx + 0x48]
mov rdx, rdi
call fcn.140119e00
mov word [rbx + 0x68], 0x100
lea r9, [rbx + 0x18]
xorps xmm0, xmm0
movups xmmword [r9], xmm0
movups xmmword [r9 + 0x10], xmm0
lea rcx, [0x140193630]
mov qword [rsp + 0x20], rcx
mov r8d, edi
mov rdx, rax
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x1401938d0
mov byte [rbx + 0x69], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, eax
sub ecx, 0x6d
je 0x1401938c4
cmp ecx, 0x7c
je 0x1401938c4
mov edx, 0x22
lea rcx, str.QWindowsPipeReader::startAsyncRead
call fcn.1400ba5a0
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x48]
mov edx, edi
mov rcx, rbx
call fcn.1401d22c0
nop
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax]
test ecx, ecx
je 0x1401938a4
cmp ecx, 0xffffffff
je 0x1401938d0
mov rax, qword [rsp + 0x48]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1401938d0
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x48]
call fcn.1400affb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov byte [rbx + 0x6b], 1
mov rcx, rbx
call fcn.1401d2120
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140193e40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x51], 0
mov rdi, rcx
jne 0x140193ec8
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
add rcx, 0x40
call fcn.1400b0570
mov rdx, qword [rdi + 0x40]
lea rax, [0x140193ef0]
mov rcx, qword [rdi + 0x10]
lea r9, [rdi + 0x18]
mov word [rdi + 0x50], 0x100
mov qword [rsp + 0x20], rax
mov r8d, dword [rdx + 4]
add rdx, qword [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rbx, qword [rsp + 0x40]
test eax, eax
jne 0x140193ed5
lea rcx, [rdi + 0x40]
mov byte [rdi + 0x51], al
call fcn.1400b0c40
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x140193ec8
lea rdx, str.QWindowsPipeWriter::write_failed.
mov ecx, eax
call fcn.1400ad750
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140195bc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0xa4], 1
je 0x14018b112
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140195bc0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x78]
test rcx, rcx
jne 0x140195cc2
cmp dword [rsi + 0xa0], 0xffffffff
jne 0x140195d64
cmp qword [rsi + 0x80], 0xffffffffffffffff
je 0x140195d5b
mov rdi, r8
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
nop dword [rax + rax]
mov r8d, 0x2000000
cmp rdi, r8
cmovl r8d, edi
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140195c67
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140195c5f
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140195c20
mov rax, rbx
jmp 0x140195d72
test rbx, rbx
jne 0x140195c5f
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140164c60
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.1401895e0
nop
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x140195cb8
cmp ecx, 0xffffffff
je 0x140195d5b
mov rax, qword [rsp + 0x30]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140195d5b
mov rcx, qword [rsp + 0x30]
jmp 0x140195d4b
call fcn.140243fb4
mov ecx, eax
call fcn.140243e3c
cmp rax, 0xffffffffffffffff
je 0x140195d64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
add eax, 0xfffffffe
cmp eax, 1
ja 0x140195d64
mov rcx, qword [rsi + 0x78]
call fcn.140241238
test eax, eax
je 0x140195d64
mov edx, 0xffffffff
lea rcx, [rsp + 0x88]
call fcn.140164df0
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.1401895e0
nop
mov rax, qword [rsp + 0x88]
mov ecx, dword [rax]
test ecx, ecx
je 0x140195d43
cmp ecx, 0xffffffff
je 0x140195d5b
mov rcx, qword [rsp + 0x88]
mov edx, 0xffffffff
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140195d5b
mov rcx, qword [rsp + 0x88]
mov r8d, 8
mov edx, 2
call fcn.1400affb0
mov rax, 0xffffffffffffffff
jmp 0x140195d72
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.14018b130
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140195f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x40], 0xfdffffff
cmp dword [rbx + 0xa4], 2
je 0x14018bca9
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140195f90
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp qword [rcx + 0x78], 0
jne 0x14019608d
cmp dword [rcx + 0xa0], 0xffffffff
jne 0x14019608d
cmp qword [rcx + 0x80], 0xffffffffffffffff
je 0x140196084
mov rdi, r8
xor r12d, r12d
mov ebx, r12d
mov r8d, 0x2000000
cmp rdi, r8
cmovl r8d, edi
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140196026
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140196021
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140195fe2
mov rax, rbx
jmp 0x140196092
test rbx, rbx
jne 0x140196021
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140164c60
nop
mov r8, rax
mov edx, 2
mov rcx, r15
call fcn.1401895e0
nop
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x14019606f
cmp ecx, 0xffffffff
je 0x140196084
mov rax, qword [rsp + 0x30]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140196084
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1400affb0
mov rax, 0xffffffffffffffff
jmp 0x140196092
call fcn.14018bcd0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140196310
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
mov rdi, qword [rax + 0x80]
cmp rdi, 0xffffffffffffffff
jne 0x14019649b
cmp dword [rax + 0xa0], edi
jne 0x14019646f
cmp qword [rax + 0x78], 0
jne 0x14019646f
lea rcx, [rax + 0x20]
mov rax, qword [rcx]
cmp dword [rax + 4], 0
jne 0x140196369
mov rax, qword [rcx + 8]
cmp dword [rax + 4], 0
je 0x1401964f2
lea rdx, [rsp + 0x60]
call fcn.1401897e0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400dc440
nop
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax]
mov edi, 0xffffffff
test ecx, ecx
je 0x1401963a6
cmp ecx, edi
je 0x1401963bb
mov rax, qword [rsp + 0x60]
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1401963bb
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x60]
call fcn.1400affb0
mov edx, 3
lea rcx, [rsp + 0x20]
call fcn.1400dc970
test al, al
je 0x140196456
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400dcd40
movzx esi, al
test al, al
jne 0x14019643b
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x20]
call fcn.1400d9af0
nop
mov r8, rax
mov edx, listen
mov rcx, rbx
call fcn.1401895e0
nop
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax]
test ecx, ecx
je 0x140196425
cmp ecx, 0xffffffff
je 0x14019643b
mov rax, qword [rsp + 0x68]
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14019643b
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400affb0
nop
lea rcx, [rsp + 0x20]
call fcn.1400dc610
movzx eax, sil
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x20]
call fcn.1400dc610
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp rdi, 0xffffffffffffffff
jne 0x14019649b
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x140196485
call fcn.140243fb4
jmp 0x14019648b
mov eax, dword [rax + 0xa0]
mov ecx, eax
call fcn.140243e3c
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401964f2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov rbp, rax
mov rax, qword [rbx]
mov rdx, rsi
mov rcx, rbx
call qword [rax + gethostname]
test al, al
je 0x1401964e6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1401964e6
mov rax, qword [rbx]
cmp rbp, rsi
cmovl rsi, rbp
mov rdx, rsi
mov rcx, rbx
call qword [rax + gethostname]
mov al, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, rbx
call qword [rax + gethostname]
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019c380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rax, qword [rdx]
sub rax, qword [rcx]
sar rax, 3
movsxd r13, eax
mov r14, r13
sar r14, 1
test r14, r14
jle 0x14019c4f8
lea r8, [r13 - 1]
mov r15, r8
sar r15, 1
lea rdx, [0x140484d90]
nop dword [rax]
nop dword [rax + rax]
dec r14
mov rax, qword [r12]
lea rcx, [rax + r14*8]
mov rax, qword [rcx]
mov qword [rsp + 0x68], rax
mov qword [rcx], rdx
mov rdi, qword [r12]
mov rbp, r14
mov rdx, r14
cmp r14, r15
jge 0x14019c440
nop word [rax + rax]
lea rbx, [rdx + rdx]
lea rcx, [rdi + 0x10]
lea rcx, [rcx + rbx*8]
lea rdx, [rcx - 8]
call fcn.1400b1f60
shr eax, 0x1f
mov edx, eax
xor rdx, 1
inc rdx
add rdx, rbx
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rdi + rdx*8]
mov qword [rdi + rbp*8], rax
mov qword [rdi + rdx*8], rcx
mov rbp, rdx
cmp rdx, r15
jl 0x14019c400
lea r8, [r13 - 1]
cmp rbp, r15
jne 0x14019c460
test r13b, 1
jne 0x14019c460
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rdi + r13*8 - 8]
mov qword [rdi + rbp*8], rax
mov qword [rdi + r13*8 - 8], rcx
mov rbp, r8
lea rsi, [rbp - 1]
sar rsi, 1
cmp r14, rbp
jge 0x14019c4a4
nop dword [rax]
lea rbx, [rdi + rsi*8]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1400b1f60
shr eax, 0x1f
test al, al
je 0x14019c4a4
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rbx]
mov qword [rdi + rbp*8], rax
mov qword [rbx], rcx
mov rbp, rsi
dec rsi
sar rsi, 1
cmp r14, rbp
jl 0x14019c470
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rsp + 0x68]
mov qword [rdi + rbp*8], rax
mov qword [rsp + 0x68], rcx
mov eax, dword [rcx]
test eax, eax
je 0x14019c4cf
cmp eax, 0xffffffff
je 0x14019c4e4
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14019c4e4
mov edx, 1
mov r8d, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400affb0
test r14, r14
lea r8, [r13 - 1]
lea rdx, [0x140484d90]
jg 0x14019c3d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019c8c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov r13, r8
mov rbp, rdx
mov rsi, rcx
mov r15, rdx
mov r10, rdx
lea rdi, [r8 - 1]
sar rdi, 1
cmp rdx, rdi
jge 0x14019c947
nop word [rax + rax]
lea rbx, [r10 + r10]
mov rcx, qword [rsi]
add rcx, 0x10
lea rcx, [rcx + rbx*8]
lea rdx, [rcx - 8]
call fcn.1400b1f60
shr eax, 0x1f
mov r10d, eax
xor r10, 1
inc r10
add r10, rbx
mov rax, qword [rsi]
lea r8, [rax + r10*8]
lea rcx, [rax + rbp*8]
mov rdx, qword [rcx]
mov rax, qword [r8]
mov qword [rcx], rax
mov qword [r8], rdx
mov rbp, r10
cmp r10, rdi
jl 0x14019c900
cmp r10, rdi
jne 0x14019c96f
test r13b, 1
jne 0x14019c96f
mov rax, qword [rsi]
lea r8, [rax + r13*8]
lea rcx, [rax + rbp*8]
mov rdx, qword [rcx]
mov rax, qword [r8 - 8]
mov qword [rcx], rax
mov qword [r8 - 8], rdx
lea rbp, [r13 - 1]
mov rdi, qword [rsi]
lea rsi, [rbp - 1]
sar rsi, 1
cmp r15, rbp
jge 0x14019c9b2
nop
lea rbx, [rdi + rsi*8]
mov rdx, r14
mov rcx, rbx
call fcn.1400b1f60
shr eax, 0x1f
test al, al
je 0x14019c9b2
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rbx]
mov qword [rdi + rbp*8], rax
mov qword [rbx], rcx
mov rbp, rsi
dec rsi
sar rsi, 1
cmp r15, rbp
jl 0x14019c980
mov rcx, qword [rdi + rbp*8]
mov rax, qword [r14]
mov qword [rdi + rbp*8], rax
mov qword [r14], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401a8db0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
lea r14, [0x140492180]
mov qword [rbp + 0x67], r14
mov eax, 0x40
test r9d, r9d
cmovne eax, r9d
mov dword [rbp - 0x45], eax
cmp eax, 0x40
jle 0x1401a8e1a
movsxd rcx, eax
add rcx, rcx
call fcn.14023c100
mov r8, rax
mov qword [rbp - 0x41], rax
test rax, rax
jne 0x1401a8e12
call fcn.1400ab7c0
mov r8, qword [rbp - 0x41]
mov eax, dword [rbp - 0x45]
mov dword [rbp - 0x49], eax
jmp 0x1401a8e29
lea r8, [rbp - 0x39]
mov qword [rbp - 0x41], r8
mov dword [rbp - 0x49], 0x40
mov r9d, eax
mov edx, ebx
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1401a8ee9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x50
jne 0x1401a8e98
test eax, eax
jne 0x1401a8e98
mov qword [rdi], r14
mov eax, dword [0x140492180]
inc eax
cmp eax, 1
jbe 0x1401a8e64
lock inc dword [0x140492180]
lea rax, [rbp - 0x39]
mov rcx, qword [rbp - 0x41]
cmp rcx, rax
je 0x1401a8e77
call fcn.14023c0f0
nop
mov eax, dword [0x140492180]
test eax, eax
je 0x1401a8f3c
cmp eax, 0xffffffff
je 0x1401a8f4f
mov ebx, 0xffffffff
jmp 0x1401a8f2f
cmp eax, 0x7a
je 0x1401a8ea9
lea rax, [0x140484d90]
mov qword [rdi], rax
jmp 0x1401a8e64
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, eax
test eax, eax
je 0x1401a8e9d
mov r8d, eax
cmp eax, dword [rbp - 0x49]
cmovl r8d, dword [rbp - 0x49]
lea rcx, [rbp - 0x49]
call fcn.140191170
mov r9d, dword [rbp - 0x45]
mov r8, qword [rbp - 0x41]
mov edx, ebx
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401a8e9d
mov rdx, qword [rbp - 0x41]
cmp ebx, 0x50
jne 0x1401a8efc
cmp word [rdx], 0
je 0x1401a8e4d
mov ebx, 0xffffffff
mov r8d, ebx
mov rcx, rdi
call fcn.14004c7e0
nop
lea rax, [rbp - 0x39]
mov rcx, qword [rbp - 0x41]
cmp rcx, rax
je 0x1401a8f20
call fcn.14023c0f0
nop
mov eax, dword [0x140492180]
test eax, eax
je 0x1401a8f3c
cmp eax, 0xffffffff
je 0x1401a8f4f
lock xadd dword [0x140492180], ebx
cmp ebx, 1
jne 0x1401a8f4f
mov r8d, 8
mov edx, 2
mov rcx, r14
call fcn.1400affb0
mov rax, rdi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1401ab150
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [rcx + 4]
mov rbx, rcx
test eax, eax
jne 0x1401ab1ea
mov ecx, dword [rcx]
lea r8, [rsp + 0x20]
mov r9d, 8
mov edx, 0x1014
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401ab1e2
movzx eax, word [rsp + 0x20]
cmp ax, 0x31
je 0x1401ab1e2
cmp ax, 0x30
jne 0x1401ab1a3
mov eax, 1
jmp 0x1401ab1e7
cmp ax, 0x32
jne 0x1401ab1b0
mov eax, 2
jmp 0x1401ab1e7
mov ecx, dword [rbx]
lea r8, [rsp + 0x30]
mov r9d, listen
mov edx, setsockopt
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401ab1e2
movzx eax, word [rsp + 0x20]
movzx ecx, word [rsp + 0x30]
add ecx, 2
cmp eax, ecx
mov eax, 2
je 0x1401ab1e7
mov eax, 3
mov dword [rbx + 4], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140229fa0
add rsp, 0x50
pop rbx
ret

Function at 0x1401ac4e0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, edx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
lea rbp, [0x140484d90]
mov qword [rcx], rbp
mov dword [rsp + 0x20], 1
mov r9d, 0xff
lea r8, [rsp + 0x40]
mov edx, 0x5a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401ac5bd
mov esi, 0xffffffff
mov r8d, esi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.1400ba830
nop
mov rbx, qword [rax]
mov qword [rax], rbp
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x1401ac57e
cmp ecx, esi
je 0x1401ac593
mov rax, qword [rsp + 0x28]
mov ecx, esi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1401ac593
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.1400affb0
mov rcx, qword [rdi]
mov qword [rdi], rbx
mov eax, dword [rcx]
test eax, eax
je 0x1401ac5ad
cmp eax, 0xffffffff
je 0x1401ac5bd
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x1401ac5bd
mov edx, 2
mov r8d, 8
call fcn.1400affb0
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401acdb0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x2c], 0
lea r14, [rcx + 8]
mov rax, qword [r14]
cmp dword [rax + 4], 0
jne 0x1401ace92
mov r9d, listen
lea r8, [rsp + 0x30]
mov edx, setsockopt
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401ace92
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400ba830
nop
mov rbx, qword [rax]
lea rcx, [0x140484d90]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
mov edi, 0xffffffff
test ecx, ecx
je 0x1401ace54
cmp ecx, edi
je 0x1401ace69
mov rax, qword [rsp + 0x20]
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1401ace69
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1400affb0
mov rcx, qword [r14]
mov qword [r14], rbx
mov eax, dword [rcx]
test eax, eax
je 0x1401ace82
cmp eax, edi
je 0x1401ace92
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x1401ace92
mov edx, 2
mov r8d, 8
call fcn.1400affb0
mov rdx, r14
mov rcx, rsi
call fcn.1400f1430
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret