joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400971c0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.1400ad180
lea rbp, [0x14012779c]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x1401277a0]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.1400977f0
mov ecx, 0x110
call fcn.1400bae58
mov rbx, rax
test rax, rax
je 0x14009724b
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.1400ad180
test rbx, rbx
je 0x1400973a0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140097377
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1401277a0]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.1400977f0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097322
bt eax, 0xa
jae 0x140097322
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097310
bt eax, 0xa
jae 0x140097310
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097303
test al, 0x10
je 0x140097303
lea rcx, [rsp + 0x170]
call fcn.1400d89e4
jmp 0x140097310
lea rcx, [rsp + 0x170]
call fcn.1400bd7ac
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.1400ad180
cmp byte [rsp + 0x5c], 0
jne 0x140097346
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x140097280
cmp byte [rsp + 0x5c], 0
je 0x14009737e
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1400baf28
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1400baf28
cmp byte [rsp + 0x5c], 0
jne 0x1400973a0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140097394
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400bae44
xor eax, eax
jmp 0x1400973a3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400ab870
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400973d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097428
bt eax, 0xa
jae 0x140097428
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097415
test al, 0x10
je 0x140097415
mov rcx, rbx
call fcn.1400d89e4
jmp 0x14009741d
mov rcx, rbx
call fcn.1400bd7ac
test eax, eax
je 0x140097428
mov ecx, 0x1f
jmp 0x140097437
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d849c
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x60
pop rbx
ret

Function at 0x140097460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400974d6
bt eax, 0xa
jae 0x1400974d6
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400974b8
test al, 0x10
je 0x1400974b8
mov rcx, rdi
call fcn.1400d89e4
jmp 0x1400974c0
mov rcx, rdi
call fcn.1400bd7ac
test eax, eax
je 0x1400974d6
test rbx, rbx
je 0x1400974cf
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x14009757e
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400baf28
lea rdx, [0x140128018]
mov rcx, rsi
call fcn.1400d9d90
test rax, rax
je 0x140097557
mov edx, 0x63
mov rcx, rsi
call fcn.1400ad320
test rax, rax
jne 0x140097557
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400d5428
cmp rax, 0x20
jne 0x14009753b
mov byte [rsp + 0x47], bpl
jmp 0x140097557
mov r9, 0xffffffffffffffff
lea r8, [0x14012801c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400ebfb4
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ec384
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x14009757b
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ab870
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400975a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097613
bt eax, 0xa
jae 0x140097613
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400975fd
test al, 0x10
je 0x1400975fd
mov rcx, rdi
call fcn.1400d89e4
jmp 0x140097605
mov rcx, rdi
call fcn.1400bd7ac
test eax, eax
je 0x140097613
mov eax, 0x1f
jmp 0x140097787
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097657
bt eax, 0xa
jae 0x140097657
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009764b
test al, 0x10
je 0x14009764b
mov rcx, rdi
call fcn.1400d89e4
jmp 0x140097653
mov rcx, rdi
call fcn.1400bd7ac
test eax, eax
jne 0x14009766e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d849c
mov ebx, eax
test eax, eax
je 0x14009777d
test rdi, rdi
jne 0x140097677
xor ebx, ebx
jmp 0x140097687
mov edx, 0x104
mov rcx, rdi
call fcn.1400d5428
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400ad180
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400baf28
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x1400976db
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x1400976db
dec rbx
cmp rbx, 0x104
jae 0x1400977a0
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009771f
bt eax, 0xa
jae 0x14009771f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097711
test al, 0x10
je 0x140097711
lea rcx, [rsp + 0x50]
call fcn.1400d89e4
jmp 0x14009771b
lea rcx, [rsp + 0x50]
call fcn.1400bd7ac
test eax, eax
jne 0x140097734
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d849c
mov ebx, eax
test eax, eax
je 0x14009777d
lea rcx, [rsp + 0x50]
call fcn.1400d8760
mov ebx, eax
test eax, eax
je 0x14009777d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400ad888
mov rdi, rax
test rax, rax
je 0x14009777d
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400975a0
mov ebx, eax
test eax, eax
jne 0x14009777d
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d8760
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x170
pop rdi
ret
call fcn.1400ab9d4
int3
Function at 0x140097870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor dil, dil
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400979f7
test rdx, rdx
je 0x1400979f7
xorps xmm0, xmm0
mov edx, 0x100
mov rcx, rbp
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.14000d0f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140097904
bt eax, 0xa
jae 0x140097904
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400978f4
test al, 0x10
je 0x1400978f4
mov rcx, rbx
call fcn.1400d89e4
jmp 0x1400978fc
mov rcx, rbx
call fcn.1400bd7ac
test eax, eax
jne 0x1400979ef
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d849c
test eax, eax
jne 0x1400979ef
mov ecx, dword [rsp + 0x44]
test ecx, ecx
jle 0x1400979ef
mov eax, 0x1000
mov qword [rsp + 0xb0], rsi
cmp ecx, eax
mov qword [rsp + 0x78], r14
cmovle eax, ecx
movsxd r14, eax
mov rcx, r14
call fcn.1400977b0
mov rsi, rax
test rax, rax
je 0x1400979e2
xor r8d, r8d
mov qword [rsp + 0x70], r15
lea rdx, [0x140127a14]
mov rcx, rbx
call fcn.140097460
mov r15, rax
test rax, rax
je 0x1400979d5
movsxd rdi, dword [rsp + 0x44]
test rdi, rdi
je 0x1400979be
nop dword [rax]
cmp rdi, r14
mov qword [rsp + 0x20], r15
mov rbx, r14
mov r8d, 1
cmovbe rbx, rdi
mov rdx, r14
mov r9, rbx
mov rcx, rsi
call fcn.1400ec6c4
cmp rax, rbx
jne 0x1400979be
mov r8, rax
mov rdx, rsi
mov rcx, rbp
sub rdi, rax
call fcn.14000d1d0
test rdi, rdi
jne 0x140097980
mov rcx, r15
call fcn.1400eced0
mov rcx, r15
call fcn.1400ec884
test rdi, rdi
sete dil
mov rcx, rsi
call fcn.1400bae44
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
mov rcx, rbp
call fcn.14000cf00
movzx eax, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x140097c40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x240
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400ad180
xorps xmm0, xmm0
mov dword [rbx], 9
mov edx, 0x104
lea rcx, [rsp + 0x20]
movups xmmword [rbx + 4], xmm0
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140097d4d
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], r15
lfence
lea ecx, [rax + 1]
lea rsi, [rcx + rcx]
mov r15d, ecx
mov rcx, rsi
call fcn.1400bae58
mov rdi, rax
test rax, rax
je 0x140097ce6
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400ad180
mov rsi, qword [rsp + 0x250]
test rdi, rdi
mov qword [rbx + 4], rdi
mov rdi, qword [rsp + 0x258]
je 0x140097d20
lfence
mov rcx, qword [rbx + 4]
lea r8, [rsp + 0x20]
mov rdx, r15
call fcn.1400f32a8
lea ecx, [r14 + r14]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov r15, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400ab870
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r14
ret
mov rax, rbx
jmp 0x140097d2b
Function at 0x14009ced0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov byte [rsp + 0x2e], 0xd
mov ecx, 0xfffffff6
mov word [rsp + 0x20], bx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x50
pop rbx
ret
Function at 0x14009cfa0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r14
sub rsp, 0xd0
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor eax, eax
mov r12, r8
mov dword [rsp + 0x54], eax
mov rdi, rdx
mov qword [r11 - 0x64], rax
xor ebx, ebx
mov dword [r11 - 0x5c], eax
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov rcx, qword [rdi]
mov rsi, rax
test rcx, rcx
jne 0x14009cfee
mov ecx, ebx
jmp 0x14009cffb
mov edx, 0x1fff
call fcn.1400d56a4
mov rcx, rax
cmp word [rsi], 0x22
lea rax, [rcx + 2]
mov rdx, qword [rdi + 8]
cmovne rax, rcx
lea rcx, [rsi + rax*2]
call fcn.1400aecc0
mov r14, rax
test rax, rax
jne 0x14009d035
lea rdx, str.Unable_to_parse_command_line._n
lea ecx, [rax + 3]
call fcn.1400127d0
mov eax, 0x708
jmp 0x14009d1ec
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x100], rbp
mov qword [rsp + 0x118], r15
test rcx, rcx
jne 0x14009d053
mov rax, rbx
jmp 0x14009d05d
mov edx, 0x1fff
call fcn.1400d56a4
mov edx, 0x1fff
lea r15, [r14 + rax*2]
mov rcx, rsi
call fcn.1400d56a4
mov rcx, qword [rdi + 8]
lea rsi, [rax + 1]
test rcx, rcx
jne 0x14009d080
mov rax, rbx
jmp 0x14009d08a
mov edx, 0x1fff
call fcn.1400d56a4
mov edx, 0x1fff
lea rcx, str.server__i
sub rsi, rax
call fcn.1400d56a4
lea r14, [rax + 2]
add r14, rsi
lea rbp, [r14 + r14]
mov rcx, rbp
call fcn.1400bae58
mov rsi, rax
test rax, rax
je 0x14009d1c6
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1400ad180
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.1400ad180
mov r8, qword [rdi]
mov eax, 0x22
mov rdx, r14
mov word [rsi], ax
mov rcx, rsi
call fcn.1400f345c
lea r8, [0x1401dabec]
mov rdx, r14
mov rcx, rsi
call fcn.1400f345c
lea r8, [0x1401dabf0]
mov rdx, r14
mov rcx, rsi
call fcn.1400f345c
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.1400f345c
mov qword [rsp + 0x48], r12
lea rax, [0x1401d6a98]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x28], 0x8000000
xor ecx, ecx
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x8c], 1
mov qword [rsp + 0x58], rbx
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
mov ecx, 0x3eb
cmove ebx, ecx
mov rcx, rsi
call fcn.1400bae44
mov eax, ebx
jmp 0x14009d1dc
lea rdx, str.Unable_to_allocate_memory._n
mov ecx, 3
call fcn.1400127d0
mov eax, 0x708
mov rbp, qword [rsp + 0x100]
mov r15, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0xd0
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009e070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14009e0c7
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x14009e0c7
call fcn.14009eb60
test eax, eax
je 0x14009e0c7
cmp qword [rbx + 0x270], 0
je 0x14009e0c7
mov rcx, qword [rbx + 0x28]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14009ec50
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14009e3c0
Capabilities:
Connect pipe

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
xor eax, eax
mov rcx, qword [rcx + 0x208]
cmp rcx, 0xffffffffffffffff
je 0x14009e437
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
cmp dword [rdi + 0x214], eax
jne 0x14009e41c
cmp dword [rdi + 0x218], eax
jne 0x14009e44a
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x14009e41c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x217
jne 0x14009e42b
mov ebx, 1
mov dword [rdi + 0x210], 1
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x30
pop rdi
ret
lea rdx, [rdi + 0x278]
mov qword [rdi + 0x278], rax
mov qword [rdi + 0x280], rax
call qword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x14009e421
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x14009e415
mov rcx, qword [rdi + 0x208]
lea r9d, [rbx + 1]
lea r8, [rsp + 0x20]
lea rdx, [rdi + 0x278]
call qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
mov ebx, eax
test eax, eax
jne 0x14009e421
jmp 0x14009e42d
Function at 0x14009eb70
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x14009eba3
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x14009ec2c
test rdx, rdx
jne 0x14009ebb5
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x14009ec2c
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x208]
cmp dword [rbx + 0x218], edi
jne 0x14009ebd6
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
jmp 0x14009ec2c
mov qword [rsp + 0x40], rsi
lea rsi, [rbx + 0x228]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
mov qword [rbx + 0x230], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov edi, eax
test eax, eax
jne 0x14009ec27
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x14009ec25
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
jmp 0x14009ec27
mov eax, edi
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x14009ec50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x14009ec83
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x14009ed0c
test rdx, rdx
jne 0x14009ec95
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x14009ed0c
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x208]
cmp dword [rbx + 0x218], edi
jne 0x14009ecb6
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x14009ed0c
mov qword [rsp + 0x40], rsi
lea rsi, [rbx + 0x250]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
mov qword [rbx + 0x258], rdi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov edi, eax
test eax, eax
jne 0x14009ed07
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x14009ed05
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
jmp 0x14009ed07
mov eax, edi
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x14009ef20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14009ef6f
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009ef6f
bt eax, 0xa
jae 0x14009ef6f
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009ef5f
test al, 0x10
je 0x14009ef5f
mov rcx, rdi
call fcn.1400d89e4
jmp 0x14009ef67
mov rcx, rdi
call fcn.1400bd7ac
test eax, eax
jne 0x14009eff4
mov ecx, 0x18
call fcn.1400bae58
mov rbx, rax
test rax, rax
je 0x14009eff4
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
test rdi, rdi
je 0x14009efbd
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8, rbx
lea rdx, [fcn.14009ef20]
mov ecx, 4
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleExA]
test eax, eax
jne 0x14009efdd
mov qword [rbx], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400a0220
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x230
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov eax, dword [0x14021b698]
mov rdi, rcx
add eax, 0xfffffffd
cmp eax, 1
jbe 0x1400a03e8
xorps xmm0, xmm0
mov qword [rsp + 0x248], rbx
xor eax, eax
lea rcx, [rsp + 0x110]
xor edx, edx
mov dword [rsp + 0x104], eax
mov r8d, 0x104
mov qword [rsp + 0x90], rax
movups xmmword [rsp + 0xa4], xmm0
xor ebx, ebx
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xe4], xmm0
movups xmmword [rsp + 0xf4], xmm0
movups xmmword [rsp + 0x80], xmm0
call fcn.1400ad180
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea r8d, [rbx + 6]
lea rcx, [rsp + 0x110]
call fcn.140013cb0
mov r9, qword [rdi + 8]
lea r8, [rsp + 0x110]
lea rdx, str.__S_s_
lea rcx, [rsp + 0x68]
call fcn.140096f30
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
cmp qword [rsp + 0x54], rbx
je 0x1400a03dc
mov rdx, qword [rsp + 0x54]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0xa0]
mov qword [rdi + 0x10], rbx
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
mov qword [rdi + 0x18], rbx
mov dword [rsp + 0xa0], 0x68
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov ebx, eax
test eax, eax
jne 0x1400a03b5
cmp dword [0x14020e430], 2
jl 0x1400a03d2
test dword [0x14020e47c], 0x10000
je 0x1400a03d2
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsp + 0x30], eax
lea r9, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswin_rsrc_app.c
lea rax, str.Unable_to_start_capture_program._Error___d
mov ecx, 0x10000
mov qword [rsp + 0x28], rax
lea r8, str.rsrc_app_start_app_in_current_session
lea edx, [rbx + 2]
mov dword [rsp + 0x20], 0x27c
call fcn.140078130
jmp 0x1400a03d2
mov rax, qword [rsp + 0x80]
mov ebx, 1
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x18], rax
mov rcx, qword [rsp + 0x54]
call fcn.1400bae44
mov eax, ebx
mov rbx, qword [rsp + 0x248]
jmp 0x1400a03ed
call fcn.1400a0410
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x230
pop rdi
ret