joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c600
Capabilities:
Create thread

Disassembly:
jmp 0x14003c600
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x69], 0
mov rdi, rcx
jne 0x14003c6c7
mov word [rcx + 0x69], 1
mov byte [rcx + 0x68], 1
add rcx, 0x30
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor esi, esi
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x7fffffff
mov qword [rdi + 0x38], rsi
mov dword [rdi + 0x40], esi
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
lea ecx, [rsi + 0x10]
mov dword [rdi + 0x48], esi
mov byte [rdi + 0x44], sil
mov qword [rdi + 0x50], rax
call fcn.14008c958
mov rbx, rax
test rax, rax
je 0x14003c6bd
lea rcx, [rdi + 0x2c]
lea rax, [0x14003c810]
lea r8, [0x14003eed0]
mov qword [rsp + 0x28], rcx
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14003c6b5
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14008c8c8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14003ef20
Capabilities:
Create thread

Disassembly:
jmp 0x14003ef20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x140120a68]
xor esi, esi
cmp ecx, 0x1f4
cmovge eax, ecx
xor bl, bl
mov dword [0x140120a68], eax
movzx ecx, bl
call fcn.14000150a
mov rdi, rax
test rax, rax
je 0x14003ef68
mov rcx, rax
call fcn.140001b45
mov rcx, rdi
call fcn.140001c8f
inc bl
cmp bl, 0x20
jb 0x14003ef48
mov rax, rsi
lock xadd qword [0x140120a60], rax
test al, al
je 0x14003f00b
mov ecx, reloc.WSOCK32.dll_recv
call fcn.14008c958
mov rbx, rax
test rax, rax
je 0x14003f006
lea rax, [0x14003f200]
lea r8, [0x140041350]
mov r9, rbx
mov qword [rbx], rax
lea rax, [0x14013d3a0]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rbx + 8], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14003efe7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.14008c8c8
mov esi, 0x3eb
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov esi, 0x708
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140067a90
Capabilities:
Delete directory
Delete file

Disassembly:
jmp 0x140067a90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
mov rbx, rcx
test rax, rax
je 0x140067ab3
mov rdx, qword [rcx + 0x28]
xor ecx, ecx
call rax
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140067abe
call rax
mov rcx, qword [rbx + 8]
xor esi, esi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], rsi
test rcx, rcx
je 0x140067ae3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 8], rsi
lea rcx, [rbx + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14000195b

Function at 0x140068f60
Capabilities:
Create thread

Disassembly:
jmp 0x140068f60
push rbx
sub rsp, 0x40
mov rbx, rcx
mov r9, rcx
mov r8, rdx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140068feb
cmp dword [reloc.WSOCK32.dll_accept], 4
jl 0x140068fe3
test dword [0x140124900], 0x100000
je 0x140068fe3
mov eax, dword [rbx + 0xc8]
lea r9, str..._act_wireless.c
lea r8, str.create_act_wireless_event_monitor_thread
mov dword [rsp + 0x30], eax
lea rax, str.__d__Unable_to_create_Act_event_monitor_thread_n
mov edx, 4
mov qword [rsp + 0x28], rax
mov ecx, 0x100000
mov dword [rsp + 0x20], 0x1b2
call fcn.140001a41
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov eax, 1
add rsp, 0x40
pop rbx
ret

Function at 0x140070700
Capabilities:
Create thread

Disassembly:
jmp 0x140070700
push rbx
sub rsp, 0x40
cmp dword [reloc.WSOCK32.dll_accept], 4
mov rbx, rcx
jl 0x14007074f
test dword [0x140124900], 0x200000
je 0x14007074f
lea rax, str.Starting_thread__n
lea r9, str...cem_cstatechangedetection.cpp
lea r8, str.CStateChangeDetection::StartThread
mov qword [rsp + 0x28], rax
mov edx, 4
mov ecx, 0x200000
mov dword [rsp + 0x20], 0x5d
call fcn.140001a41
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + htons]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rbx + 0x14], 0
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1400707a6
lea r8, [0x140001302]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400707b1
mov eax, 0x80004005
add rsp, 0x40
pop rbx
ret
cmp dword [reloc.WSOCK32.dll_accept], 4
jl 0x140070804
test dword [0x140124900], 0x200000
je 0x140070804
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadId]
lea r10, str.Thread_ID___d_n
lea r9, str...cem_cstatechangedetection.cpp
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r10
lea r8, str.CStateChangeDetection::StartThread
mov edx, 4
mov ecx, 0x200000
mov dword [rsp + 0x20], reloc.WSOCK32.dll_WSACleanup
call fcn.140001a41
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x14007aa90
Capabilities:
Get common file path

Disassembly:
jmp 0x14007aa90
mov qword [rsp + 0x20], rbx
push r15
sub rsp, 0x240
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call fcn.14008ca20
xor eax, eax
mov dword [rbx], 9
mov qword [rbx + 4], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov qword [rbx + 0xc], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
mov r15d, eax
cmp ecx, 0x102
ja 0x14007aba0
lea ecx, [rax + 1]
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
lea rsi, [rcx + rcx]
mov qword [rsp + 0x260], r14
mov r14d, ecx
mov rcx, rsi
call fcn.14008c958
mov rdi, rax
test rax, rax
je 0x14007ab3d
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14008ca20
mov rsi, qword [rsp + 0x250]
mov qword [rbx + 4], rdi
test rdi, rdi
je 0x14007ab6b
lea r8, [rsp + 0x20]
mov rdx, r14
mov rcx, rdi
call fcn.140094ebc
lea ecx, [r15 + r15]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x258]
mov r14, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14008d900
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r15
ret
mov rax, rbx
jmp 0x14007ab7e

Function at 0x14007abf0
Capabilities:
Get common file path

Disassembly:
jmp 0x14007abf0
mov qword [rsp + 0x20], rbx
push r15
sub rsp, 0x240
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call fcn.14008ca20
xor eax, eax
mov dword [rbx], 9
mov qword [rbx + 4], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x104
mov qword [rbx + 0xc], rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [rax - 1]
mov r15d, eax
cmp ecx, 0x102
ja 0x14007ad00
lea ecx, [rax + 1]
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
lea rsi, [rcx + rcx]
mov qword [rsp + 0x260], r14
mov r14d, ecx
mov rcx, rsi
call fcn.14008c958
mov rdi, rax
test rax, rax
je 0x14007ac9d
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14008ca20
mov rsi, qword [rsp + 0x250]
mov qword [rbx + 4], rdi
test rdi, rdi
je 0x14007accb
lea r8, [rsp + 0x20]
mov rdx, r14
mov rcx, rdi
call fcn.140094ebc
lea ecx, [r15 + r15]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x258]
mov r14, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14008d900
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r15
ret
mov rax, rbx
jmp 0x14007acde
Function at 0x14007b180
Capabilities:
Get common file path
Query environment variable

Disassembly:
jmp 0x14007b180
push rbp
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rbp + 0x470], rax
lea rcx, [rbp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x140], 0
call fcn.14008ca20
lea rcx, [rbp + 0x251]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x250], 0
call fcn.14008ca20
lea rcx, [rbp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x30], 0
call fcn.14008ca20
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.14008ca20
lea rcx, [rbp + 0x361]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x360], 0
call fcn.14008ca20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, [rbp + 0x140]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
jne 0x14007b265
lea r8, [0x1400fcfb0]
lea rcx, [rbp + 0x140]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea rcx, [rbp + 0x250]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14007b297
lea r8, [0x1400fcfc0]
lea rcx, [rbp + 0x250]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea rdx, [rbp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, eax
cmp rax, 1
jbe 0x14007b2c4
dec rax
cmp rax, 0x104
jae 0x14007b3ff
mov byte [rbp + rax + 0x30], 0
jmp 0x14007b2dd
lea r8, [0x1400fcfd8]
lea rcx, [rbp + 0x30]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea rdx, [rsp + 0x20]
lea rcx, [0x1400fcff0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x14007b32f
lea rdx, [rsp + 0x20]
lea rcx, [0x1400fd000]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x14007b32f
lea r8, [0x1400fd010]
lea rcx, [rsp + 0x20]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea r9, [rsp + 0x20]
lea r8, [0x1400fd028]
lea rdx, [rbp + 0x360]
mov ecx, 0x104
call fcn.14007a750
lea r8, [rbp + 0x140]
lea rdx, [0x1400fd070]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rbp + 0x250]
lea rdx, [0x1400fd080]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rbp + 0x30]
lea rdx, [0x1400fd08c]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rsp + 0x20]
lea rdx, [0x1400fd098]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rbp + 0x360]
lea rdx, [0x1400fd0ac]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.14008d900
add rsp, 0x580
pop rbp
ret
call fcn.14008cf94
int3
Function at 0x14007f0a0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov ebx, 1
mov ecx, 0xfffffff6
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x2c], ebx
mov byte [rsp + 0x36], reloc.WSOCK32.dll_listen
mov word [rsp + 0x28], bx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008d900
add rsp, 0x50
pop rbx
ret
Function at 0x14007f2e0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0xc0
xor ebx, ebx
mov r12, r8
mov rdi, rdx
lea rcx, [rsp + 0x58]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [rsp + 0x50], ebx
call fcn.14008ca20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, qword [rdi]
mov rsi, rax
test rcx, rcx
jne 0x14007f327
mov eax, ebx
jmp 0x14007f331
mov edx, 0x1fff
call fcn.140092b74
cmp word [rsi], 0x22
jne 0x14007f33b
add rax, 2
mov rdx, qword [rdi + 8]
lea rcx, [rsi + rax*2]
call fcn.140095254
mov r14, rax
test rax, rax
jne 0x14007f369
lea rdx, str.Unable_to_parse_command_line._n
lea ecx, [rax + 3]
call fcn.1400013e3
mov eax, 0x708
jmp 0x14007f520
mov rcx, qword [rdi + 8]
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xe8], r15
test rcx, rcx
jne 0x14007f387
mov rax, rbx
jmp 0x14007f391
mov edx, 0x1fff
call fcn.140092b74
mov edx, 0x1fff
mov rcx, rsi
lea r15, [r14 + rax*2]
call fcn.140092b74
mov rcx, qword [rdi + 8]
lea rsi, [rax + 1]
test rcx, rcx
jne 0x14007f3b4
mov rax, rbx
jmp 0x14007f3be
mov edx, 0x1fff
call fcn.140092b74
lea rcx, str.server__i
mov edx, 0x1fff
sub rsi, rax
call fcn.140092b74
lea r14, [rax + 2]
add r14, rsi
lea rbp, [r14 + r14]
mov rcx, rbp
call fcn.14008c958
mov rsi, rax
test rax, rax
je 0x14007f4fa
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.14008ca20
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.14008ca20
mov eax, 0x22
mov rdx, r14
mov word [rsi], ax
mov r8, qword [rdi]
mov rcx, rsi
call fcn.1400951cc
lea r8, [0x1400fd78c]
mov rdx, r14
mov rcx, rsi
call fcn.1400951cc
lea r8, [0x1400fd790]
mov rdx, r14
mov rcx, rsi
call fcn.1400951cc
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.1400951cc
mov qword [rsp + 0x48], r12
lea rax, [0x1400fb314]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x8c], 1
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, 0x3eb
test eax, eax
cmove ebx, ecx
mov rcx, rsi
call fcn.14008c8c8
mov eax, ebx
jmp 0x14007f510
lea rdx, str.Unable_to_allocate_memory._n
mov ecx, 3
call fcn.1400013e3
mov eax, 0x708
mov rbp, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x14007f9e0
Capabilities:
Create thread

Disassembly:
jmp 0x14007f9e0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov r14d, r9d
mov edi, r8d
mov rbx, rcx
test rcx, rcx
je 0x14007fb5f
mov r8, rdx
add rcx, 8
mov edx, 0x104
call fcn.140094ebc
test eax, eax
jne 0x14007fb5f
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x50], rbp
mov dword [rbx + 0x240], r15d
mov ecx, eax
mov qword [rbx + 0x248], r15
mov dword [rbx + 0x210], edi
mov dword [rbx + 0x214], r14d
mov qword [rbx + 0x218], r15
mov dword [rbx + 0x220], eax
mov qword [rbx + 0x230], r15
mov qword [rbx + 0x238], r15
mov dword [rbx + 0x224], 0x40008
mov dword [rbx + 0x228], 0x40008
mov ebp, eax
call fcn.14008c958
mov rdi, rax
test rax, rax
je 0x14007fa95
mov r8d, ebp
xor edx, edx
mov rcx, rax
call fcn.14008ca20
mov rbp, qword [rsp + 0x50]
mov qword [rbx + 0x218], rdi
test rdi, rdi
je 0x14007fb5f
mov ecx, 0x298
call fcn.14008c958
mov rdi, rax
test rax, rax
je 0x14007facc
xor edx, edx
mov r8d, 0x298
mov rcx, rax
call fcn.14008ca20
mov qword [rbx], rdi
test rdi, rdi
je 0x14007fb5f
mov dword [rsp + 0x20], r14d
mov r9d, 1
lea rdx, [rbx + 8]
mov rcx, rdi
cmp dword [rbx + 0x210], r15d
jne 0x14007faf8
xor r8d, r8d
jmp 0x14007fafb
mov r8d, r9d
call fcn.1400010b9
test eax, eax
je 0x14007fb5f
cmp qword [rbx + 0x218], r15
je 0x14007fb5f
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x230], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x238], rax
cmp qword [rbx], r15
je 0x14007fb4f
lea r8, [0x14007fd90]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x248], rax
cmp qword [rbx + 0x248], r15
je 0x14007fb5f
mov eax, 1
jmp 0x14007fb6a
mov rcx, rbx
call fcn.140001a0f
mov eax, r15d
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14007ff90
Capabilities:
Write file on windows

Disassembly:
jmp 0x140080b70
jmp 0x14007ff90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14007ffe5
mov rcx, qword [rcx]
test rcx, rcx
je 0x14007ffe5
call fcn.140001db1
test eax, eax
je 0x14007ffe5
cmp qword [rbx + 0x248], 0
je 0x14007ffe5
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140001127
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x140080b9d
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x140080bb8
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x40]
cmp dword [rcx + 0x218], edi
jne 0x140080be2
mov rcx, qword [rcx + 0x208]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x258], rdi
mov qword [rsp + 0x48], rsi
lea rsi, [rcx + 0x250]
mov rcx, qword [rcx + 0x208]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x140080c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140080c46
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140080100
Capabilities:
Connect pipe

Disassembly:
jmp 0x140080100
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x208]
xor eax, eax
cmp rcx, 0xffffffffffffffff
je 0x140080168
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
cmp dword [rdi + 0x214], eax
jne 0x14008014d
cmp dword [rdi + 0x218], eax
jne 0x14008016e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x14008014d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x14008015c
mov ebx, 1
mov dword [rdi + 0x210], 1
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, [rdi + 0x278]
mov qword [rdi + 0x278], rax
mov qword [rdi + 0x280], rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x140080152
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140080146
mov rcx, qword [rdi + 0x208]
lea r9d, [rbx + 1]
lea r8, [rsp + 0x30]
lea rdx, [rdi + 0x278]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebx, eax
test eax, eax
jne 0x140080152
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140080a30
Capabilities:
Read file on windows

Disassembly:
jmp 0x140080a30
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x140080a5d
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x140080a78
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x40]
cmp dword [rcx + 0x218], edi
jne 0x140080aa2
mov rcx, qword [rcx + 0x208]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x230], rdi
mov qword [rsp + 0x48], rsi
lea rsi, [rcx + 0x228]
mov rcx, qword [rcx + 0x208]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test eax, eax
jne 0x140080b08
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140080b06
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140080b70
Capabilities:
Write file on windows

Disassembly:
jmp 0x140080b70
jmp 0x14007ff90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14007ffe5
mov rcx, qword [rcx]
test rcx, rcx
je 0x14007ffe5
call fcn.140001db1
test eax, eax
je 0x14007ffe5
cmp qword [rbx + 0x248], 0
je 0x14007ffe5
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140001127
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x140080b9d
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x140080bb8
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x40]
cmp dword [rcx + 0x218], edi
jne 0x140080be2
mov rcx, qword [rcx + 0x208]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x258], rdi
mov qword [rsp + 0x48], rsi
lea rsi, [rcx + 0x250]
mov rcx, qword [rcx + 0x208]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x140080c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140080c46
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140080d70
Capabilities:
Terminate process

Disassembly:
jmp 0x140080d70
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 1
xor eax, eax
lock cmpxchg dword [rcx], edi
je 0x140080da3
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [rbx], edi
jne 0x140080d90
dec dword [rbx + 4]
mov eax, dword [rbx + 4]
mov edi, 0
cmovs eax, edi
mov dword [rbx + 4], eax
test eax, eax
jne 0x140080e4c
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x140080dfb
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140080ded
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x60], rdi
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], rdi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140080e34
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0x48]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140080e34
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 8]
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x58], 0xffffffff
call fcn.14000195b
xchg dword [rbx], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret