joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f8a0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbx, rdx
mov rbp, rcx
xor dil, dil
xor esi, esi
call fcn.140058dd0
test al, al
je 0x14005f93d
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
lea rdx, [rsp + 0x78]
mov rcx, rbp
call fcn.140058850
nop
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x10]
movzx ecx, word [rdx + rcx]
call fcn.14001a630
lea ecx, [rax - 0x41]
mov ebp, 1
shl ebp, cl
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx]
test eax, eax
je 0x14005f91a
cmp eax, 0xffffffff
je 0x14005f928
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
jne 0x14005f928
mov rcx, qword [rsp + 0x78]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
test esi, ebp
je 0x14005fa52
mov esi, 0x14
mov dil, 1
jmp 0x14005fa21
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.1400590c0
nop
mov dword [rsp + 0x30], 7
lea rax, [0x1414b14e8]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov ebp, 1
mov r8d, ebp
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140019960
test al, al
je 0x14005f9ee
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x10]
mov r9d, ebp
lea r8d, [rbp + 6]
movzx edx, word [rax + rcx]
lea rcx, [rsp + 0x70]
call fcn.1400158a0
test eax, eax
jle 0x14005f9d7
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x10]
lea r8d, [rax + 1]
mov r9d, ebp
movzx edx, word [rcx + rdx]
lea rcx, [rsp + 0x70]
call fcn.1400158a0
test eax, eax
jle 0x14005f9d7
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + 4]
dec edx
cmp eax, edx
jne 0x14005f9f3
lea rcx, [rsp + 0x70]
call fcn.14005fd00
test al, al
je 0x14005f9ee
mov esi, 0x10
movzx edi, bpl
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
test eax, eax
je 0x14005fa0e
cmp eax, 0xffffffff
je 0x14005fa1c
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
jne 0x14005fa1c
mov rcx, qword [rsp + 0x70]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
test dil, dil
je 0x14005fa52
mov dword [rbx + 0x10], esi
test sil, 2
je 0x14005fa31
or dword [rbx + 4], 0x100000
test sil, 0x10
mov eax, 0x20000
mov ecx, 0x40000
cmovne eax, ecx
or dword [rbx + 4], eax
or dword [rbx + 4], 0x400000
or dword [rbx], 0x560000
movzx eax, dil
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006b080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 1
je 0x14005a132
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14006b080
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov rax, qword [rcx + 0x70]
test rax, rax
jne 0x14006b1a4
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14006b19f
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x14006b205
mov edi, r8d
mov dword [r11 + 8], r8d
xor r12d, r12d
mov ebx, r12d
lea r13, [0x1414b2560]
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x90]
cmp edi, 0x2000000
cmovae rax, r13
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xa8]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006b142
mov ecx, dword [rsp + 0xa8]
test ecx, ecx
je 0x14006b19a
add rbx, rcx
sub edi, ecx
mov dword [rsp + 0x90], edi
cmp rbx, rbp
jge 0x14006b19a
jmp 0x14006b0f0
test rbx, rbx
jne 0x14006b19a
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.14000e6b0
nop
mov r8, rax
lea edx, [rbx + 1]
mov rcx, r15
call fcn.140058540
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14006b186
cmp eax, 0xffffffff
je 0x14006b205
lock dec dword [rcx]
jne 0x14006b205
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
or rax, 0xffffffffffffffff
jmp 0x14006b219
mov rax, rbx
jmp 0x14006b219
test rax, rax
je 0x14006b20b
call fcn.14006ae00
test al, al
je 0x14006b20b
mov rcx, qword [rsi + 0x70]
call fcn.1400fd560
test eax, eax
je 0x14006b20b
call fcn.1400fd4f0
mov edx, dword [rax]
lea rcx, [rsp + 0x38]
call fcn.14000e6b0
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.140058540
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x14006b1f7
cmp eax, 0xffffffff
je 0x14006b205
lock dec dword [rcx]
jne 0x14006b205
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
or rax, 0xffffffffffffffff
jmp 0x14006b219
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.14005a150
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006b410
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 2
je 0x14005a862
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14006b410
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp qword [rcx + 0x70], 0
jne 0x14006b519
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14006b519
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x14006b50e
mov edi, r8d
xor r12d, r12d
mov ebx, r12d
lea r13, [0x1414b2564]
mov dword [rsp + 0x80], edi
lea rax, [rsp + 0x80]
cmp edi, 0x2000000
cmovae rax, r13
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x98]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14006b4c4
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x14006b514
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jge 0x14006b514
jmp 0x14006b471
test rbx, rbx
jne 0x14006b514
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.14000e6b0
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r15
call fcn.140058540
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14006b500
cmp eax, 0xffffffff
je 0x14006b50e
lock dec dword [rcx]
jne 0x14006b50e
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
or rax, 0xffffffffffffffff
jmp 0x14006b51e
mov rax, rbx
jmp 0x14006b51e
call fcn.14005a880
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006b830
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140059a10
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp method.QFSFileEngine.virtual_96
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx + 8]
lea rcx, [rsp + 0x30]
call fcn.140058670
nop
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1400590c0
mov rbx, rax
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1400590c0
mov rdi, rax
mov rcx, rbx
call fcn.14001afc0
mov rbx, rax
mov rcx, rdi
call fcn.14001afc0
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x14006b8be
cmp eax, ebx
je 0x14006b8cd
lock dec dword [rcx]
jne 0x14006b8cd
mov rcx, qword [rsp + 0x70]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
nop
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx]
test eax, eax
je 0x14006b8ed
cmp eax, 0xffffffff
je 0x14006b8fc
lock dec dword [rcx]
jne 0x14006b8fc
mov rcx, qword [rsp + 0x80]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x14006b916
cmp eax, 0xffffffff
je 0x14006b925
lock dec dword [rcx]
jne 0x14006b925
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14006b944
cmp eax, 0xffffffff
je 0x14006b952
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
jne 0x14006b952
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
test dil, dil
jne 0x14006b9bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x8c], 2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x88]
call fcn.1400a5ac0
nop
mov r8, rax
mov edx, 0xa
mov rcx, rsi
call fcn.140058540
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14006b9ad
cmp eax, 0xffffffff
je 0x14006b9bb
lock dec dword [rcx]
jne 0x14006b9bb
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
movzx eax, dil
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006bb10
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
mov rdi, qword [rax + 0x78]
cmp rdi, 0xffffffffffffffff
jne 0x14006bc8b
cmp dword [rax + 0x98], edi
jne 0x14006bc5f
cmp qword [rax + 0x70], 0
jne 0x14006bc5f
lea rdi, [rax + 0x20]
mov rcx, rdi
call fcn.140058e40
test al, al
jne 0x14006bce7
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.140058850
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14001c590
nop
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx]
test eax, eax
je 0x14006bbad
cmp eax, 0xffffffff
je 0x14006bbbb
lock dec dword [rcx]
mov rsi, qword [rsp + 0x78]
jne 0x14006bbbb
mov rcx, qword [rsp + 0x80]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
mov dword [rsp + 0x70], 3
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.14001d0d0
test al, al
je 0x14006bc50
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14001dbe0
movzx esi, al
test al, al
jne 0x14006bc3d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.1400303c0
nop
mov r8, rax
mov edx, 0xc
mov rcx, rbx
call fcn.140058540
nop
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx]
test eax, eax
je 0x14006bc2e
cmp eax, 0xffffffff
je 0x14006bc3d
lock dec dword [rcx]
jne 0x14006bc3d
mov rcx, qword [rsp + 0x88]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
nop
lea rcx, [rsp + 0x30]
call fcn.14001c660
movzx eax, sil
jmp 0x14006bce9
lea rcx, [rsp + 0x30]
call fcn.14001c660
jmp 0x14006bce7
cmp rdi, 0xffffffffffffffff
jne 0x14006bc8b
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x14006bc77
call fcn.140100704
mov ecx, eax
jmp 0x14006bc7d
mov ecx, dword [rax + 0x98]
call fcn.1400ff248
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006bce7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov rbp, rax
mov qword [rsp + 0x20], rax
mov r8, qword [rbx]
mov rdx, rsi
mov rcx, rbx
call qword [r8 + 0x38]
test al, al
je 0x14006bcdb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14006bcdb
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
cmp rbp, rsi
cmovge rdx, rcx
mov rdx, qword [rdx]
mov rcx, rbx
call qword [rax + 0x38]
mov al, 1
jmp 0x14006bce9
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, rbx
call qword [rax + 0x38]
xor al, al
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140075f40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
movzx ebx, cl
call fcn.140076800
mov ecx, dword [0x1415b02a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x140076068
test bl, bl
je 0x140076068
lea ecx, [rax + 0x70]
call fcn.1400f95e4
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140075fa3
lea edx, [rsi + 1]
mov rcx, rax
call fcn.1400423d0
mov rsi, rax
jmp 0x140075fa5
xor esi, esi
mov qword [rsp + 0x68], rsi
mov rdx, rsi
mov ecx, dword [0x1415b02a0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov ecx, 0x10
call fcn.1400f95e4
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140075fda
mov rdx, rsi
mov rcx, rax
call fcn.1400422c0
nop
mov qword [rsi + 0x30], rax
mov rcx, rsi
call fcn.140042920
mov byte [rsi + 0x6a], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
mov qword [rsi + 0x38], rax
cmp qword [0x1415b39a8], 0
jne 0x14007600d
mov rax, qword [rsi + 0x30]
mov qword [0x1415b39a8], rax
jmp 0x140076068
mov qword [rsp + 0x68], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsp + 0x68]
call fcn.140076880
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140076800
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp dword [0x1415b02a0], 0xffffffff
jne 0x140076877
mov eax, dword [0x1415b41e8]
lea rbx, [0x1415b41e0]
test al, 1
jne 0x140076849
or eax, 1
mov dword [0x1415b41e8], eax
xor edx, edx
mov rcx, rbx
call fcn.1400414e0
lea rcx, [0x140126ac0]
call fcn.1400f97a0
nop
mov rcx, rbx
call fcn.140041a70
or rbx, 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1415b02a0], eax
test bl, 1
je 0x140076877
and rbx, 0xfffffffffffffffe
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.140041f80
add rsp, 0x30
pop rbx
ret
Function at 0x140076880
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rdi, rcx
lea rbx, [0x1415b41d8]
mov rcx, rbx
call fcn.140041a70
or rbx, 1
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1415b41c0]
jne 0x1400768d3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140076a1b
mov rax, qword [0x1415b02a8]
mov r8d, dword [rax + 8]
btr r8d, 0x1f
mov edx, dword [rax + 4]
lea r10d, [rdx + 1]
cmp r10d, r8d
seta cl
cmp dword [rax], 1
ja 0x1400768f9
test cl, cl
je 0x14007691e
movzx eax, cl
neg al
sbb r9d, r9d
and r9d, 8
test cl, cl
cmovne r8d, r10d
lea rcx, [0x1415b02a8]
call fcn.140075d60
mov rax, qword [0x1415b02a8]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rdi
mov rax, qword [0x1415b02a8]
inc dword [rax + 4]
mov rax, qword [0x1415b02b0]
mov r8d, dword [rax + 8]
btr r8d, 0x1f
mov edx, dword [rax + 4]
lea r10d, [rdx + 1]
cmp r10d, r8d
seta cl
cmp dword [rax], 1
ja 0x14007695e
test cl, cl
je 0x140076983
movzx eax, cl
neg al
sbb r9d, r9d
and r9d, 8
test cl, cl
cmovne r8d, r10d
lea rcx, [0x1415b02b0]
call fcn.140076a40
mov rax, qword [0x1415b02b0]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rsi
mov rax, qword [0x1415b02b0]
inc dword [rax + 4]
cmp dword [0x1415b41c0], 0
jne 0x140076a0d
cmp qword [0x1415b41c8], 0
jne 0x1400769da
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1415b41c8], rax
lea rdx, [0x1415b41c8]
lea rcx, [0x1415b02a8]
call fcn.140076290
lea rax, [0x1415b41c0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140076390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140076a1b
mov rcx, qword [0x1415b41c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
test bl, 1
je 0x140076a2c
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.140041f80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14007da40
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x1415b0b50]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r12d, r12d
movzx r15d, dl
mov r14, rcx
mov dword [rsp + 0x40], 0x18
mov ebp, 0x3e8
lea r13d, [r12 + 8]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
nop
call fcn.14000e640
lea r8, [0x1414b9580]
lea rcx, [rsp + 0x60]
mov r9d, eax
mov edx, 0x100
call fcn.140100b20
mov edi, r12d
mov esi, r12d
test r15b, r15b
je 0x14007dac5
mov ebx, 0x40000002
mov edi, 0x100000
jmp 0x14007dacf
mov ebx, 0x40000001
mov esi, 0x100000
call fcn.14000ee30
mov r8d, r12d
lea rcx, [rsp + 0x60]
cmp eax, 0x80
lea rax, [rsp + 0x40]
mov r9d, 1
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
cmovge r8d, r13d
mov edx, ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14007db3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x14007db28
dec ebp
jne 0x14007da90
lea rdx, [0x1414b95a0]
mov ecx, eax
call fcn.14000ff00
jmp 0x14007dbbb
mov edx, 0x40000000
mov eax, 0x80000100
mov qword [rsp + 0x30], r12
test r15b, r15b
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x60]
cmovne edx, eax
xor r8d, r8d
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007db9b
lea rcx, [0x1414b95c8]
call fcn.140010060
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007dbbb
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test r15b, r15b
je 0x14007dbb4
mov qword [r14], rdi
mov qword [r14 + 8], rbx
jmp 0x14007dbbb
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400fb630
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007dc80
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rax - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, r9
mov rbx, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rax + 0x18]
call fcn.14007ca10
nop
mov dword [rsp + 0x70], 0x68
xor esi, esi
mov qword [rsp + 0x78], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0x8000000080000000
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
mov dword [rsp + 0xb0], esi
mov qword [rsp + 0xb8], rsi
movdqa xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rsi
mov rax, qword [rbx]
cmp dword [rax + 4], esi
jne 0x14007dd22
mov ebx, esi
jmp 0x14007dd2d
mov rcx, rbx
call fcn.14001afc0
mov rbx, rax
lea rcx, [rsp + 0x100]
call fcn.14001afc0
mov rdx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x410
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
test bl, bl
je 0x14007dda0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14007dda0
mov eax, dword [rsp + 0x60]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x100]
mov eax, dword [rcx]
test eax, eax
je 0x14007ddc6
cmp eax, 0xffffffff
je 0x14007ddd4
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
jne 0x14007ddd4
mov rcx, qword [rsp + 0x100]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
movzx eax, bl
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14007f160
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
xor edx, edx
jmp fcn.140042a80
test edx, edx
jne 0x14007f1c9
cmp r8d, 5
ja case.default.0x14007f183
movsxd rax, r8d
lea r8, [0x140000000]
mov edx, dword [r8 + rax*4 + 0x7f1fc]
add rdx, r8
jmp rdx
lea rdx, [0x1414b9930]
xor r9d, r9d
xor r8d, r8d
jmp fcn.140053010
xor r9d, r9d
lea rdx, [0x1414b9930]
lea r8d, [r9 + 1]
jmp fcn.140053010
mov rax, qword [r9 + 8]
mov edx, dword [rax]
jmp fcn.140076c70
mov edx, 7
jmp fcn.140076c70
jmp fcn.140076f90
jmp 0x140042bb0
cmp edx, 0xa
jne case.default.0x14007f183
mov rcx, qword [r9 + 8]
mov rax, qword [r9]
lea rdx, [fcn.14007f320]
cmp qword [rcx], rdx
jne 0x14007f1e7
mov dword [rax], 0
lea rdx, [fcn.14007f220]
cmp qword [rcx], rdx
jne case.default.0x14007f183
mov dword [rax], 1
ret

Function at 0x140086880
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x1415b4240]
test rcx, rcx
jne 0x1400868aa
lea edx, [rcx + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1415b4240], rax
jmp 0x1400868b3
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r10, qword [0x1415b4268]
mov rcx, qword [rbx - 0x10]
lea rax, [rbx - 0x10]
sub r10, rcx
mov r9, rax
sub r9, qword [rax + 8]
mov qword [0x1415b4268], r10
cmp qword [r9], 0
jne 0x1400868ec
add qword [r9 + 0x20], rcx
mov rax, qword [r9 + 0x20]
lea r8, [r9 + 0x20]
mov qword [rax + r9 + 8], rax
jmp 0x14008691a
xor edx, edx
lea r8, [rax + 0x20]
mov r9, rax
mov qword [r8], rcx
mov rcx, qword [0x1415b4260]
mov qword [rax], rdx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdx
test rcx, rcx
je 0x140086913
mov qword [rcx + 0x18], rax
mov qword [0x1415b4260], rax
mov rcx, qword [r8]
cmp qword [rcx + r9], 0
lea rdx, [rcx + r9]
jne 0x140086966
add rcx, qword [rdx + 0x20]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x140086940
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
test rcx, rcx
je 0x140086953
mov qword [rcx + 0x10], rax
jmp 0x14008695a
mov qword [0x1415b4260], rax
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
lea rdx, [rax + r9]
cmp qword [r9 + 8], 0
jne 0x1400869cc
cmp qword [rdx], 1
jne 0x1400869cc
mov rcx, qword [0x1415b4270]
lea rax, [r10 + r10*2]
sub rcx, qword [r8]
shr rax, 1
cmp rcx, rax
jbe 0x1400869cc
mov qword [0x1415b4270], rcx
mov rcx, qword [r9 + 0x10]
test rcx, rcx
je 0x1400869a1
mov rax, qword [r9 + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 0x10]
test rcx, rcx
je 0x1400869b4
mov qword [rcx + 0x10], rax
jmp 0x1400869bb
mov qword [0x1415b4260], rax
xor edx, edx
mov r8d, 0x8000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [0x1415b4240]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ReleaseMutex]
Function at 0x140097b40
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x1415b0b50]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
xor edi, edi
mov dword [rsp + 0x28], edi
lea r9d, [rdi + 0xf]
lea r8, [rsp + 0x38]
lea edx, [rdi + 0x28]
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140097bd1
or r8d, 0xffffffff
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14000e320
nop
mov rdx, rax
mov rcx, rbx
call fcn.140094860
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x140097bc1
cmp eax, 0xffffffff
je 0x140097bdb
lock dec dword [rcx]
jne 0x140097bdb
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011b40
jmp 0x140097bdb
mov dword [rbx + 8], 0x80000000
mov qword [rbx], rdi
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400fb630
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret