joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021180
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140248318]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140021253
cmp byte [rcx + 0x71], 0
je 0x140021253
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14002124f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140021214
sub eax, 1
je 0x140021218
cmp eax, 2
jne 0x14002124f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14018bc90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140021246
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002124f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400211fc
xor al, al
jmp 0x1400211fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14018bc90
add rsp, 0x60
pop rbx
ret
Function at 0x140032850
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140248318]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003287d
xor eax, eax
jmp 0x1400329d2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400328a8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400328a8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400329d2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400329c5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400328eb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140032916
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400329ca
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140032985
sub eax, 1
je 0x140032985
cmp eax, 2
jne 0x1400329c5
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400329ca
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400329b3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400329c5
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x1400329ca
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14018bc90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140043d30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140043d61
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140043d7f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140043da0
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140043da2
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140043dd4
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
mov rbx, rdi
je 0x140043e71
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140043e12
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x140043e51
nop dword [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x140043e92
cmp rdi, rax
ja 0x140043e20
test rbx, rbx
je 0x140043e71
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x140043e74
Function at 0x140043ea0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140043ed7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140043ef8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140043efa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140043f53
test ecx, ecx
jle 0x140043f33
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140043f53
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140043f53
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400487d0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbx, r9
mov eax, r8d
mov rsi, rdx
mov rdi, rcx
jb 0x1400487f5
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1400487ff
mov rcx, qword [rcx]
xor r8d, r8d
test eax, eax
sete r8b
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140048848
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140048848
lea rcx, str.boost::filesystem::copy_file
mov r9, rbx
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov ecx, eax
mov rdx, rdi
call fcn.140049c90
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x140048862
lea rax, [0x1401b3f30]
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov byte [rbx + 4], 0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140048880
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov r8d, esi
mov eax, 2
mul r8
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.14018c514
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x140048908
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140048908
lea r8, str.boost::filesystem::current_path
mov rdx, r15
mov ecx, eax
call fcn.140049e00
jmp 0x14004891f
test r15, r15
je 0x14004891f
mov dword [r15], esi
mov byte [r15 + 4], sil
lea rax, [0x1401b3f30]
mov qword [r15 + 8], rax
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140048932
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140046cb0
nop
mov rcx, rbx
call fcn.14018bbf4
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140048ca0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
lea r14, [0x1401b3f30]
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x24], bpl
mov qword [rsp + 0x28], r14
jb 0x140048cd9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140048d00
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140048b80
mov ebp, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140048d65
bt ebx, 0xa
jae 0x140048d5c
mov rcx, rsi
call fcn.140048970
test al, al
je 0x140048d24
test bl, 0x10
mov eax, listen
mov ebx, 4
cmovne ebx, eax
jmp 0x140048d65
mov ebx, 9
test rdi, rdi
je 0x140048d3c
mov dword [rdi], 0
mov byte [rdi + 4], 0
mov qword [rdi + 8], r14
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.140048d90
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
jne 0x140048d29
test ebp, ebp
je 0x140048d29
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rsi
mov ecx, ebp
call fcn.140049d50
xor al, al
jmp 0x140048d49
Function at 0x140048d90
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rcx
cmp edx, 1
jne 0x140048dce
test rbx, rbx
je 0x140048dc1
lea rax, [0x1401b3f30]
mov dword [r8], 0
mov qword [r8 + 8], rax
mov byte [r8 + 4], 0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x140048dea
cmp qword [rcx + 0x18], 8
jb 0x140048de2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140048dfa
cmp qword [rcx + 0x18], 8
jb 0x140048df4
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140048e55
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140048e19
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140048e55
cmp eax, 0x7b
je 0x140048e55
cmp eax, 0x57
je 0x140048e55
cmp eax, 0xa1
je 0x140048e55
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140048e55
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
mov ecx, eax
call fcn.140049d50
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x140048e6f
lea rax, [0x1401b3f30]
mov byte [rbx + 4], 0
mov qword [rbx + 8], rax
mov dword [rbx], 0
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140048e80
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
jb 0x140048ea2
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x140048eac
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140048ef2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140048ef2
lea rcx, str.boost::filesystem::rename
mov r9, rbx
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov ecx, eax
mov rdx, rdi
call fcn.140049c90
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x140048f0c
lea rax, [0x1401b3f30]
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov byte [rbx + 4], 0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140048f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140248318]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140048f54
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x140048f75
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.140048b80
jmp 0x1400490ed
mov edx, r14d
mov rcx, rsi
call fcn.140048a50
mov r12d, eax
xor ebp, ebp
bt r14d, 0xa
jae 0x1400490aa
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140048f9d
mov rdx, qword [rsi]
mov qword [rsp + 0x48], rbp
movdqa xmm0, xmmword [0x1401b83c0]
movdqu xmmword [rsp + 0x58], xmm0
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], bp
jne 0x140048fc0
lea rcx, [rsp + 0x48]
call fcn.140046cb0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140049056
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049051
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049051
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14018bbf4
movdqa xmm0, xmmword [0x1401b83c0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
cmp rbx, 0xffffffffffffffff
jne 0x140049080
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.140048b80
nop
jmp 0x1400490ed
mov rcx, rsi
call fcn.140048970
test al, al
jne 0x1400490a1
mov dword [rdi], 9
mov dword [rdi + 4], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400490ed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1400490c2
mov dword [r15], ebp
mov byte [r15 + 4], 0
lea rax, [0x1401b3f30]
mov qword [r15 + 8], rax
and r14d, 0x10
je 0x1400490ce
mov eax, dword [rsp + 0x40]
jmp 0x1400490d6
mov eax, r12d
mov r12d, dword [rsp + 0x40]
test r14d, r14d
setne bpl
add ebp, 2
mov dword [rdi], ebp
test r14d, r14d
cmove r12d, eax
mov dword [rdi + 4], r12d
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14018bc90
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140066890
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
cmp qword [rcx + 0x40], 0
mov rdi, rcx
je 0x1400668bf
mov al, 1
mov rdi, qword [rsp + 0x158]
add rsp, 0x130
pop rbp
ret
mov qword [rsp + 0x150], rsi
call fcn.1400667a0
mov rsi, rax
test rax, rax
je 0x140066a22
mov qword [rsp + 0x148], rbx
mov ebx, dword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm0, xmmword [rdi + 0x28]
mov dword [rbp - 0x6c], eax
lea r9, [rsp + 0x40]
lea rax, [rdi + 0x5c]
mov dword [rbp - 0x68], ebx
xor ebx, ebx
mov qword [rbp - 0x60], rax
lea rax, [rdi + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x70]
lea rax, [rdi + 0x68]
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x50], rax
lea r8d, [rbx + 0x50]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x38], rbx
movups xmmword [rbp - 0x48], xmm0
mov qword [rsp + 0x28], rax
mov rcx, rsi
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x50
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x68], xmm1
mov qword [rsp + 0x78], rbx
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x140066a0e
cmp dword [rsp + 0x40], 2
jne 0x140066a0e
cmp dword [rsp + 0x44], ebx
je 0x140066a0e
cmp qword [rsp + 0x78], rbx
je 0x140066a0e
cmp qword [rbp - 0x80], rbx
je 0x140066a0e
cmp qword [rbp - 0x78], rbx
je 0x140066a0e
xorps xmm0, xmm0
mov qword [rbp - 0x1c], rbx
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm0
xor eax, eax
movaps xmmword [rbp], xmm1
lea r9, [rbp + 0x40]
mov qword [rbp + 0x10], rax
lea r8d, [rbx + 0x50]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp - 0x20]
mov qword [rbp + 0x18], rbx
mov rcx, rsi
mov dword [rbp - 0x20], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140066a0e
mov rax, qword [rsp + 0x78]
mov bl, 1
mov qword [rdi + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rdi + 0x48], rax
mov rax, qword [rbp - 0x78]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x44]
mov dword [rdi + 0x58], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
add rsp, 0x130
pop rbp
ret
Function at 0x14006ff90
Capabilities:
Create thread

Disassembly:
add rcx, 0x50
jmp fcn.14006fd30
Function at 0x14008b860
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x140248318]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 0x30]
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14008ba31
cmp dword [rsi + 0x2c], eax
je 0x14008b8e7
mov dword [rsp + 0x30], 2
lea rax, [0x140245970]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14008ba1b
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
jmp 0x14008b9e4
mov dword [rsi + 0x2c], 1
mov rcx, rsi
call fcn.14008bfe0
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov qword [rsp + 0xa0], r14
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14008b92b
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax]
mov qword [rsp + 0xa0], rax
mov ecx, 0x48
call fcn.14018bbb8
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14008b972
mov rax, qword [rsp + 0x60]
mov qword [rdi], rax
lea rbp, [rdi + 8]
mov qword [rsp + 0x40], rbp
mov qword [rbp + 0x38], r14
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14008b970
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax]
mov qword [rbp + 0x38], rax
jmp 0x14008b975
mov rdi, r14
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x14007dbf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14008ba21
cmp dword [rsi + 0xd0], 0
jne 0x14008ba14
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rsi + 0xc8], xmm1
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14008b9e4
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_unlock
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14018bc90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x1400955d0
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x14009568e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x140095690
cmp rax, rdx
je 0x14009568e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140095671
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret