joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141db52c0
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov r12, rcx
xor r13d, r13d
mov dword [rbp + 0x50], r13d
mov dword [rbp + 0x58], r13d
mov dword [rbp - 0x3c], r13d
mov dword [rbp - 0x40], r13d
mov rdi, qword [rbp + 0x50]
mov rcx, r12
call fcn.141d45210
mov rcx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp - 0x38]
mov edx, 1
call sub.NETAPI32.dll_NetShareEnum
mov r15d, eax
test eax, eax
je 0x141db5343
cmp eax, 0xea
jne 0x141db545a
mov rsi, qword [rbp - 0x38]
mov r14d, 1
cmp dword [rbp + 0x58], r14d
jb 0x141db545a
test rbx, rbx
je 0x141db5449
cmp dword [rsi + 8], 0
jne 0x141db5449
mov r8, 0xffffffffffffffff
mov rdx, qword [rsi]
lea rcx, [rbp - 0x18]
call fcn.141d3e900
nop
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x28], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov eax, dword [rbp + 0x50]
or eax, 5
mov dword [rbp + 0x50], eax
test al, 2
je 0x141db53cd
and dword [rbp + 0x50], 0xfffffffd
test rdi, rdi
je 0x141db53cd
mov eax, 0xffffffff
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x141db53cd
mov rcx, rdi
call fcn.141ec82c8
nop
mov eax, dword [rbp + 0x50]
test al, 1
je 0x141db53f9
and dword [rbp + 0x50], 0xfffffffe
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x141db53f9
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db53f9
mov rcx, qword [rbp - 0x18]
call fcn.141ec82c8
nop
lea r8, [rbp - 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.141d2de00
mov rax, qword [rbx]
test rax, rax
je 0x141db5418
mov eax, dword [rax]
cmp eax, 1
jle 0x141db5429
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.141d2d8a0
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x141db5449
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db5449
mov rcx, qword [rbp - 0x30]
call fcn.141ec82c8
add rsi, 0x18
inc r14d
cmp r14d, dword [rbp + 0x58]
jbe 0x141db5357
mov rcx, qword [rbp - 0x38]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r15d, 0xea
je 0x141db52f7
test r15d, r15d
sete al
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x141db6190
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
mov r9, rdx
test r8, r8
je 0x141db61ec
mov r9, qword [0x141f1e8d0]
mov rax, qword [0x141f20200]
bt rax, 8
jae 0x141db61ec
mov rax, qword [0x141f20200]
test al, 0x20
je 0x141db61ec
mov rax, qword [0x141f20200]
bt rax, 0x1c
jae 0x141db61e7
mov rax, qword [0x141f20200]
bt rax, 0x16
jb 0x141db5db0
jmp 0x141db5ca0
jmp 0x141db5b00
cmp rdx, 8
jbe 0x141db60e0
jmp 0x141db62b0
Function at 0x141db6270
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
test r8, r8
je 0x141db62a6
nop dword [rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
shl edx, 4
add edx, eax
mov eax, edx
shr edx, 0x17
and edx, 0x1e0
xor edx, eax
and edx, 0xfffffff
sub r8, 1
jne 0x141db6280
mov eax, edx
ret
Function at 0x141df53c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rax - 0x58], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rax - 0x58], 1
mov qword [rax + 0x18], r12
lea r9, [rax + 0x18]
xor r8d, r8d
mov edx, 0x4000
mov rcx, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x141df54a3
mov rsi, 0xffffffffffffffff
mov r8, rsi
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.141d3e900
nop
mov rbp, qword [rax]
mov r14, qword [rax + 8]
mov r15, qword [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov dword [rsp + 0x20], 9
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141df5474
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141df5474
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
mov rcx, qword [rbx]
mov qword [rbx], rbp
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r15
test rcx, rcx
je 0x141df5495
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x141df5495
call fcn.141ec82c8
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp qword [rbx + 0x10], 0
jne 0x141df551b
mov rax, qword [rdi]
cmp rax, qword [0x1400f0a00]
jne 0x141df54d5
mov rax, qword [rdi + 8]
cmp rax, qword [0x1400f0a08]
jne 0x141df54d5
mov qword [rsp + 0x30], 0x11
lea rax, [0x14007c418]
jmp 0x141df54fe
mov rax, qword [rdi]
cmp rax, qword [0x1400f0a20]
jne 0x141df551b
mov rax, qword [rdi + 8]
cmp rax, qword [0x1400f0a28]
jne 0x141df551b
mov qword [rsp + 0x30], 0xf
lea rax, [0x14007c430]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.141d38120
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x141dfcc10
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx ebp, dl
xor r13d, r13d
mov esi, ebp
mov dword [rsp + 0x40], 0x18
xor esi, 1
mov qword [rsp + 0x48], r13
shl esi, 0x14
mov r15d, ebp
shl r15d, 0x14
mov r14, rcx
mov dword [rsp + 0x50], r8d
mov edi, 0x3e8
call fcn.141e29d00
xor edx, edx
mov r8d, 1
mov rcx, rax
call fcn.141e29b30
mov rbx, rax
call fcn.141d71d50
mov r9d, eax
mov dword [rsp + 0x20], ebx
lea r8, [0x14007cae8]
mov edx, 0x100
lea rcx, [rsp + 0x80]
call fcn.141dfde60
lea rax, [rsp + 0x40]
mov r9d, 1
mov qword [rsp + 0x38], rax
lea edx, [rbp + 0x40000001]
mov dword [rsp + 0x30], r13d
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x28], esi
mov r8d, 8
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x141dfcd11
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x141dfccfc
add edi, 0xffffffff
jne 0x141dfcc68
lea rdx, [0x14007cb10]
mov ecx, eax
call fcn.141d47a40
xor al, al
jmp 0x141dfce28
mov edx, 0x40000000
mov qword [rsp + 0x30], r13
mov eax, 0x80000100
mov dword [rsp + 0x28], 0x40000000
test bpl, bpl
mov dword [rsp + 0x50], 1
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 3
cmovne edx, eax
lea rcx, [rsp + 0x80]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x141dfcd79
lea rcx, [0x14007cb38]
call fcn.141d47cf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x141dfce28
xorps xmm0, xmm0
mov qword [rsp + 0x58], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x141dfce04
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x141dfce04
cmp eax, 0x3e5
je 0x141dfcdf4
lea rdx, [0x14007cb58]
mov ecx, eax
call fcn.141d47a40
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x141dfce28
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bpl, bpl
je 0x141dfce19
mov rax, rbx
jmp 0x141dfce1f
mov rax, rdi
mov rdi, rbx
mov qword [r14], rdi
mov qword [r14 + 8], rax
mov al, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.141ec2250
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x141dfd5e0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x2f8]
mov rbx, rcx
test rax, rax
je 0x141dfd626
mov edx, dword [rax + 0x10]
lea rcx, [0x141dfce60]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbx + 0x2f8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov ecx, dword [rcx + 0x14]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostThreadMessageW]
add rsp, 0x20
pop rbx
ret
Function at 0x141e031b0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov rbx, qword [rcx + 8]
lea rsi, [rbx + 0x78]
xor bpl, bpl
mov r12d, 1
test rsi, rsi
je 0x141e031fa
mov rax, qword [rsi]
test rax, rax
jne 0x141e031ee
lock cmpxchg qword [rsi], r12
je 0x141e031f6
mov rcx, rsi
call fcn.141d8d680
movzx ebp, r12b
xor r15d, r15d
cmp byte [rbx + 0x84], r15b
je 0x141e032fe
cmp byte [rbx + 0xa8], r15b
jne 0x141e0321f
mov byte [rbx + 0xa9], r12b
jmp 0x141e032fe
xor edx, edx
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
mov rdi, qword [r14 + 8]
mov byte [rdi + 0x86], 1
mov dword [rdi + 0x94], 7
mov rbx, qword [rdi + 0xb0]
movzx edx, byte [rsp + 0x50]
mov rcx, r14
call fcn.141d99120
mov r8, qword [rdi + 0xb0]
mov edx, 0x34
xor ecx, ecx
call fcn.141d75d60
lea rcx, [rbx + 0x78]
call fcn.141e01b70
mov rax, qword [rdi + 0xb0]
mov rbx, qword [rax + 0x70]
test rbx, rbx
je 0x141e032c1
mov qword [rsp + 0x50], r15
mov rdx, qword [rdi + 0xb0]
mov rax, qword [rsp + 0x50]
nop
nop
mov qword [rdx + 0x70], rax
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb0]
call qword [case.0x141d6f3c0.0]
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x141d6f3c0.0]
mov word [rdi + 0x84], 0x100
mov byte [rdi + 0x86], 0
mov eax, r15d
xchg byte [rdi + 0x87], al
cmp dword [rdi + 0xa4], 0
jne 0x141e032f7
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x98], r15
mov dword [rdi + 0xa0], r15d
test bpl, bpl
je 0x141e03315
mov rax, r12
lock cmpxchg qword [rsi], r15
je 0x141e03315
mov rcx, rsi
call fcn.141d8dc50
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x141e15960
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rdx
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x20], r14
lea rax, [0x140089028]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rbp - 0x80], 0x40
lea rax, [rbp - 0x68]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x78], 0x40
mov r9d, 0x40
lea r8, [rbp - 0x68]
mov edx, ebx
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x141e15a8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x50
jne 0x141e15a2f
test eax, eax
jne 0x141e15a2f
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.141dda060
nop
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
cmp rcx, rax
je 0x141e15a15
call fcn.141ec82c8
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x141e15b54
mov rbx, 0xffffffffffffffff
jmp 0x141e15b41
cmp eax, 0x7a
je 0x141e15a55
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov rax, qword [rdi + 0x18]
and rax, 0xfffffffffffffffe
or rax, 2
and eax, 3
mov qword [rdi + 0x18], rax
jmp 0x141e15a02
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x141e15a34
movsxd rdx, eax
lea rcx, [rbp - 0x80]
call fcn.141db4680
mov r9d, dword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
mov edx, ebx
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x141e15a34
mov rdx, qword [rbp - 0x70]
cmp ebx, 0x50
jne 0x141e15a9e
cmp word [rdx], 0
je 0x141e159f4
mov rbx, 0xffffffffffffffff
mov r8, rbx
lea rcx, [rsp + 0x60]
call fcn.141d3e900
nop
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x141e15af7
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e15af7
mov rcx, qword [rsp + 0x60]
call fcn.141ec82c8
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.141dda060
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x141e15b24
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e15b24
mov rcx, qword [rsp + 0x40]
call fcn.141ec82c8
nop
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
cmp rcx, rax
je 0x141e15b37
call fcn.141ec82c8
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x141e15b54
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x141e15b54
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
mov rax, rdi
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.141ec2250
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x141e15f30
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov eax, r9d
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
xor r14d, r14d
mov dword [rsp + 0x48], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov ecx, 0x7d1
mov word [rsp + 0x50], cx
mov word [rsp + 0x52], r8w
mov ecx, 0xa
mov word [rsp + 0x56], cx
lea rcx, [0x1400890f0]
lea r9, [0x140089100]
test eax, eax
cmove r9, rcx
mov dword [rsp + 0x28], 0xff
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
cmp eax, 2
jle 0x141e1615f
mov rsi, 0xffffffffffffffff
mov r8, rsi
lea rdx, [rbp - 0x6c]
lea rcx, [rsp + 0x60]
call fcn.141d3e900
nop
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x141e1602a
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e1602a
mov rcx, qword [rsp + 0x60]
call fcn.141ec82c8
nop
mov eax, dword [rbx + 4]
test eax, eax
jne 0x141e160c8
mov r9d, 8
lea r8, [rsp + 0x78]
mov edx, 0x1014
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x141e1605d
mov dword [rbx + 4], 3
jmp 0x141e16132
movzx eax, word [rsp + 0x78]
cmp ax, 0x31
je 0x141e160c0
cmp ax, 0x30
jne 0x141e16075
mov eax, 1
jmp 0x141e160c5
cmp ax, 0x32
jne 0x141e16082
mov eax, 2
jmp 0x141e160c5
mov r9d, 0xb
lea r8, [rsp + 0x60]
mov edx, 0x13
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x141e160aa
mov dword [rbx + 4], 3
jmp 0x141e16132
movzx ecx, word [rsp + 0x60]
add ecx, 2
movzx eax, word [rsp + 0x78]
cmp eax, ecx
mov eax, 2
je 0x141e160c5
mov eax, 3
mov dword [rbx + 4], eax
cmp eax, 2
jne 0x141e16132
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.141e16db0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov qword [rax + 8], rdx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rax + 0x10], rdx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x141e16132
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e16132
mov rcx, qword [rsp + 0x60]
call fcn.141ec82c8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.141dda060
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x141e1617e
lock xadd dword [rax], esi
cmp esi, 1
jne 0x141e1617e
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
jmp 0x141e1617e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov rax, qword [rdi + 0x18]
and rax, 0xfffffffffffffffe
or rax, 2
and eax, 3
mov qword [rdi + 0x18], rax
mov rax, rdi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.141ec2250
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x141e19290
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov eax, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov dword [rsp + 0x20], 1
mov r9d, 0xff
lea r8, [rsp + 0x50]
mov edx, 0x5a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x141e19366
mov rdi, 0xffffffffffffffff
mov r8, rdi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.141d3e900
nop
mov rsi, qword [rax]
mov rbp, qword [rax + 8]
mov r14, qword [rax + 0x10]
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141e19345
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e19345
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
mov rcx, qword [rbx]
mov qword [rbx], rsi
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], r14
test rcx, rcx
je 0x141e19366
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x141e19366
call fcn.141ec82c8
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.141ec2250
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x141e1a200
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
cmp qword [rcx + 0x18], rsi
jne 0x141e1a2c9
mov r9d, 0xb
lea r8, [rsp + 0x48]
mov edx, 0x13
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x141e1a2c9
mov r8d, 1
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.141d3e900
nop
mov rbp, qword [rax]
mov r14, qword [rax + 8]
mov r15, qword [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141e1a2a6
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e1a2a6
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r15
test rcx, rcx
je 0x141e1a2c9
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x141e1a2c9
call fcn.141ec82c8
lea rdx, [rbx + 8]
mov rcx, rdi
call fcn.141dda060
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.141ec2250
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x141e299a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x141e29a01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x141e299c0
mov ecx, dword [r9]
jmp 0x141e29aeb
cmp ecx, 0x4e0
jb 0x141e29aeb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x141e29a20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x141e29a70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x141e29c40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
sub rdi, rdx
sar rdi, 2
xor ebp, ebp
mov esi, ebp
mov rax, qword [0x141f20200]
bt rax, 0xb
jae 0x141e29c7f
mov rdx, rdi
mov rcx, r14
call fcn.141e2a420
mov rsi, rax
cmp rsi, rdi
je 0x141e29ce9
mov rbx, rdi
sub rbx, rsi
shl rbx, 2
lea rcx, [r14 + rsi*4]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
cmovne rbp, rbx
mov rax, rbp
cqo
and edx, 3
add rax, rdx
sar rax, 2
add rsi, rax
cmp rsi, rdi
je 0x141e29ce9
lea rbx, [r14 + rsi*4]
sub rdi, rsi
lea rdi, [rbx + rdi*4]
cmp rbx, rdi
je 0x141e29ce9
nop word [rax + rax]
lea rcx, [rsp + 0x48]
call fcn.141ed4b3c
mov eax, dword [rsp + 0x48]
mov dword [rbx], eax
add rbx, 4
cmp rbx, rdi
jne 0x141e29cd0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x141e29d90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov ebx, 0x10
nop dword [rax]
nop word [rax + rax]
mov edx, 0x10
lea rcx, [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
nop
test al, al
jne 0x141e29e05
sub ebx, 1
jne 0x141e29dc0
lea rbx, [rsp + 0x38]
nop
lea rcx, [rsp + 0x20]
call fcn.141ed4b3c
mov eax, dword [rsp + 0x20]
mov dword [rbx], eax
add rbx, 4
lea rax, [rsp + 0x48]
cmp rbx, rax
jne 0x141e29de0
movups xmm0, xmmword [rsp + 0x38]
jmp 0x141e29e0a
movups xmm0, xmmword [rsp + 0x28]
mov rax, rdi
movups xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.141ec2250
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x141e29e30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x9f0
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rsp + 0x9e0], rax
mov dword [rcx + 0x1388], 0xffffffff
mov edx, 1
mov dword [rcx], edx
mov r8d, 0x1571
mov dword [rcx + 8], r8d
mov rbx, rcx
add rcx, 0xc
nop dword [rax]
mov eax, r8d
lea rcx, [rcx + 4]
shr eax, 0x1e
xor eax, r8d
imul r8d, eax, 0x6c078965
add r8d, edx
inc rdx
mov dword [rcx - 4], r8d
cmp rdx, 0x270
jb 0x141e29e70
lea r8, [rsp + 0x9e0]
mov dword [rbx + 4], 0x270
lea rdx, [rsp + 0x20]
lea rcx, [0x141f1ee0c]
call fcn.141e29c40
xor r8d, r8d
mov edx, r8d
nop dword [rax]
mov ecx, dword [rsp + rdx*4 + 0x20]
mov eax, ecx
or eax, r8d
mov dword [rbx + rdx*4 + 8], ecx
shr ecx, 0x1f
test rdx, rdx
cmovne ecx, eax
inc rdx
mov r8d, ecx
cmp rdx, 0x270
jb 0x141e29ec0
test ecx, ecx
jne 0x141e29ef0
mov dword [rbx + 8], 0x80000000
mov dword [rbx + 4], 0x270
mov rcx, qword [rsp + 0x9e0]
xor rcx, rsp
call fcn.141ec2250
add rsp, 0x9f0
pop rbx
ret