joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140294730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov esi, r8d
mov rbx, r9
mov rbp, rdx
sar esi, 4
test r8b, 0xf
je 0x140294766
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
lea rdx, [0x14042bfac]
mov rax, rcx
mov qword [rsp + 0x30], rdi
sub rax, rdx
mov qword [rsp + 0x38], r14
test al, 3
jne 0x1402947dc
mov rax, rbx
sub rax, rdx
test al, 3
jne 0x1402947dc
test esi, esi
je 0x140294880
mov r14, qword [rsp + 0x50]
lea rdi, [rcx + 8]
nop dword [rax]
mov eax, dword [rdi - 8]
mov r8, r14
mov rdx, rbx
xor dword [rbx], eax
mov eax, dword [rdi - 4]
mov rcx, rbx
xor dword [rbx + 4], eax
mov eax, dword [rdi]
xor dword [rbx + 8], eax
mov eax, dword [rdi + 4]
xor dword [rbx + 0xc], eax
call section..text
lea rbp, [rbp + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x10], xmm0
lea rdi, [rdi + 0x10]
dec esi
jne 0x1402947a0
jmp 0x140294880
test esi, esi
je 0x140294880
mov r14, qword [rsp + 0x50]
lea rdi, [rcx + 2]
sub rbp, rcx
movzx eax, byte [rdi - 2]
mov r8, r14
mov rdx, rbx
xor byte [rbx], al
movzx eax, byte [rdi - 1]
mov rcx, rbx
xor byte [rbx + 1], al
movzx eax, byte [rdi]
xor byte [rbx + 2], al
movzx eax, byte [rdi + 1]
xor byte [rbx + 3], al
movzx eax, byte [rdi + 2]
xor byte [rbx + 4], al
movzx eax, byte [rdi + 3]
xor byte [rbx + 5], al
movzx eax, byte [rdi + 4]
xor byte [rbx + 6], al
movzx eax, byte [rdi + 5]
xor byte [rbx + 7], al
movzx eax, byte [rdi + 6]
xor byte [rbx + 8], al
movzx eax, byte [rdi + 7]
xor byte [rbx + 9], al
movzx eax, byte [rdi + 8]
xor byte [rbx + 0xa], al
movzx eax, byte [rdi + 9]
xor byte [rbx + 0xb], al
movzx eax, byte [rdi + 0xa]
xor byte [rbx + 0xc], al
movzx eax, byte [rdi + 0xb]
xor byte [rbx + 0xd], al
movzx eax, byte [rdi + 0xc]
xor byte [rbx + 0xe], al
movzx eax, byte [rdi + 0xd]
xor byte [rbx + 0xf], al
call section..text
lea rdi, [rdi + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [rdi + rbp - 0x12], xmm0
dec esi
jne 0x1402947f0
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1402948a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov r14d, r8d
mov rsi, r9
mov rbp, rcx
sar r14d, 4
test r8b, 0xf
je 0x1402948ca
mov eax, 1
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x50], rbx
lea rcx, [0x14042bfac]
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
test al, 3
jne 0x140294958
mov rax, r9
sub rax, rcx
test al, 3
jne 0x140294958
test r14d, r14d
je 0x140294a0e
mov r15, qword [rsp + 0x70]
lea rbx, [rdx + 8]
nop word [rax + rax]
movups xmm0, xmmword [rbp]
lea rdx, [rbx - 8]
mov r8, r15
mov rcx, rbp
movups xmmword [rsp + 0x20], xmm0
call fcn.140001a00
mov eax, dword [rsi]
xor dword [rbx - 8], eax
mov eax, dword [rsi + 4]
movups xmm0, xmmword [rsp + 0x20]
xor dword [rbx - 4], eax
mov eax, dword [rsi + 8]
add rbp, 0x10
xor dword [rbx], eax
mov eax, dword [rsi + 0xc]
lea rbx, [rbx + 0x10]
xor dword [rbx - 0xc], eax
movups xmmword [rsi], xmm0
dec r14d
jne 0x140294910
jmp 0x140294a0e
test r14d, r14d
je 0x140294a0e
mov r15, qword [rsp + 0x70]
sub rbp, rdx
lea rdi, [rdx + 2]
add rbp, 0xfffffffffffffffe
movups xmm0, xmmword [rdi + rbp]
lea rcx, [rdi + rbp]
lea rdx, [rdi - 2]
mov r8, r15
movups xmmword [rsp + 0x20], xmm0
call fcn.140001a00
movzx eax, byte [rsi]
movups xmm0, xmmword [rsp + 0x20]
xor byte [rdi - 2], al
movzx eax, byte [rsi + 1]
lea rdi, [rdi + 0x10]
xor byte [rdi - 0x11], al
movzx eax, byte [rsi + 2]
xor byte [rdi - 0x10], al
movzx eax, byte [rsi + 3]
xor byte [rdi - 0xf], al
movzx eax, byte [rsi + 4]
xor byte [rdi - 0xe], al
movzx eax, byte [rsi + 5]
xor byte [rdi - 0xd], al
movzx eax, byte [rsi + 6]
xor byte [rdi - 0xc], al
movzx eax, byte [rsi + 7]
xor byte [rdi - 0xb], al
movzx eax, byte [rsi + 8]
xor byte [rdi - 0xa], al
movzx eax, byte [rsi + 9]
xor byte [rdi - 9], al
movzx eax, byte [rsi + 0xa]
xor byte [rdi - 8], al
movzx eax, byte [rsi + 0xb]
xor byte [rdi - 7], al
movzx eax, byte [rsi + 0xc]
xor byte [rdi - 6], al
movzx eax, byte [rsi + 0xd]
xor byte [rdi - 5], al
movzx eax, byte [rsi + 0xe]
xor byte [rdi - 4], al
movzx eax, byte [rsi + 0xf]
xor byte [rdi - 3], al
movups xmmword [rsi], xmm0
dec r14d
jne 0x140294971
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret

Function at 0x1402a64a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
add edx, edx
shr ecx, 7
shr rax, 8
movzx r10d, word [rbx + rax*2]
and ecx, 1
neg ecx
shr r10, 4
sar rcx, 4
and ecx, 0x7f
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1402a64b0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret
Function at 0x1402a64f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, 0x100
xor ebx, ebx
mov r11d, r8d
or edx, r10d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
mov ecx, edx
shr ecx, 7
shr r8d, 8
mov eax, r10d
and ecx, 1
and eax, r11d
add edx, edx
neg ecx
add eax, r10d
sar rcx, 4
add r8d, eax
movzx r8d, word [rdi + r8*2]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
mov ecx, edx
add ebx, dword [r9 + r8*4]
xor ecx, r11d
not ecx
and r10d, ecx
cmp edx, 0x10000
jb 0x1402a6510
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402a6870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
movzx r10d, word [rcx]
mov ebp, r8d
movzx r8d, word [rcx + 2]
mov eax, r10d
xor r10, 0x7f0
shr rax, 4
shr r10, 4
mov r13, r9
mov r14d, dword [r11 + rax*4]
mov eax, r8d
xor r8, 0x7f0
shr rax, 4
shr r8, 4
mov r15d, edx
mov r12d, dword [r11 + rax*4]
mov eax, dword [r11 + r8*4]
mov rbx, rcx
add eax, dword [r11 + r10*4]
add r12d, dword [r11 + r10*4]
xor r9d, r9d
mov dword [rsp + 0x48], eax
mov rsi, r13
nop dword [rax + rax]
cmp r9d, ebp
jae 0x1402a6a51
mov r8d, r9d
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x1402a6942
lea edi, [r15*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 4]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1402a6911
lea eax, [r10 + r14]
inc r9d
add rsi, 4
mov dword [rsi - 4], eax
cmp r9d, 8
jb 0x1402a68f0
cmp r9d, 0x10
jae 0x1402a69dc
lea r14, [r9*4]
lea esi, [r9 - 8]
add r14, r13
nop
cmp r9d, ebp
jae 0x1402a6a51
mov r8d, esi
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x1402a69c5
lea edi, [r15*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 0x104]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1402a6991
lea eax, [r10 + r12]
inc r9d
add r14, 4
mov dword [r14 - 4], eax
inc esi
cmp r9d, 0x10
jb 0x1402a6970
cmp r9d, ebp
jae 0x1402a6a51
lea rdi, [r9*4]
lea r10d, [r9 - 0x10]
add rdi, r13
sub ebp, r9d
mov esi, ebp
mov ebp, dword [rsp + 0x48]
nop dword [rax]
mov eax, r10d
xor r9d, r9d
bts eax, 8
cmp eax, 1
je 0x1402a6a3e
nop
mov edx, eax
mov ecx, eax
shr eax, 1
and edx, 1
shr rcx, 1
movzx r8d, word [rbx + rcx*2 + 0x204]
neg edx
sar rdx, 4
shr r8, 4
and edx, 0x7f
xor r8, rdx
add r9d, dword [r11 + r8*4]
cmp eax, 1
jne 0x1402a6a10
lea eax, [r9 + rbp]
add rdi, 4
inc r10d
mov dword [rdi - 4], eax
dec rsi
jne 0x1402a6a00
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1402a89f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rsi, rcx
xor r11d, r11d
lea rdi, [rcx + 0x33b84]
nop dword [rax]
xor r9d, r9d
mov r10d, r11d
lea eax, [r9 + 1]
lea ebx, [rax + 3]
nop dword [rax]
mov ecx, eax
mov r8d, r10d
add eax, eax
movzx edx, word [rsi + rcx*2 + 0x3422c]
and r8d, 1
shr r10d, 1
mov ecx, r8d
shr rdx, 4
or eax, r8d
neg ecx
sar rcx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [rsi + rdx*4 + 0x324d4]
dec ebx
jne 0x1402a8a20
inc r11d
mov dword [rdi], r9d
add rdi, 4
cmp r11d, 0x10
jb 0x1402a8a10
mov rdi, qword [rsp + 0x18]
mov dword [rsi + 0x33bc4], ebx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
Function at 0x1402a8a80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r12d, 4
mov r10, rcx
lea rbp, [rcx + 0x304d8]
mov edi, r12d
lea rsi, [rsp + 0x10]
nop dword [rax]
movzx edx, byte [rbp]
xor ebx, ebx
mov r11d, edi
mov r9d, edx
mov eax, edx
lea r8d, [rbx + 1]
and eax, 1
shr r9d, 1
dec r9d
or eax, 2
mov ecx, r9d
shl eax, cl
sub r11d, eax
test r9d, r9d
je 0x1402a8b41
mov r14d, edx
mov r15d, eax
mov eax, r8d
mov edx, r11d
add r8d, r8d
sub rax, r14
and edx, 1
shr r11d, 1
add rax, r15
or r8d, edx
movzx ecx, word [r10 + rax*2 + 0x34146]
mov eax, edx
neg eax
shr rcx, 4
sar rax, 4
and eax, 0x7f
xor rcx, rax
add ebx, dword [r10 + rcx*4 + 0x324d4]
dec r9d
jne 0x1402a8b01
inc edi
mov dword [rsi], ebx
inc rbp
add rsi, r12
cmp edi, 0x80
jb 0x1402a8ad0
lea rsi, [rsp]
lea rbx, [r10 + 0x32f84]
lea rdi, [r10 + 0x33f48]
sub rsi, r10
lea r14, [r10 + 0x3338c]
sub rsi, 0x33384
nop word [rax + rax]
xor r11d, r11d
cmp dword [r10 + 0x33bc8], r11d
jbe 0x1402a8bde
nop dword [rax]
mov eax, r11d
xor r9d, r9d
or eax, 0x40
cmp eax, 1
je 0x1402a8bce
nop
mov edx, eax
mov ecx, eax
shr eax, 1
and edx, 1
shr rcx, 1
movzx r8d, word [rdi + rcx*2]
neg edx
sar rdx, 4
shr r8, 4
and edx, 0x7f
xor r8, rdx
add r9d, dword [r10 + r8*4 + 0x324d4]
cmp eax, 1
jne 0x1402a8ba0
mov dword [rbx + r11*4], r9d
inc r11d
cmp r11d, dword [r10 + 0x33bc8]
jb 0x1402a8b90
mov edx, 0xe
cmp dword [r10 + 0x33bc8], edx
jbe 0x1402a8c0d
nop dword [rax]
mov eax, edx
lea rcx, [rbx + rax*4]
mov eax, edx
inc edx
shr eax, 1
sub eax, 5
shl eax, 4
add dword [rcx], eax
cmp edx, dword [r10 + 0x33bc8]
jb 0x1402a8bf0
mov eax, dword [rbx]
lea r8, [r10 + 0x304d8]
lea rdx, [r14 + 8]
mov dword [r14 - 8], eax
mov eax, dword [rbx + 4]
mov r9d, 0x7c
mov dword [r14 - 4], eax
mov eax, dword [rbx + 8]
mov dword [r14], eax
mov eax, dword [rbx + 0xc]
mov dword [r14 + 4], eax
nop dword [rax + rax]
movzx eax, byte [r8]
lea rdx, [rdx + 4]
lea r8, [r8 + 1]
mov ecx, dword [rbx + rax*4]
add ecx, dword [rdx + rsi - 4]
mov dword [rdx - 4], ecx
dec r9
jne 0x1402a8c40
sub rdi, 0xffffffffffffff80
add rbx, 0x100
add r14, 0x200
sub rsi, 0x200
dec r12
jne 0x1402a8b80
mov dword [r10 + 0x3d340], r12d
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402a9da0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov dword [rcx + 0x3c], 0x20
mov qword [rcx + 0x68], 1
mov qword [rcx + 0x60], 4
lea r8, [rcx + 0x84]
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x28], rax
nop dword [rax + rax]
mov edx, eax
mov ecx, eax
inc eax
shr ecx, 1
and edx, 1
lea r8, [r8 + 4]
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [r8 - 4], ecx
cmp eax, 0x100
jb 0x1402a9dd0
ret
Function at 0x1402b0bb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x48], rdi
jne 0x1402b0c3e
lea rax, [rsp + 0x30]
mov r9, rcx
lea r8, [0x1402b14c0]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x1402b0c3e
lea rcx, [rbx + 0x80]
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0xb0], edi
jne 0x1402b0c26
mov rcx, qword [rbx + 0xa8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
inc dword [rbx + 0xb0]
lea rcx, [rbx + 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x58]
cmp qword [rbx + 0x48], rdi
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1402b14d0
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdx, qword [rdi + 0x40]
lea r14, [rdi + 0x28]
mov qword [rsp + 0x68], rdx
mov rbp, rax
mov qword [rsp + 0x60], rax
xor r15d, r15d
cmp qword [rdi + 0x20], 8
jb 0x1402b1532
mov rcx, qword [rdi + 8]
jmp 0x1402b1536
lea rcx, [rdi + 8]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x3e8
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 6
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1402b1586
mov rcx, qword [rdi + 0x40]
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1402b15f7
xor eax, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1402b15cd
lea rdx, [rsp + 0x60]
lea ecx, [rax + 2]
or r9d, 0xffffffff
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x1402b15ee
mov rdx, rbx
mov rcx, rdi
call fcn.1402b2a90
test al, al
jne 0x1402b1525
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402b1525
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [rdi + 0xb0]
jne 0x1402b1619
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1402b1eb0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, vtable.HitmanProPipeClient.0
mov qword [rcx], rax
mov qword [rcx + 0x58], 7
xor edi, edi
mov qword [rcx + 0x50], rdi
mov word [rcx + 0x40], di
mov qword [rcx + 0x78], 7
mov qword [rcx + 0x70], rdi
mov word [rcx + 0x60], di
mov qword [rcx + 0x98], 7
mov qword [rcx + 0x90], rdi
mov word [rcx + 0x80], di
add rcx, 0xb8
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rdi
mov word [rcx], di
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov dword [rbx + 0xa0], edi
mov qword [rbx + 0xa8], rdi
mov qword [rbx + 0x38], rdi
mov dword [rbx + 0xb0], 0xffffffff
lea r8d, [rdi + 0x12]
lea rdx, str..pipehitmanpro
call fcn.1400ce190
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x28], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x30], rax
mov byte [rbx + 0xe8], dil
xor eax, eax
mov qword [rbx + 0xe9], rax
mov qword [rbx + 0xf1], rax
mov qword [rbx + 0xf9], rax
mov dword [rbx + 0x101], eax
mov qword [rbx + 0xe0], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x1402b24c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xd8], rax
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1402b2040
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0xd8]
lea rax, vtable.HitmanProPipeClient.0
mov rbx, rcx
mov qword [rcx], rax
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
mov r8d, 0x1f4
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1402b2087
mov rcx, qword [rbx + 0xd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx + 0xd0], 8
jb 0x1402b20be
mov rcx, qword [rbx + 0xb8]
call fcn.1402177e0
xor edi, edi
mov qword [rbx + 0xd0], 7
mov qword [rbx + 0xc8], rdi
mov word [rbx + 0xb8], di
cmp qword [rbx + 0x98], 8
jb 0x1402b20ef
mov rcx, qword [rbx + 0x80]
call fcn.1402177e0
mov qword [rbx + 0x98], 7
mov qword [rbx + 0x90], rdi
mov word [rbx + 0x80], di
cmp qword [rbx + 0x78], 8
jb 0x1402b2118
mov rcx, qword [rbx + 0x60]
call fcn.1402177e0
mov qword [rbx + 0x78], 7
mov qword [rbx + 0x70], rdi
mov word [rbx + 0x60], di
cmp qword [rbx + 0x58], 8
jb 0x1402b2138
mov rcx, qword [rbx + 0x40]
call fcn.1402177e0
mov qword [rbx + 0x58], 7
mov qword [rbx + 0x50], rdi
mov word [rbx + 0x40], di
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1402b2230
Capabilities:
Create process on windows
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x10f0
call fcn.1402cb740
sub rsp, rax
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x10e0], rax
cmp qword [rcx + 0xa8], 0
mov rdi, rdx
mov rbx, rcx
je 0x1402b2282
lea rdx, str.Already_running.
add rcx, 0x40
mov r8d, 0x10
call fcn.1400ce190
xor al, al
jmp 0x1402b23be
call fcn.1402b21a0
cmp qword [rax + 0x10], 0
jne 0x1402b22ab
lea rcx, [rbx + 0x40]
lea rdx, str.No_path_to_HitmanPro_found.
mov r8d, 0x1b
call fcn.1400ce190
xor al, al
jmp 0x1402b23be
mov rcx, rbx
call fcn.1402b21a0
cmp qword [rax + 0x18], 8
jb 0x1402b22bd
mov rax, qword [rax]
lea rdx, str.__ls___ls
lea rcx, [rsp + 0xe0]
mov r9, rdi
mov r8, rax
call fcn.1402b2810
xor eax, eax
xor edi, edi
lea rcx, [rsp + 0x78]
lea r8d, [rdi + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1402c22a0
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1402b235e
lea rcx, [rbx + 0x40]
lea r8d, [rdi + 0x15]
lea rdx, str.CreateProcess_failed.
call fcn.1400ce190
xor al, al
jmp 0x1402b23be
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rbx + 0xe0]
mov dword [rbx + 0xa0], eax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0xa8], rax
test rcx, rcx
je 0x1402b2393
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rax, [rsp + 0x68]
lea r8, [0x1402b23e0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xe0], rax
mov al, 1
mov rcx, qword [rsp + 0x10e0]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x1110]
add rsp, 0x10f0
pop rdi
ret
Function at 0x1402b24e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.1402cb740
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x10b8], rbx
mov qword [rsp + 0x10c0], rsi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
lea r14, vtable.HitmanProPipeData.0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.1402b2700
mov rdi, rax
test rax, rax
jne 0x1402b2584
nop dword [rax + rax]
mov edx, 0x14d
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1402b26c1
call fcn.1402b2700
mov rdi, rax
test rax, rax
je 0x1402b2560
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 0x1000
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1402b26b3
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x1402b2541
xor ecx, ecx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x60], r14
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x78], eax
cmp dword [rbp - 0x80], 0x50504d48
jne 0x1402b2679
movzx eax, word [rbp - 0x78]
cmp ax, 1
jne 0x1402b265a
movups xmm0, xmmword [rbp - 0x6c]
movups xmmword [rbx + 0xe9], xmm0
movsd xmm1, qword [rbp - 0x5c]
movsd qword [rbx + 0xf9], xmm1
mov eax, dword [rbp - 0x54]
mov dword [rbx + 0x101], eax
mov byte [rbx + 0xe8], 1
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1402b2679
mov r8, rbx
mov edx, dword [rbp - 0x74]
mov ecx, dword [rbp - 0x70]
call rax
movzx eax, word [rbp - 0x78]
cmp ax, 2
jne 0x1402b2679
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x1402b2679
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x68]
mov ecx, dword [rbp - 0x74]
call rax
nop
cmp byte [rsp + 0x68], 0
je 0x1402b2689
lea rcx, [rbp - 0x80]
call fcn.1402b9c20
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 0x1000
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1402b25d3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x1402b2541
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret