joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b930
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
movzx esi, cx
mov r15, r8
mov ecx, esi
xor r8d, r8d
mov r12d, r9d
mov ebp, edx
call qword [sym.imp.WS2_32.dll_socket]
mov r14, qword [rsp + 0x78]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x14002b98c
mov r8d, esi
lea rdx, str.PollSocketPairConnecting
lea rcx, str._s:_Could_not_create_socket__socket_family:__d._n
call fcn.14001bf60
mov rax, 0xffffffffffffffff
jmp 0x14002bb0b
xor r8d, r8d
mov edx, ebp
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002b9e7
mov rbx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, esi
mov qword [r14], 0xffffffffffffffff
lea rdx, str.PollSocketPairConnecting
lea rcx, str._s:_Could_not_create_second_socket__socket_family:__d._n
call fcn.14001bf60
mov rax, 0xffffffffffffffff
jmp 0x14002bb0b
mov r8d, r12d
mov dword [rsp + 0x78], r12d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14002ba09
lea rcx, str._s:_Could_not_bind_socket._n
jmp 0x14002ba76
movzx ebx, byte [rsp + 0x70]
test bl, bl
jne 0x14002ba3b
mov rcx, qword [r14]
lea r8, [rsp + 0x50]
mov edx, 0x8004667e
mov dword [rsp + 0x50], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x14002ba3b
lea rcx, str._s:_Could_not_make_socket_non_blocking._n
jmp 0x14002ba76
cmp ebp, 1
jne 0x14002ba59
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x14002ba59
lea rcx, str._s:_Could_not_listen_on_a_socket._n
jmp 0x14002ba76
lea r8, [rsp + 0x78]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x14002ba8b
lea rcx, str._s:_getsockname___failed._n
lea rdx, str.PollSocketPairPrepare
call fcn.14001bf60
lea rcx, str._s:_Could_not_prepare_the_socket_pair_for_the_following_connecting___________socket_type:__d_n
jmp 0x14002bad7
mov rcx, qword [r14]
mov r8d, r12d
mov rdx, r15
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14002bab9
test bl, bl
jne 0x14002bab0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14002bb08
lea rcx, str._s:_Could_not_connect_to_a_local_socket._n
jmp 0x14002bac4
test bl, bl
jne 0x14002bb08
lea rcx, str._s:_non_blocking_socket_connected_immediately__n
lea rdx, str.PollSocketPairConnect
call fcn.14001bf60
lea rcx, str._s:_Could_not_make_socket_pair_connected__socket_type:__d
mov r8d, esi
lea rdx, str.PollSocketPairConnecting
call fcn.14001bf60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, 0xffffffffffffffff
jmp 0x14002bb0b
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14002eb60
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd r9, r8d
xor edi, edi
mov r8, qword [0x1401052c8]
mov rbx, r9
shl rbx, 4
mov rbp, rcx
add rbx, r8
mov r11d, edi
mov r10d, edi
movsxd rsi, dword [r8 + r9*4 + 0xc]
test esi, esi
jle 0x14002ebb8
mov r9d, dword [rdx + 0x58]
mov ecx, edi
mov rax, qword [rbx + rcx*8 + 0x28]
cmp dword [rax + 0x18], r9d
je 0x14002ebb8
inc r10d
inc rcx
cmp rcx, rsi
jl 0x14002eba2
cmp r10d, esi
jl 0x14002ebd1
mov edx, dword [rdx + 0x58]
lea rcx, str.Could_not_find_socket_thread_of_type__d_
call fcn.14001bf60
jmp 0x14002ecc3
lfence
movsxd rax, r10d
mov r8, qword [rbx + rax*8 + 0x28]
mov rax, qword [r8 + 0x10]
test rax, rax
je 0x14002ec02
mov rcx, qword [rdx + 0x48]
nop dword [rax]
cmp qword [rax + 0x10], rcx
je 0x14002ec02
mov r11, rax
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x14002ebf0
cmp qword [rax], rdx
jne 0x14002ec53
dec dword [rdx + 8]
cmp dword [rdx + 8], edi
jg 0x14002ec1d
mov rcx, qword [rbp + 0x20]
mov qword [rdx], rcx
mov qword [rbp + 0x20], rdx
mov rdx, rdi
dec dword [rax + 0x18]
cmp dword [rax + 0x18], edi
jg 0x14002ec50
mov rcx, qword [rax + 0x20]
cmp rax, qword [r8 + 0x10]
jne 0x14002ec35
mov qword [r8 + 0x10], rcx
jmp 0x14002ec39
mov qword [r11 + 0x20], rcx
mov rdx, qword [0x1401052c8]
mov rcx, qword [rdx]
mov qword [rax + 0x20], rcx
mov qword [rdx], rax
dec dword [r8 + 0x24]
jmp 0x14002ec78
mov qword [rax], rdi
cmp qword [rax + 8], rdx
jne 0x14002ec78
dec dword [rdx + 8]
cmp dword [rdx + 8], edi
jg 0x14002ec6c
mov rcx, qword [rbp + 0x20]
mov qword [rdx], rcx
mov qword [rbp + 0x20], rdx
dec dword [rax + 0x18]
cmp dword [rax + 0x18], edi
jle 0x14002ec25
mov qword [rax + 8], rdi
movsxd rsi, dword [r8 + 0x2c]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov byte [r8 + 0x1c], 1
mov rcx, rsi
mov byte [rsp + 0x40], 1
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp eax, 1
je 0x14002ecc3
cmp eax, 0xffffffff
jne 0x14002ecaf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov r9d, edi
lea rcx, str.POLL_could_not_signal_socket_thread__fd__d__ret__d__err__d__n
mov r8d, ebx
mov edx, esi
call fcn.14001bf60
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14002ece0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor r9d, r9d
movsxd rdi, ecx
mov rcx, rdi
mov byte [rsp + 0x30], 1
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp eax, 1
je 0x14002ed2f
xor eax, eax
cmp ebx, 0xffffffff
jne 0x14002ed1b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea rcx, str.POLL_could_not_signal_socket_thread__fd__d__ret__d__err__d__n
mov r8d, ebx
mov edx, edi
call fcn.14001bf60
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003e170
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov qword [rsp + 0x68], 0
xor ebx, ebx
mov qword [rsp + 0x60], 0
xor edi, edi
call fcn.1400302e0
mov rdx, rax
mov r9d, 0x20219
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003e255
mov ecx, 0x208
mov dword [rsp + 0x50], 0x208
call fcn.140020af0
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x58]
mov rdi, rax
lea rdx, str.AppDataPath
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x14003e255
mov edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.140020b20
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x58]
mov rdi, rax
lea rdx, str.AppDataPath
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003e255
mov edx, dword [rsp + 0x50]
lea r8d, [rbx + 1]
mov rcx, rdi
call fcn.140042490
mov qword [rsp + 0x60], rax
jmp 0x14003e25a
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14003e284
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8023
xor ecx, ecx
call fcn.140024ff0
test eax, eax
js 0x14003e2b7
mov rax, qword [rsp + 0x60]
xor r9d, r9d
lea r8, str.VMware
lea rdx, [0x140083cd8]
mov rcx, rax
call fcn.140042b80
mov rcx, rax
mov rbx, rax
call fcn.140017670
test al, al
jne 0x14003e2b7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003e2db
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14003e4b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor esi, esi
lea rdx, [0x1400836ec]
mov r13d, esi
mov r15d, esi
mov r12d, esi
mov ebp, esi
mov rbx, rcx
xor r14b, r14b
call fcn.1400209f0
test al, al
jne 0x14003e551
cmp byte [rbx], 0x25
je 0x14003e551
mov qword [rsp + 0x28], 0xffffffffffffffff
lea r9, [0x1400851c4]
xor edx, edx
mov qword [rsp + 0x20], rsi
lea r8, [rsi - 1]
mov rcx, rbx
call fcn.1400429f0
cmp rax, 1
je 0x14003e551
call fcn.140024c10
mov rdi, rax
test rax, rax
je 0x14003e605
xor r9d, r9d
lea rdx, [0x140083cd8]
mov r8, rbx
mov rcx, rax
call fcn.140042b80
mov rcx, rdi
mov r13, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14003e55c
mov rcx, rbx
call fcn.140042340
mov r13, rax
mov edx, 1
mov rcx, r13
call fcn.140042350
mov ecx, 0x208
mov r12, rax
mov edi, 0x104
call fcn.140020af0
mov r8d, edi
mov rdx, rax
mov rcx, r12
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
nop
mov rcx, rbp
cmp ebx, edi
jb 0x14003e5df
mov edi, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
add rcx, rcx
call fcn.140020af0
mov r8d, ebx
mov rdx, rax
mov rcx, r12
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test edi, edi
jne 0x14003e590
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.W32Util_RealPath
lea rcx, str._s:_ExpandEnvironmentStringsW_failed:__d_n
call fcn.14001bf60
jmp 0x14003e605
mov ebx, 1
mov r8d, ebx
lea rdx, [rbx - 2]
call fcn.140042490
mov rcx, rax
mov r15, rax
call fcn.1400176f0
test al, al
movzx r14d, r14b
cmovne r14d, ebx
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r12
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rbp
mov dword [rax], edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r14b, r14b
jne 0x14003e651
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r14b, r14b
mov rbx, qword [rsp + 0x60]
cmovne rsi, r15
mov rbp, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400412c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400468f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140105dc0]
test rax, rax
jne 0x1400469eb
mov qword [rsp + 0x30], rbx
lea rcx, str.ICU_DATA
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
je 0x140046997
cmp byte [rax], 0
je 0x140046997
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x140046930
add eax, 2
movsxd rcx, eax
call fcn.1400477d0
mov rdi, rax
test rax, rax
je 0x1400469da
mov rcx, rax
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140046960
mov edx, 0x2f
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14004699e
mov edx, 0x2f
mov byte [rax], 0x5c
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x140046980
jmp 0x14004699e
lea rdi, [0x14007c3c5]
xor ecx, ecx
call fcn.14004ee30
mov rcx, qword [0x140105dc0]
test rcx, rcx
je 0x1400469bb
cmp byte [rcx], 0
je 0x1400469bb
call fcn.140047790
lea rdx, [0x140046860]
mov qword [0x140105dc0], rdi
mov ecx, reloc.WS2_32.dll_send
call fcn.14004fa60
xor ecx, ecx
call fcn.14004ef50
mov rax, qword [0x140105dc0]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x14004fa80
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
xor r14d, r14d
mov rdi, rdx
mov ebx, r14d
mov rsi, rcx
call fcn.14004f000
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 1]
mov dword [rsp + 0x28], 0x10000080
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14004fb00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
lea rcx, [0x1400a5b28]
mov r8d, eax
call fcn.14001bf60
xor al, al
jmp 0x14004fbe0
mov edx, 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x14004fb4a
xor r9d, r9d
lea rcx, [rsp + 0x58]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x14004fb4a
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], 0x18
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov dword [rsp + 0x20], r14d
mov rcx, rbp
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
jne 0x14004fb94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
lea rcx, str.uprv_mapFile:_CreateFileMapping_failed_for__s___d__n
mov r8d, eax
call fcn.14001bf60
xor al, al
jmp 0x14004fbe0
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
test rax, rax
jne 0x14004fbda
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
lea rcx, str.uprv_mapFile:_MapViewOfFile_failed_for__s___d__n
mov r8d, eax
call fcn.14001bf60
xor al, al
jmp 0x14004fbe0
mov qword [rsi + 0x28], rbx
mov al, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400692c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
add r8d, edx
mov r11, rcx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x1400693f3
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add rdi, rax
nop dword [rax]
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
add r9d, r10d
shl ecx, 8
add edx, r8d
add ecx, eax
movzx eax, byte [r11 + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 0xa]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 + 3]
shl ecx, 8
mov r8d, edx
add ecx, eax
rol r8d, 4
movzx eax, byte [r11 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11]
shl ecx, 8
add r11, 0xc
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
ror r10d, 0xd
add ebx, ecx
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
rol r8d, 4
add r10d, ebx
xor r8d, ecx
sub rsi, 1
jne 0x140069310
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja 0x14006947c
lea rcx, [0x140000000]
mov eax, dword [rcx + rdi*4 + 0x694dc]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
rol eax, 0xb
xor edx, ebx
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
rol eax, 4
xor ecx, edx
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov eax, r8d
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x14006ca30
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rdx, [rcx + 0xc8]
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14006cab6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x217
je 0x14006caba
cmp eax, 0x3e5
je 0x14006caba
mov rcx, rdi
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
mov edx, esi
lea rcx, str.ConnectNamedPipe_failed._Error:__d_n
call fcn.14001dba0
mov eax, listen
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov esi, dword [rsp + 0x50]
mov rcx, rdi
call fcn.14006b6d0
mov rcx, rdi
mov rbx, rax
call fcn.14006b6d0
lea r8, [0x14006c3b0]
mov rcx, rax
mov rax, qword [rbx + 8]
mov r9, rdi
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx + 0x10]
cmp esi, 0x3e5
jne 0x14006cb0a
mov rax, qword [rdi + 0xe0]
mov edx, 4
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
jmp 0x14006cb1d
mov qword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], 1
call fcn.14002bc50
mov rcx, rdi
test eax, eax
je 0x14006cb6a
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
lea rcx, str.Could_not_register_accept_callback__n
call fcn.14001dba0
mov eax, 8
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor edx, edx
call fcn.14006b900
mov rbx, qword [rsp + 0x58]
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14006ccb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rsi, [rcx + 0xc8]
mov rdi, rcx
mov rcx, qword [rcx + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x14006cd7c
mov rcx, rdi
call fcn.14006b6d0
mov rcx, rdi
mov rbx, rax
call fcn.14006b6d0
mov rcx, qword [rbx + 8]
lea r8, [0x14006cb90]
mov qword [rsp + 0x30], rcx
mov r9, rdi
mov qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rax + 0x10]
mov dword [rsp + 0x20], 1
call fcn.14002bc50
test eax, eax
je 0x14006ce42
mov rcx, rdi
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
lea rcx, str.could_not_register_rtime_recv_callback__n
call fcn.14001dba0
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp eax, 0x3e5
je 0x14006cdb5
cmp eax, 0x6d
jne 0x14006cd9d
mov eax, 4
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi + 0x70], eax
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call fcn.14006b6d0
mov rcx, rdi
mov rbx, rax
call fcn.14006b6d0
mov rcx, qword [rbx + 8]
lea r8, [0x14006cb90]
mov qword [rsp + 0x30], rcx
mov r9, rdi
mov rcx, qword [rsi + 0x18]
mov edx, 4
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax + 0x10]
mov dword [rsp + 0x20], 2
call fcn.14002bc50
test eax, eax
je 0x14006ce42
mov rcx, rdi
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
lea rcx, str.could_not_register_recv_callback__n
call fcn.14001dba0
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov byte [rdi + 0x9f], 1
add rsp, 0x40
pop rdi
ret
Function at 0x14006cfe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov esi, r8d
lea r15, [rcx + 0xe8]
mov r14, rdx
mov rdi, rcx
call fcn.14006b6e0
cmp al, 2
je 0x14006d04c
mov rcx, rdi
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
lea rdx, str.AsyncNamedPipeSendInternal
lea rcx, str._s:_Socket_closed_n
call fcn.14001dba0
mov eax, 9
jmp 0x14006d239
cmp byte [rdi + 0x9c], 0
mov qword [rsp + 0x68], rbp
jne 0x14006d232
mov rcx, qword [rdi + 0xc0]
lea r9, [rsp + 0x60]
mov r8d, esi
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebx, ebx
je 0x14006d151
movsxd rax, dword [rsp + 0x60]
add dword [rdi + 0x98], eax
cmp eax, esi
jge 0x14006d0b2
sub esi, eax
lea rdx, [r14 + rax]
mov r8d, esi
mov rcx, rdi
call fcn.14006cfe0
jmp 0x14006d234
cmp byte [rdi + 0x9d], 0
jne 0x14006d232
mov rcx, rdi
call fcn.14006b6d0
mov rcx, rdi
mov rbx, rax
call fcn.14006b6d0
mov rcx, qword [rbx + 8]
lea r8, [fcn.14006c990]
mov qword [rsp + 0x30], rcx
mov r9, rdi
mov qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rax + 0x10]
mov dword [rsp + 0x20], 1
call fcn.14002bc50
test eax, eax
je 0x14006d145
mov rcx, rdi
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
lea rdx, str.AsyncNamedPipeSendInternal
lea rcx, str._s:_Could_not_register_rtime_send_callback__n
call fcn.14001dba0
mov eax, 8
jmp 0x14006d234
mov byte [rdi + 0x9d], 1
jmp 0x14006d232
mov rcx, rdi
cmp ebp, 0x3e5
jne 0x14006d1ec
call fcn.14006b6d0
mov rcx, rdi
mov rbx, rax
call fcn.14006b6d0
mov rcx, qword [rbx + 8]
lea r8, [0x14006ce60]
mov qword [rsp + 0x30], rcx
mov r9, rdi
mov rcx, qword [r15 + 0x18]
mov edx, 4
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax + 0x10]
mov dword [rsp + 0x20], 2
call fcn.14002bc50
test eax, eax
je 0x14006d1e3
mov rcx, rdi
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
lea rdx, str.AsyncNamedPipeSendInternal
lea rcx, str._s:_Could_not_register_send_callback__n
call fcn.14001dba0
mov eax, 8
jmp 0x14006d234
mov byte [rdi + 0x9c], 1
jmp 0x14006d232
mov dword [rdi + 0x70], ebp
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
mov r8d, ebp
lea rdx, str.AsyncNamedPipeSendInternal
lea rcx, str._s:_Write_error:__d._n
call fcn.14001dba0
mov edx, 1
mov rcx, rdi
call fcn.14006b6f0
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret