joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062010
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov r9, rdx
xor r10d, r10d
movabs rax, 0xaaaaaaaaaaaaaaab
mov rbx, rcx
lea rsi, [0x1401c5ba0]
mov r11, r10
mul rdx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
test rdx, rdx
je 0x1400620dc
mov qword [rsp + 0x30], rdi
lea r11, [rdx*4]
lea rdi, [r8 + 4]
nop
movzx eax, byte [rbx + r10]
add rdi, 8
add r10, 3
shr rax, 2
movzx eax, word [rsi + rax*2]
mov word [rdi - 0xc], ax
movzx eax, byte [rbx + r10 - 3]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [rbx + r10 - 2]
shr eax, 4
or rcx, rax
movzx eax, word [rsi + rcx*2]
mov word [rdi - 0xa], ax
movzx eax, byte [rbx + r10 - 2]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
movzx eax, byte [rbx + r10 - 1]
shr rax, 6
or rcx, rax
movzx eax, word [rsi + rcx*2]
mov word [rdi - 8], ax
movzx eax, byte [rbx + r10 - 1]
and eax, 0x3f
sub rdx, 1
movzx eax, word [rsi + rax*2]
mov word [rdi - 6], ax
jne 0x140062060
mov rdi, qword [rsp + 0x30]
sub r9, 1
je 0x140062141
cmp r9, 1
jne 0x14006217b
movzx eax, byte [r10 + rbx]
shr rax, 2
movzx eax, word [rsi + rax*2]
mov word [r8 + r11*2], ax
movzx eax, byte [r10 + rbx]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [r10 + rbx + 1]
shr rax, 4
or rcx, rax
movzx eax, word [rsi + rcx*2]
mov word [r8 + r11*2 + 2], ax
movzx eax, byte [r10 + rbx + 1]
and eax, 0xf
shl eax, 2
cdqe
movzx eax, word [rsi + rax*2]
mov word [r8 + r11*2 + 4], ax
lea eax, [r9 + 0x3c]
jmp 0x140062175
movzx eax, byte [r10 + rbx]
shr rax, 2
movzx eax, word [rsi + rax*2]
mov word [r8 + r11*2], ax
movzx eax, byte [r10 + rbx]
and eax, 3
shl eax, 4
cdqe
movzx eax, word [rsi + rax*2]
mov word [r8 + r11*2 + 2], ax
mov eax, 0x3d
mov word [r8 + r11*2 + 4], ax
mov word [r8 + r11*2 + 6], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rsi
ret
Function at 0x1400621a0
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x1400621ce
nop dword [rax]
cmp byte [rcx + r9 - 1], 0x3d
jne 0x1400621ce
sub r9, 1
jne 0x1400621c0
mov rbx, r9
xor r11d, r11d
and r9d, 3
shr rbx, 2
mov r8, r11
lea rsi, [0x1401c5c20]
test rbx, rbx
je 0x140062266
nop dword [rax + rax]
movsx rax, byte [r10 + r8]
add r11, 3
add r8, 4
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 3]
movzx ecx, byte [rax + rsi]
shl dl, 2
sar cl, 4
and cl, 3
or dl, cl
mov byte [rdi + r11 - 3], dl
movsx rax, byte [r10 + r8 - 2]
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 3]
movzx ecx, byte [rax + rsi]
sar dl, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [rdi + r11 - 2], dl
movsx rax, byte [r10 + r8 - 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 2]
movzx ecx, byte [rax + rsi]
and dl, 0x3f
shl cl, 6
or dl, cl
sub rbx, 1
mov byte [rdi + r11 - 1], dl
jne 0x1400621f0
sub r9, 2
je 0x1400622ba
cmp r9, 1
jne 0x1400622dc
movsx rax, byte [r8 + r10 + 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10]
movzx ecx, byte [rax + rsi]
sar dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [r11 + rdi], dl
movsx rax, byte [r8 + r10 + 2]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10 + 1]
movzx ecx, byte [rax + rsi]
sar dl, 2
shl cl, 4
and dl, 0xf
or dl, cl
mov byte [r11 + rdi + 1], dl
jmp 0x1400622dc
movsx rax, byte [r8 + r10 + 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10]
movzx ecx, byte [rax + rsi]
sar dl, 4
shl cl, 2
and dl, 3
or dl, cl
mov byte [r11 + rdi], dl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140062300
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x140062332
lea rax, [rcx + rdx*2 - 2]
cmp word [rax], 0x3d
jne 0x140062332
sub rax, 2
sub r9, 1
jne 0x140062322
mov r8, r9
xor ebx, ebx
and r9d, 3
shr r8, 2
mov r11, rbx
lea rbp, [0x1401c5d20]
test r8, r8
je 0x1400623e2
mov qword [rsp + 0x30], rsi
lea r11, [r8*4]
lea rsi, [rcx + 2]
nop word [rax + rax]
movzx eax, word [rsi]
add rbx, 3
add rsi, 8
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 0xa]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [rdi + rbx - 3], dl
movzx eax, word [rsi - 6]
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 8]
movzx ecx, byte [rbp + rax*2]
shr dl, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [rdi + rbx - 2], dl
movzx eax, word [rsi - 4]
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 6]
movzx ecx, byte [rbp + rax*2]
and dl, 0x3f
shl cl, 6
or dl, cl
sub r8, 1
mov byte [rdi + rbx - 1], dl
jne 0x140062370
mov rsi, qword [rsp + 0x30]
sub r9, 2
je 0x140062438
cmp r9, 1
jne 0x14006245b
movzx eax, word [r10 + r11*2 + 2]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [rbx + rdi], dl
movzx eax, word [r10 + r11*2 + 4]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2 + 2]
movzx ecx, byte [rbp + rax*2]
shr dl, 2
shl cl, 4
and dl, 0xf
or dl, cl
mov byte [rbx + rdi + 1], dl
jmp 0x14006245b
movzx eax, word [r10 + r11*2 + 2]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
shl cl, 2
and dl, 3
or dl, cl
mov byte [rbx + rdi], dl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140062ec0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x4c0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rsi, rdx
mov dword [rsp + 0x24], 0x78
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax]
nop
lea r13, vtable.SpeedBit::Utils::StackBufferEx_1024_.0
mov qword [rsp + 0x90], r13
xor ebx, ebx
mov qword [rsp + 0x498], rbx
mov qword [rsp + 0x4a0], rbx
lea rdx, [rsp + 0x20]
mov edi, 1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140062f6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401cecd0]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x40]
call sub.MSVCR90.dll__CxxThrowException
lea edx, [rax + 1]
add rdx, rdx
lea rcx, [rsp + 0x90]
mov rax, qword [rsp + 0x90]
call qword [rax + 0x18]
lea rcx, [rsp + 0x90]
mov rax, qword [rsp + 0x90]
call qword [rax + 0x30]
test eax, eax
je 0x140062fcf
mov dword [rsp + 0x30], 8
lea rax, str.Utils::StackBufferEx::resize
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x50]
call sub.MSVCR90.dll__CxxThrowException
lea rcx, [rsp + 0x90]
mov rax, qword [rsp + 0x90]
call qword [rax + 0x10]
mov r12, rax
lea rcx, [rsp + 0x90]
mov rdx, qword [rsp + 0x90]
call qword [rdx + 0x38]
mov rdx, r12
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r12d, eax
test eax, eax
jne 0x14006303c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401cecd0]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
lea rcx, [rsp + 0x90]
mov rax, qword [rsp + 0x90]
call qword [rax + 0x10]
mov r9, qword [rsi]
mov r8, r12
mov rdx, rax
mov rcx, rsi
call qword [r9 + 0x10]
nop
mov qword [rsp + 0x90], r13
lea rax, [rsp + 0x98]
mov rcx, qword [rsp + 0x498]
cmp rcx, rax
je 0x140063089
test rcx, rcx
je 0x140063089
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x140063093
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140155650
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400630d0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x4f0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rdi, r9
mov r12d, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 0x78
mov rax, qword [r9]
mov rcx, r9
call qword [rax]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rax, vtable.SpeedBit::Utils::Std::StringValueW_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140062ec0
nop
test eax, eax
jne 0x140063183
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str.Utils::FileSystem::GetTempPathW
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x50]
call sub.MSVCR90.dll__CxxThrowException
lea r13, vtable.SpeedBit::Utils::StackBufferEx_1040_.0
mov qword [rsp + 0xb0], r13
xor ebx, ebx
mov qword [rsp + 0x4c8], rbx
mov qword [rsp + 0x4d0], rbx
mov edx, 0x208
lea rcx, [rsp + 0xb0]
call qword [0x1401cefa0]
lea rcx, [rsp + 0xb0]
mov rax, qword [rsp + 0xb0]
call qword [rax + 0x10]
lea rcx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rcx, qword [rsp + 0x88]
mov r9, rax
mov r8d, r12d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140063229
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401ced30]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll__CxxThrowException
lea rcx, [rsp + 0xb0]
mov rax, qword [rsp + 0xb0]
call qword [rax + 0x10]
mov r8, qword [rdi]
mov rdx, rax
mov rcx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov dword [rsp + 0x20], ebx
mov edi, 1
mov qword [rsp + 0xb0], r13
lea rax, [rsp + 0xb8]
mov rcx, qword [rsp + 0x4c8]
cmp rcx, rax
je 0x14006327a
test rcx, rcx
je 0x14006327a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x4c8], rbx
mov qword [rsp + 0x4d0], rbx
lea rax, vtable.SpeedBit::Utils::BaseBuffer.0
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
jmp 0x1400632b2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140155650
add rsp, 0x4f0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400632e0
Capabilities:
Read file on windows

Disassembly:
push rdi
push r12
push r13
mov eax, 0x11d0
call fcn.140156450
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x11f0], rbx
mov qword [rsp + 0x1208], rsi
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x11c0], rax
mov rbx, r8
mov r13, rdx
lea rdx, str._Utils::FileSystem::ReadContent_
mov qword [rsp + 0x40], rdx
xor esi, esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], 0x78
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.140001d10
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov dword [rsp + 0x38], esi
mov r12, rsi
nop word [rax + rax]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov r8d, 0x1000
lea rdx, [rsp + 0x1c0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14006340f
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14006341b
mov rdx, rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
jne 0x1400633e3
mov dword [rsp + 0x50], 8
lea rax, str.Utils::BaseBuffer::grow
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8d, dword [rsp + 0x38]
lea rcx, [rax + r12]
lea rdx, [rsp + 0x1c0]
call sub.MSVCR90.dll_memcpy
mov r11d, dword [rsp + 0x38]
add r12, r11
jmp 0x140063370
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, dword [rsp + 0x30]
mov dword [rsp + 0x34], esi
jmp 0x140063425
lea rcx, [rsp + 0x80]
call fcn.140001e50
nop
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x11c0]
xor rcx, rsp
call fcn.140155650
lea r11, [rsp + 0x11d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140063470
Capabilities:
Clear file content
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x1e0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov rbx, r9
mov r13, r8
mov r12, rdx
lea rdx, str._Utils::FileSystem::WriteContent_
mov qword [rsp + 0x58], rdx
xor esi, esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], 0x78
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.140001d10
nop
test r13, r13
je 0x1400635b1
test rbx, rbx
je 0x1400635b1
mov dword [rsp + 0x38], esi
mov rdi, rsi
mov eax, dword [rsp + 0x30]
test ebx, ebx
je 0x140063527
lea rdx, [r13 + rdi]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14006352b
mov edx, dword [rsp + 0x38]
add rdi, rdx
sub ebx, edx
jmp 0x1400634f5
test eax, eax
jne 0x140063563
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401cee28]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x90]
call sub.MSVCR90.dll__CxxThrowException
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x1400635a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401cee40]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll__CxxThrowException
cmp dword [rsp + 0x30], 0
jne 0x1400635f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400635f0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400635f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401cee68]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x34], esi
mov ebx, 1
mov dword [rsp + 0x30], ebx
jmp 0x140063603
lea rcx, [rsp + 0xa0]
call fcn.140001e50
nop
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.140155650
add rsp, 0x1e0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006a410
Capabilities:
Create pipe

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
mov r15, r9
mov r14, r8
mov r13, rdx
mov dword [rsp + 0x48], 0x78
mov dword [r11 - 0x68], 0x18
mov r12d, 1
mov dword [r11 - 0x58], r12d
xor esi, esi
mov qword [r11 - 0x60], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
xor r9d, r9d
lea r8, [r11 - 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14006a4ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
lea rax, [0x1401d0110]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0xa0], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0xa0]
call sub.MSVCR90.dll__CxxThrowException
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14006a4e4
cmp rcx, 0xffffffffffffffff
je 0x14006a4e4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], rsi
mov rdi, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x40]
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14006a55e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
lea rax, [0x1401d0128]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x80], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x80]
call sub.MSVCR90.dll__CxxThrowException
xor r8d, r8d
mov edx, r12d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x14006a5ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
lea rax, [0x1401d0148]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x90]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rsp + 0x58]
mov qword [r13], rax
mov rax, qword [rsp + 0x50]
mov qword [r14], rax
mov rax, qword [rsp + 0x40]
mov qword [r15], rax
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
jmp 0x14006a5e2
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r12d
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.140155650
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006a610
Capabilities:
Create pipe

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x1e0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov r12, r8
mov rsi, rdx
mov dword [rsp + 0x20], 0x78
mov dword [r11 - 0x48], 0x18
mov edi, 1
mov dword [r11 - 0x38], edi
xor ebx, ebx
mov qword [r11 - 0x40], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
lea r8, [r11 - 0x48]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14006a6bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401d0110]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x80], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x80]
call sub.MSVCR90.dll__CxxThrowException
xor r8d, r8d
mov edx, edi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x14006a705
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401d0148]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rsp + 0x28]
mov qword [rsi], rax
mov rax, qword [rsp + 0x30]
mov qword [r12], rax
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbx
jmp 0x14006a72e
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x200]
add rsp, 0x1e0
pop r12
pop rdi
pop rsi
ret
Function at 0x14006d7a0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
mov rdx, rbx
lea rcx, [rsp + 0x28]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14006d840
test al, al
je 0x14006d80f
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140155650
add rsp, 0x90
pop rbx
ret
Function at 0x14006d840
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x370
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x390], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x140], rcx
lea rdx, [rsp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14006d8a1
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14006d951
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int____ptr64]
nop
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140002150
mov rcx, rax
lea rdx, [0x1401b8374]
call fcn.140002150
mov rcx, rax
lea rdx, [0x1401d09f0]
call fcn.140002150
mov rcx, rax
lea rdx, str._cache_
call fcn.140002150
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP90.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::operator___wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64_]
mov rcx, rax
lea rdx, str..cache
call fcn.140002150
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void____ptr64]
nop
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x390]
add rsp, 0x370
pop rdi
ret