joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140120d30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm2, xmmword [rcx]
vmovdqu xmm0, xmmword [rcx + 0x10]
mov rax, qword [rsp + 0x28]
vperm2i128 ymm1, ymm2, ymm2, 0
vpslldq xmm5, xmm2, 4
vaeskeygenassist xmm4, xmm0, 1
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rdx], ymm1
vperm2i128 ymm1, ymm0, ymm0, 0
vmovdqu ymmword [r8], ymm1
vpslldq xmm1, xmm5, 4
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpxor xmm1, xmm1, xmm2
vpslldq xmm5, xmm0, 4
vpxor xmm2, xmm3, xmm4
vpxor xmm1, xmm1, xmm2
vpslldq xmm2, xmm5, 4
vaeskeygenassist xmm4, xmm1, 0
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm1, 4
vpxor xmm2, xmm2, xmm0
vpxor xmm0, xmm3, xmm4
vpxor xmm2, xmm2, xmm0
vperm2i128 ymm0, ymm1, ymm1, 0
vmovdqu ymmword [r9], ymm0
vperm2i128 ymm0, ymm2, ymm2, 0
vaeskeygenassist xmm4, xmm2, 2
vmovdqu ymmword [rax], ymm0
vpslldq xmm0, xmm5, 4
vpshufd xmm4, xmm4, 0xff
mov rax, qword [rsp + 0x30]
vpslldq xmm3, xmm0, 4
vpxor xmm0, xmm0, xmm5
vpxor xmm0, xmm0, xmm1
vpslldq xmm5, xmm2, 4
vpxor xmm1, xmm3, xmm4
vpxor xmm0, xmm0, xmm1
vpslldq xmm1, xmm5, 4
vaeskeygenassist xmm4, xmm0, 0
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm0, 4
vpxor xmm1, xmm1, xmm2
vpxor xmm2, xmm3, xmm4
vpxor xmm1, xmm1, xmm2
vperm2i128 ymm2, ymm0, ymm0, 0
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x38]
vperm2i128 ymm2, ymm1, ymm1, 0
vaeskeygenassist xmm4, xmm1, 4
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rax], ymm2
vpslldq xmm2, xmm5, 4
mov rax, qword [rsp + 0x40]
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpxor xmm2, xmm2, xmm0
vpslldq xmm5, xmm1, 4
vpxor xmm0, xmm3, xmm4
vpxor xmm2, xmm2, xmm0
vpslldq xmm0, xmm5, 4
vaeskeygenassist xmm4, xmm2, 0
vpslldq xmm3, xmm0, 4
vpxor xmm0, xmm0, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm2, 4
vpxor xmm0, xmm0, xmm1
vpxor xmm1, xmm3, xmm4
vpxor xmm0, xmm0, xmm1
vperm2i128 ymm1, ymm2, ymm2, 0
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vperm2i128 ymm1, ymm0, ymm0, 0
vaeskeygenassist xmm4, xmm0, 8
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rax], ymm1
vpslldq xmm1, xmm5, 4
mov rax, qword [rsp + 0x50]
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpxor xmm1, xmm1, xmm2
vpslldq xmm5, xmm0, 4
vpxor xmm2, xmm3, xmm4
vpxor xmm1, xmm1, xmm2
vpslldq xmm2, xmm5, 4
vaeskeygenassist xmm4, xmm1, 0
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpshufd xmm4, xmm4, 0xaa
vinserti128 ymm1, ymm1, xmm1, 1
vpxor xmm0, xmm2, xmm0
vmovdqu ymmword [rax], ymm1
vpxor xmm1, xmm3, xmm4
mov rax, qword [rsp + 0x58]
vpxor xmm0, xmm0, xmm1
vinserti128 ymm0, ymm0, xmm0, 1
vmovdqu ymmword [rax], ymm0
vzeroupper
ret
Function at 0x140123dd0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x40
mov r8, rcx
test rcx, rcx
je 0x140123ecc
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140123eb3
mov eax, 0x101
lea rdi, [rcx + 0x48]
mov byte [rsp], dl
movabs r9, 0x3c6ef372fe94f82b
mov word [rsp + 2], ax
and rdi, 0xfffffffffffffff8
mov eax, ecx
movabs r10, 0xa54ff53a5f1d36f1
sub eax, edi
mov byte [rsp + 1], 0
movdqu xmm0, xmmword [0x140460e40]
mov dword [rsp + 4], 0
mov qword [rsp + 8], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
lea ecx, [rax + 0xf0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov qword [r8 + 0x10], r9
xor eax, eax
movabs r9, 0x510e527fade682d1
mov qword [r8 + 0x18], r10
movabs r10, 0x9b05688c2b3e6c1f
mov qword [r8 + 0x20], r9
pxor xmm0, xmmword [rsp]
movabs r9, 0x1f83d9abfb41bd6b
mov qword [r8 + 0x28], r10
movabs r10, 0x5be0cd19137e2179
mov qword [r8 + 0x30], r9
mov qword [r8 + 0x38], r10
mov dword [r8 + 0xe4], edx
movups xmmword [r8], xmm0
add rsp, 0x40
pop rdi
ret
cmp byte [rcx + 0xe8], 0
je 0x140123ec4
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [r8 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x140123ead
Function at 0x140125b00
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r12, rdx
lea rax, [r8 + 1]
mov rsi, rcx
mov rbx, r8
movabs rdx, 0x5851f42d4c957f2d
lea r13, [rcx + 0x20]
lea rdi, [rsp + 0x20]
imul rax, rdx
lea rbp, [rcx + 0xc3e0]
movabs rdx, 0x810a978a59f5a1fc
xor rdx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa77099df38c2d846
xor rdx, rax
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8126b91cbf22495c
xor rdx, rax
mov qword [rsp + 0x38], rdx
movabs rdx, 0x494d2597179f8a62
xor rdx, rax
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9237efb9ceaaec0c
xor rdx, rax
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2f2a56746ce62d78
xor rdx, rax
mov qword [rsp + 0x50], rdx
movabs rdx, 0x84853bf7b62ce54e
xor rax, rdx
mov qword [rsp + 0x58], rax
nop word [rax + rax]
and ebx, 0x3fffff
mov rdx, r13
mov rcx, rdi
add r13, 0x1878
shl rbx, 6
add rbx, qword [rsi]
prefetchnta byte [rbx]
call fcn.14012ac90
mov rax, qword [rbx]
xor qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x58], rax
movsxd rax, dword [r13 - 0x64]
mov rbx, qword [rsp + rax*8 + 0x20]
cmp rbp, r13
jne 0x140125bc0
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmm1, xmmword [rsp + 0x30]
movdqu xmm2, xmmword [rsp + 0x40]
movdqu xmm3, xmmword [rsp + 0x50]
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12 + 0x20], xmm2
movups xmmword [r12 + 0x30], xmm3
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140146600
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov r13, rdx
mov rbp, r8
call sub.msvcrt.dll_wcslen
mov rdi, rax
mov rbx, rax
jmp 0x140146640
lea rsi, [rbx - 1]
movzx eax, word [r12 + rsi*2]
cmp ax, 0x2f
je 0x1401466b0
cmp ax, 0x5c
je 0x1401466b0
mov rbx, rsi
test rbx, rbx
jne 0x140146628
test r13, r13
je 0x140146689
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call rbx
mov r14d, eax
test eax, eax
je 0x14014672e
mov ecx, eax
add rcx, rcx
call fcn.1401419c0
mov qword [r13], rax
mov rdx, rax
test rax, rax
je 0x14014674d
mov ecx, r14d
call rbx
test eax, eax
je 0x140146735
mov rcx, r12
call sub.msvcrt.dll__wcsdup
mov qword [rbp], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test rsi, rsi
je 0x140146645
test r13, r13
je 0x1401466ea
lea r14, [rbx + rbx + 2]
mov rcx, r14
call fcn.1401419c0
mov qword [r13], rax
mov rcx, rax
test rax, rax
je 0x14014674d
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_wcsncpy
mov rax, qword [r13]
xor ecx, ecx
mov word [rax + r14 - 2], cx
sub rdi, rsi
lea rsi, [rdi + rdi]
mov rcx, rsi
call fcn.1401419c0
mov qword [rbp], rax
mov rcx, rax
test rax, rax
je 0x14014674d
lea rdx, [r12 + rbx*2]
lea r8, [rdi - 1]
call sub.msvcrt.dll_wcsncpy
mov rax, qword [rbp]
xor edx, edx
mov word [rax + rsi - 2], dx
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 0xffffffff
jmp 0x14014671f
mov rcx, qword [r13]
call fcn.1401419e0
mov qword [r13], 0
mov eax, 0xffffffff
jmp 0x14014671f
lea rdx, [0x1404716e0]
mov ecx, 0xe
call fcn.140146180
nop
nop
Function at 0x140148110
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x1407b2aa0]
mov dword [0x140529a80], eax
call fcn.14015d700
test eax, eax
jne 0x140148170
lea rax, [0x14052aaa0]
lea rdx, [0x140529aa0]
lea rcx, [rax + 0x288000]
nop
mov qword [rdx + 8], rax
add rax, 0x2880
add rdx, 0x10
mov qword [rdx - 0x10], 0
cmp rax, rcx
jne 0x140148150
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.140146180
nop
nop
Function at 0x1401500a0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x40]
mov rbx, rcx
mov qword [rcx + 0x48], 0
mov rcx, qword [rcx + 0x38]
lea r9, [rbx + 0x48]
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
cmp eax, 0x273f
je 0x140150190
jle 0x140150100
cmp eax, 0x2afa
je 0x140150170
jle 0x140150120
cmp eax, 0x2afb
jne 0x140150180
mov eax, 0xfffff444
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x2726
je 0x140150160
jle 0x140150140
cmp eax, 0x273c
jne 0x140150180
mov eax, 0xfffff43d
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x277d
je 0x140150150
cmp eax, 0x2af9
jne 0x140150180
mov eax, 0xfffff440
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
test eax, eax
je 0x1401500f0
cmp eax, 8
jne 0x140150180
mov eax, 0xfffff442
jmp 0x1401500f0
mov eax, 0xfffff43e
jmp 0x1401500f0
mov eax, 0xfffff446
jmp 0x1401500f0
mov eax, 0xfffff447
jmp 0x1401500f0
mov ecx, eax
call fcn.140146240
jmp 0x1401500f0
mov eax, 0xfffff443
jmp 0x1401500f0

Function at 0x1401513a0
Capabilities:
Create pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp qword [r8 + 0x70], 0xffffffffffffffff
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
mov edi, r9d
je 0x1401513d5
mov r8d, 0x14c
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle__INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
cmp edi, 1
mov rcx, qword [rsi + 0x120]
mov qword [rsp + 0x38], 0
mov r9d, 0xff
sbb edx, edx
mov dword [rsp + 0x30], 0
xor r8d, r8d
and edx, 0xfff80000
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
add edx, 0x400c0003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140151460
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x14015146b
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x118], rax
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateIoCompletionPort
mov ecx, eax
call fcn.140146180
nop
Function at 0x140151690
Capabilities:
Connect pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rdi, rdx
mov rbx, r8
mov esi, r9d
test byte [rdx + 0x58], 0x40
je 0x140151700
test esi, esi
je 0x14015171e
cmp qword [rbx + 0x70], 0xffffffffffffffff
je 0x1401517b8
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140151760
add dword [rdi + 0x78], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x34c
lea rdx, str.src_win_pipe.c
lea rcx, [0x140471e78]
call qword [sym.imp.msvcrt.dll__assert]
test esi, esi
jne 0x1401516ae
xor r9d, r9d
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.1401513a0
test eax, eax
jne 0x1401516ae
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
test eax, eax
jle 0x14015180c
call rsi
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
jmp 0x140151785
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
je 0x1401516eb
call rsi
cmp eax, 0x217
jne 0x1401517f0
mov qword [rbx + 0x40], 0
mov rax, qword [rbp + 0x48]
mov qword [rbx + 0x68], 0
test rax, rax
je 0x1401517e0
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0x68], rdx
mov qword [rax + 0x68], rbx
mov qword [rbp + 0x48], rbx
add dword [rdi + 0x78], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x355
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1401516b9
mov qword [rbx + 0x68], rbx
mov qword [rbp + 0x48], rbx
jmp 0x1401516eb
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call rsi
test eax, eax
jg 0x140151748
call rsi
cdqe
jmp 0x140151754

Function at 0x140151e70
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
mov rbp, rcx
mov rdi, rdx
lea r13, [rsp + 0x4c]
mov esi, r8d
nop dword [rax + rax]
mov edx, ebx
mov r8d, esi
mov r9, r13
mov rcx, rbp
mov qword [rsp + 0x20], 0
add rdx, rdi
sub r8d, ebx
call r12
test eax, eax
je 0x140151f10
add ebx, dword [rsp + 0x4c]
cmp esi, ebx
ja 0x140151e98
mov eax, 0
jne 0x140151ed8
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x686
lea rdx, str.src_win_pipe.c
lea rcx, str.bytes_read__count
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140152610
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rdx + 0x58]
mov rsi, rcx
mov rbx, rdx
test ah, 0x10
je 0x1401527e8
test eax, 0x10000
jne 0x140152810
cmp qword [rbx + 0x118], 0xffffffffffffffff
je 0x140152838
mov eax, dword [rbx + 0x58]
lea rdi, [rbx + 0x80]
test eax, 0x1000000
je 0x1401526c0
mov r8d, 0x10
mov rdx, rdi
mov qword [rbx + 0x238], 0
lea rcx, [0x140151820]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x140152790
mov eax, dword [rbx + 0x58]
test al, 0x80
je 0x140152860
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x1401526a9
xor r9d, r9d
mov r8d, 0x32
lea rdx, [0x1401528f0]
call fcn.1401412a0
or dword [rbx + 0x58], 0x10000
add dword [rbx + 0x78], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rbx + 0xc0]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xc8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
test eax, 0x80000
je 0x14015270f
mov rax, qword [rbx + 0xf0]
test rax, rax
je 0x1401528c0
or rax, 1
mov qword [rbx + 0xd8], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, qword [rbx + 0x118]
lea rdx, [0x1407b2ae0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140152880
mov eax, dword [rbx + 0x58]
test eax, 0x80000
je 0x140152680
cmp qword [rbx + 0xf8], 0xffffffffffffffff
jne 0x140152680
mov dword [rsp + 0x28], 4
mov rdx, qword [rbx + 0xf0]
lea rcx, [rbx + 0xf8]
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x140151210]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x14015267d
nop dword [rax + rax]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
test eax, eax
jle 0x1401528a0
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0xc0], rax
mov rax, qword [rsi + 0x48]
mov qword [rbx + 0xe8], 0
test rax, rax
je 0x1401528b0
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0xe8], rdx
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1401526a9
mov r8d, 0x45e
lea rdx, str.src_win_pipe.c
lea rcx, [0x140472008]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x58]
test eax, 0x10000
je 0x140152635
mov r8d, 0x45f
lea rdx, str.src_win_pipe.c
lea rcx, [0x140472030]
call qword [sym.imp.msvcrt.dll__assert]
cmp qword [rbx + 0x118], 0xffffffffffffffff
jne 0x140152643
mov r8d, 0x461
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x140152643
mov r8d, 0x7e0
lea rdx, str.src_win_pipe.c
lea rcx, str.pipe__flags__UV_HANDLE_CONNECTION
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x140152688
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x140152736
jmp 0x140152797
call rbp
cdqe
jmp 0x1401527ad
mov qword [rbx + 0xe8], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1401526a9
mov r8d, 0x471
lea rdx, str.src_win_pipe.c
lea rcx, [0x14047205a]
call qword [sym.imp.msvcrt.dll__assert]
mov rax, qword [rbx + 0xf0]
jmp 0x140152704
Function at 0x140152b30
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov r12, rcx
mov ebx, edx
mov edi, r8d
xor edx, edx
xor r8d, r8d
lea rsi, [rsp + 0x50]
mov rcx, rbp
call fcn.140141b80
movdqu xmm0, xmmword [rsp + 0x30]
mov edx, ebx
mov r8, rsi
mov rcx, r12
movaps xmmword [rsp + 0x50], xmm0
call qword [r12 + 0x68]
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140152b85
mov r8d, dword [rsp + 0x50]
test r8d, r8d
jne 0x140152ba8
mov r8, rsi
mov rdx, 0xfffffffffffff024
mov rcx, r12
call qword [r12 + 0x70]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r8d, edi
mov rcx, qword [r12 + 0x118]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
cmova r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140152bf0
mov edx, dword [rsp + 0x4c]
mov r8, rsi
mov rcx, r12
call qword [r12 + 0x70]
mov eax, dword [rsp + 0x4c]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm1, xmmword [rsp + 0x50]
mov r8, rbp
mov rcx, r12
mov edx, eax
movaps xmmword [rsp + 0x30], xmm1
call fcn.1401529f0
xor eax, eax
jmp 0x140152b99
Function at 0x140152ed0
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r13, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea rbp, str._pipeuv_p__lu
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [rsp + 0xc0]
mov edi, r8d
mov qword [rsp + 0xa0], rcx
mov rsi, r9
mov rbx, rdx
mov qword [rsp + 0xa8], rdx
or edi, 0x400c0000
jmp 0x140152f42
call r15
mov r8d, eax
cmp eax, 0xe7
je 0x140152f3e
cmp eax, 5
jne 0x140153015
add rbx, 1
call r13
mov r9, rbx
mov r8, rbp
mov rdx, r14
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.1401525e0
mov r9d, 1
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x38], 0
mov rcx, rsi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
call r12
mov r10, rax
cmp rax, 0xffffffffffffffff
je 0x140152f28
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], r10
xor r9d, r9d
mov rcx, r10
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r10, qword [rsp + 0x40]
test rax, rax
je 0x140153029
mov rax, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa8]
mov edx, dword [rax + 0x58]
mov qword [rdi + 0x80], rdi
mov qword [rdi + 0x128], 0
mov eax, edx
or al, 0x80
and edx, 0x2000000
mov dword [rdi + 0x58], eax
jne 0x140153050
test eax, 0x1000000
jne 0x14015308a
mov rax, qword [rsp + 0xa8]
xor r8d, r8d
mov qword [rax + 0x118], r10
mov eax, r8d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x48], r10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10, qword [rsp + 0x48]
mov dword [rsp + 0x40], eax
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x40]
jmp 0x140153015
mov qword [rsp + 0x40], r10
mov r8d, 0x7f
lea rdx, str.src_win_pipe.c
lea rcx, str.__handle__flags__UV_HANDLE_PIPESERVER_
call qword [sym.imp.msvcrt.dll__assert]
mov rax, qword [rsp + 0xa8]
mov r10, qword [rsp + 0x40]
mov eax, dword [rax + 0x58]
test eax, 0x1000000
je 0x140153003
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], r10
mov qword [rax + 0x238], 0
lea rcx, [rax + 0x210]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r10, qword [rsp + 0x40]
jmp 0x140153003

Function at 0x140154ac0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r13, rdx
mov edx, dword [r8 + 0x110]
mov r12, rcx
mov rbx, r8
test edx, edx
jne 0x140154b58
test rax, rax
je 0x140154b20
mov qword [rsp + 0x28], r9
mov r8d, 0x638
lea rdx, str.src_win_pipe.c
lea rcx, str.send_handle__NULL
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x28]
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.140151f30
mov rdx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x140154680
Function at 0x140154b70
Capabilities:
Read file on windows
Read pipe

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
cmp dword [rdx + 0x10], 7
mov r13, rcx
mov r12, rdx
mov rbx, r8
je 0x140154ba2
mov r8d, 0x702
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__type__UV_NAMED_PIPE
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [r12 + 0x58]
mov edx, dword [r12 + 0x78]
and eax, 0xffdeffff
mov dword [r12 + 0x58], eax
test edx, edx
je 0x140154d20
sub edx, 1
mov dword [r12 + 0x78], edx
jne 0x140154bd0
test al, 1
jne 0x140154cd0
test al, 0x80
je 0x140154cf8
mov rcx, qword [r12 + 0x128]
test rcx, rcx
je 0x140154bea
call fcn.140141240
test byte [r12 + 0x59], 0x10
je 0x140154c25
mov rcx, qword [rbx + 0x40]
test ecx, ecx
jns 0x140154c30
mov rax, qword [0x1404c8e80]
call qword [rax]
mov edx, eax
cmp eax, 0x3e3
jne 0x140154d50
mov eax, dword [r12 + 0x58]
and eax, 0x11000
cmp eax, 0x1000
je 0x140154d70
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
lea rax, [rsp + 0x4c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x4c], 0
mov rcx, qword [r12 + 0x118]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140154d88
mov edx, dword [rsp + 0x4c]
mov eax, dword [r12 + 0x58]
test edx, edx
jne 0x140154ca9
jmp 0x140154c15
mov rcx, r12
call fcn.140152c20
test eax, eax
je 0x140154c10
mov edx, dword [rsp + 0x4c]
cmp edx, eax
jb 0x140154c10
sub edx, eax
mov eax, dword [r12 + 0x58]
mov dword [rsp + 0x4c], edx
je 0x140154c15
test ah, 0x10
je 0x140154c15
mov eax, dword [r12 + 0x110]
test eax, eax
jne 0x140154c80
mov r8d, 0xffffffff
mov rcx, r12
call fcn.140152b30
jmp 0x140154c88
test al, 0x20
jne 0x140154bd0
mov rdx, qword [r13 + 0x50]
or eax, 0x20
mov dword [r12 + 0x58], eax
mov qword [r12 + 0x50], rdx
mov qword [r13 + 0x50], r12
test al, 0x80
jne 0x140154bd8
nop dword [rax]
mov r8d, 0x7e9
lea rdx, str.src_win_pipe.c
lea rcx, str.pipe__flags__UV_HANDLE_CONNECTION
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x140154bd8
lea rdx, str.src_win_pipe.c
mov r8d, 0x705
lea rcx, [0x140472147]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [r12 + 0x78]
mov eax, dword [r12 + 0x58]
jmp 0x140154bbe
movdqa xmm0, xmmword [0x140472380]
lea r8, [rsp + 0x30]
mov rcx, r12
movaps xmmword [rsp + 0x30], xmm0
call fcn.1401529f0
jmp 0x140154c10
mov rdx, r12
mov rcx, r13
add rsp, 0x50
pop rbx
pop r12
pop r13
jmp fcn.140152610
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm1, xmmword [0x140472380]
lea r8, [rsp + 0x30]
mov rcx, r12
mov edx, eax
movaps xmmword [rsp + 0x30], xmm1
call fcn.1401529f0
jmp 0x140154c69