joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e9e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm2, xmmword [rcx]
vmovdqu xmm0, xmmword [rcx + 0x10]
mov rax, qword [rsp + 0x28]
vperm2i128 ymm1, ymm2, ymm2, 0
vpslldq xmm5, xmm2, 4
vaeskeygenassist xmm4, xmm0, 1
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rdx], ymm1
vperm2i128 ymm1, ymm0, ymm0, 0
vmovdqu ymmword [r8], ymm1
vpslldq xmm1, xmm5, 4
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm0, 4
vpxor xmm1, xmm1, xmm3
vpxor xmm1, xmm1, xmm2
vpslldq xmm2, xmm5, 4
vaeskeygenassist xmm4, xmm1, 0
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm1, 4
vpxor xmm3, xmm3, xmm4
vpxor xmm2, xmm2, xmm3
vpxor xmm2, xmm2, xmm0
vperm2i128 ymm0, ymm1, ymm1, 0
vmovdqu ymmword [r9], ymm0
vperm2i128 ymm0, ymm2, ymm2, 0
vaeskeygenassist xmm4, xmm2, 2
vmovdqu ymmword [rax], ymm0
vpslldq xmm0, xmm5, 4
vpshufd xmm4, xmm4, 0xff
mov rax, qword [rsp + 0x30]
vpslldq xmm3, xmm0, 4
vpxor xmm0, xmm0, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm2, 4
vpxor xmm0, xmm0, xmm3
vpxor xmm0, xmm0, xmm1
vpslldq xmm1, xmm5, 4
vaeskeygenassist xmm4, xmm0, 0
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm0, 4
vpxor xmm3, xmm3, xmm4
vpxor xmm1, xmm1, xmm3
vpxor xmm1, xmm1, xmm2
vperm2i128 ymm2, ymm0, ymm0, 0
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x38]
vperm2i128 ymm2, ymm1, ymm1, 0
vaeskeygenassist xmm4, xmm1, 4
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rax], ymm2
vpslldq xmm2, xmm5, 4
mov rax, qword [rsp + 0x40]
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm1, 4
vpxor xmm2, xmm2, xmm3
vpxor xmm2, xmm2, xmm0
vpslldq xmm0, xmm5, 4
vaeskeygenassist xmm4, xmm2, 0
vpslldq xmm3, xmm0, 4
vpxor xmm0, xmm0, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm2, 4
vpxor xmm3, xmm3, xmm4
vpxor xmm0, xmm0, xmm3
vpxor xmm0, xmm0, xmm1
vperm2i128 ymm1, ymm2, ymm2, 0
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vperm2i128 ymm1, ymm0, ymm0, 0
vaeskeygenassist xmm4, xmm0, 8
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rax], ymm1
vpslldq xmm1, xmm5, 4
mov rax, qword [rsp + 0x50]
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm0, 4
vpxor xmm1, xmm1, xmm3
vpxor xmm1, xmm1, xmm2
vpslldq xmm2, xmm5, 4
vaeskeygenassist xmm4, xmm1, 0
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpshufd xmm4, xmm4, 0xaa
vinserti128 ymm1, ymm1, xmm1, 1
vmovdqu ymmword [rax], ymm1
vpxor xmm1, xmm3, xmm4
mov rax, qword [rsp + 0x58]
vpxor xmm2, xmm2, xmm1
vpxor xmm0, xmm2, xmm0
vinserti128 ymm0, ymm0, xmm0, 1
vmovdqu ymmword [rax], ymm0
vzeroupper
ret
Function at 0x1400ab8e0
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov r13, rdx
mov rbp, r8
call sub.msvcrt.dll_wcslen
mov rdi, rax
mov rbx, rax
jmp 0x1400ab920
lea rsi, [rbx - 1]
movzx edx, word [r12 + rsi*2]
cmp dx, 0x2f
je 0x1400ab990
cmp dx, 0x5c
je 0x1400ab990
mov rbx, rsi
test rbx, rbx
jne 0x1400ab908
test r13, r13
je 0x1400ab969
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call rbx
mov r14d, eax
test eax, eax
je 0x1400aba0e
mov ecx, eax
add rcx, rcx
call fcn.1400a6950
mov qword [r13], rax
mov rdx, rax
test rax, rax
je 0x1400aba2d
mov ecx, r14d
call rbx
test eax, eax
je 0x1400aba15
mov rcx, r12
call sub.msvcrt.dll__wcsdup
mov qword [rbp], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test rsi, rsi
je 0x1400ab925
test r13, r13
je 0x1400ab9ca
lea r14, [rbx + rbx + 2]
mov rcx, r14
call fcn.1400a6950
mov qword [r13], rax
mov rcx, rax
test rax, rax
je 0x1400aba2d
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_wcsncpy
mov rax, qword [r13]
xor ecx, ecx
mov word [rax + r14 - 2], cx
sub rdi, rsi
lea rsi, [rdi + rdi]
mov rcx, rsi
call fcn.1400a6950
mov qword [rbp], rax
mov rcx, rax
test rax, rax
je 0x1400aba2d
lea rdx, [r12 + rbx*2]
lea r8, [rdi - 1]
call sub.msvcrt.dll_wcsncpy
mov rax, qword [rbp]
xor edx, edx
mov word [rax + rsi - 2], dx
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 0xffffffff
jmp 0x1400ab9ff
mov rcx, qword [r13]
call fcn.1400a6970
mov qword [r13], 0
mov eax, 0xffffffff
jmp 0x1400ab9ff
lea rdx, [0x14029c720]
mov ecx, 0xe
call fcn.1400ab420
nop
nop
Function at 0x1400ad520
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x140584520]
mov dword [0x1402fb500], eax
call fcn.1400c3570
test eax, eax
jne 0x1400ad580
lea rax, [0x1402fc520]
lea rdx, [0x1402fb520]
lea rcx, [rax + 0x288000]
nop
mov qword [rdx + 8], rax
add rax, 0x2880
add rdx, 0x10
mov qword [rdx - 0x10], 0
cmp rax, rcx
jne 0x1400ad560
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.1400ab420
nop
nop
Function at 0x1400b53e0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x40]
mov rbx, rcx
mov qword [rcx + 0x48], 0
mov rcx, qword [rcx + 0x38]
lea r9, [rbx + 0x48]
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
cmp eax, 0x273f
je 0x1400b54d0
jle 0x1400b5440
cmp eax, 0x2afa
je 0x1400b54b0
jle 0x1400b5460
cmp eax, 0x2afb
jne 0x1400b54c0
mov eax, 0xfffff444
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x2726
je 0x1400b54a0
jle 0x1400b5480
cmp eax, 0x273c
jne 0x1400b54c0
mov eax, 0xfffff43d
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x277d
je 0x1400b5490
cmp eax, 0x2af9
jne 0x1400b54c0
mov eax, 0xfffff440
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
test eax, eax
je 0x1400b5430
cmp eax, 8
jne 0x1400b54c0
mov eax, 0xfffff442
jmp 0x1400b5430
mov eax, 0xfffff43e
jmp 0x1400b5430
mov eax, 0xfffff446
jmp 0x1400b5430
mov eax, 0xfffff447
jmp 0x1400b5430
mov ecx, eax
call fcn.1400ab4e0
jmp 0x1400b5430
mov eax, 0xfffff443
jmp 0x1400b5430

Function at 0x1400b6790
Capabilities:
Create pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp qword [r8 + 0x70], 0xffffffffffffffff
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
mov edi, r9d
je 0x1400b67c5
mov r8d, 0x212
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle__INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
cmp edi, 1
mov rcx, qword [rsi + 0x120]
mov qword [rsp + 0x38], 0
mov r9d, 0xff
sbb edx, edx
mov dword [rsp + 0x30], 0
xor r8d, r8d
and edx, 0xfff80000
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
add edx, 0x400c0003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b6850
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x1400b685b
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x118], rax
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateIoCompletionPort
mov ecx, eax
call fcn.1400ab420
nop
Function at 0x1400b68e0
Capabilities:
Connect pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rdi, rdx
mov rbx, r8
mov esi, r9d
test byte [rdx + 0x58], 0x40
je 0x1400b6950
test esi, esi
je 0x1400b696e
cmp qword [rbx + 0x70], 0xffffffffffffffff
je 0x1400b6a10
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400b69b0
mov eax, dword [rdi + 0x78]
add eax, 1
mov dword [rdi + 0x78], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x3f7
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029ced8]
call qword [sym.imp.msvcrt.dll__assert]
test esi, esi
jne 0x1400b68fe
xor r9d, r9d
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.1400b6790
test eax, eax
jne 0x1400b68fe
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
test eax, eax
jle 0x1400b6a5c
call rsi
movzx eax, ax
or eax, 0x80070000
cdqe
jmp 0x1400b69d4
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
je 0x1400b693b
call rsi
mov r8d, eax
xor eax, eax
cmp r8d, 0x217
jne 0x1400b6a40
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1400b6a30
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rbp + 0x48], rbx
mov eax, dword [rdi + 0x78]
add eax, 1
mov dword [rdi + 0x78], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x400
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b6909
mov qword [rbx + 0x68], rbx
jmp 0x1400b69f9
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call rsi
test eax, eax
jg 0x1400b6998
call rsi
cdqe
jmp 0x1400b69d4

Function at 0x1400b7290
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
mov rbp, rcx
mov rdi, rdx
lea r13, [rsp + 0x4c]
mov esi, r8d
nop dword [rax + rax]
mov edx, ebx
mov r8d, esi
mov r9, r13
mov rcx, rbp
mov qword [rsp + 0x20], 0
add rdx, rdi
sub r8d, ebx
call r12
test eax, eax
je 0x1400b7330
add ebx, dword [rsp + 0x4c]
cmp esi, ebx
ja 0x1400b72b8
mov eax, 0
jne 0x1400b72f8
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x72f
lea rdx, str.src_win_pipe.c
lea rcx, str.bytes_read__count
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400b7d90
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rdx + 0x58]
mov rsi, rcx
mov rbx, rdx
test ah, 0x10
je 0x1400b7f70
test eax, 0x10000
jne 0x1400b7f98
cmp qword [rbx + 0x118], 0xffffffffffffffff
je 0x1400b7fc0
mov eax, dword [rbx + 0x58]
lea rdi, [rbx + 0x80]
test eax, 0x1000000
je 0x1400b7e48
mov r8d, 0x10
mov rdx, rdi
mov qword [rbx + 0x238], 0
lea rcx, [0x1400b6a70]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x1400b7f10
mov eax, dword [rbx + 0x58]
test al, 0x80
je 0x1400b7fe0
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x1400b7e29
xor r9d, r9d
mov r8d, 0x32
lea rdx, [0x1400b8070]
call fcn.1400a61f0
or dword [rbx + 0x58], 0x10000
mov eax, dword [rbx + 0x78]
add eax, 1
mov dword [rbx + 0x78], eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rbx + 0xc0]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xc8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
test eax, 0x80000
je 0x1400b7e97
mov rax, qword [rbx + 0xf0]
test rax, rax
je 0x1400b8040
or rax, 1
mov qword [rbx + 0xd8], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, qword [rbx + 0x118]
lea rdx, [0x140584560]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b8000
mov eax, dword [rbx + 0x58]
test eax, 0x80000
je 0x1400b7e00
cmp qword [rbx + 0xf8], 0xffffffffffffffff
jne 0x1400b7e00
mov dword [rsp + 0x28], 4
mov rdx, qword [rbx + 0xf0]
lea rcx, [rbx + 0xf8]
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x1400b65c0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1400b7dfd
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
test eax, eax
jle 0x1400b8020
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xe8], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400b8030
mov rax, qword [rax + 0x68]
mov qword [rbx + 0xe8], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1400b7e29
mov r8d, 0x508
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029d118]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x58]
test eax, 0x10000
je 0x1400b7db5
mov r8d, 0x509
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029d140]
call qword [sym.imp.msvcrt.dll__assert]
cmp qword [rbx + 0x118], 0xffffffffffffffff
jne 0x1400b7dc3
mov r8d, 0x50b
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b7dc3
mov r8d, 0x89d
lea rdx, str.src_win_pipe.c
lea rcx, str.pipe__flags__UV_HANDLE_CONNECTION
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b7e08
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x1400b7ebe
jmp 0x1400b7f17
call rbp
cdqe
jmp 0x1400b7f2d
mov qword [rbx + 0xe8], rdi
jmp 0x1400b7f5f
mov r8d, 0x51b
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029d16a]
call qword [sym.imp.msvcrt.dll__assert]
mov rax, qword [rbx + 0xf0]
jmp 0x1400b7e8c
Function at 0x1400b82a0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov r12, rcx
mov ebx, edx
mov edi, r8d
xor edx, edx
xor r8d, r8d
lea rsi, [rsp + 0x50]
mov rcx, rbp
call fcn.1400a6b10
movdqu xmm0, xmmword [rsp + 0x30]
mov edx, ebx
mov r8, rsi
mov rcx, r12
movups xmmword [rsp + 0x50], xmm0
call qword [r12 + 0x68]
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1400b82f5
mov r8d, dword [rsp + 0x50]
test r8d, r8d
jne 0x1400b8318
mov r8, rsi
mov rdx, 0xfffffffffffff024
mov rcx, r12
call qword [r12 + 0x70]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r8d, edi
mov rcx, qword [r12 + 0x118]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
cmova r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b8360
mov edx, dword [rsp + 0x4c]
mov r8, rsi
mov rcx, r12
call qword [r12 + 0x70]
mov eax, dword [rsp + 0x4c]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqu xmm1, xmmword [rsp + 0x50]
mov r8, rbp
mov rcx, r12
mov edx, eax
movups xmmword [rsp + 0x30], xmm1
call fcn.1400b8170
xor eax, eax
jmp 0x1400b8309

Function at 0x1400ba290
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r13, rdx
mov edx, dword [r8 + 0x110]
mov r12, rcx
mov rbx, r8
test edx, edx
jne 0x1400ba328
test rax, rax
je 0x1400ba2f0
mov qword [rsp + 0x28], r9
mov r8d, 0x6e2
lea rdx, str.src_win_pipe.c
lea rcx, str.send_handle__NULL
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x28]
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400b7350
mov rdx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400b9e50
Function at 0x1400ba340
Capabilities:
Read file on windows
Read pipe

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
cmp dword [rdx + 0x10], 7
mov r13, rcx
mov r12, rdx
mov rbx, r8
je 0x1400ba372
mov r8d, 0x7ab
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__type__UV_NAMED_PIPE
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [r12 + 0x58]
mov edx, dword [r12 + 0x78]
and eax, 0xffdeffff
mov dword [r12 + 0x58], eax
test edx, edx
je 0x1400ba4f0
sub edx, 1
mov dword [r12 + 0x78], edx
jne 0x1400ba3a0
test al, 1
jne 0x1400ba4a0
test al, 0x80
je 0x1400ba4d0
mov rcx, qword [r12 + 0x128]
test rcx, rcx
je 0x1400ba3ba
call fcn.1400a6190
test byte [r12 + 0x59], 0x10
je 0x1400ba3f7
mov rax, qword [rbx + 0x40]
mov ecx, eax
test eax, eax
jns 0x1400ba408
mov rax, qword [0x1402af3c0]
call qword [rax]
mov edx, eax
cmp eax, 0x3e3
jne 0x1400ba520
mov eax, dword [r12 + 0x58]
and eax, 0x11000
cmp eax, 0x1000
je 0x1400ba54f
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
lea rax, [rsp + 0x4c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x4c], 0
mov rcx, qword [r12 + 0x118]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400ba568
mov edx, dword [rsp + 0x4c]
mov eax, dword [r12 + 0x58]
test edx, edx
jne 0x1400ba474
jmp 0x1400ba3e7
mov rcx, r12
call fcn.1400b8390
test eax, eax
je 0x1400ba3e2
mov edx, dword [rsp + 0x4c]
cmp edx, eax
jb 0x1400ba3e2
sub edx, eax
mov dword [rsp + 0x4c], edx
je 0x1400ba3e2
mov eax, dword [r12 + 0x58]
test ah, 0x10
je 0x1400ba3e7
mov eax, dword [r12 + 0x110]
test eax, eax
jne 0x1400ba450
mov r8d, 0xffffffff
mov rcx, r12
call fcn.1400b82a0
jmp 0x1400ba458
test al, 0x20
jne 0x1400ba3a0
or eax, 0x20
mov dword [r12 + 0x58], eax
mov rax, qword [r13 + 0x50]
mov qword [r12 + 0x50], rax
mov qword [r13 + 0x50], r12
mov eax, dword [r12 + 0x58]
test al, 0x80
jne 0x1400ba3a8
nop word [rax + rax]
mov r8d, 0x8a6
lea rdx, str.src_win_pipe.c
lea rcx, str.pipe__flags__UV_HANDLE_CONNECTION
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400ba3a8
lea rdx, str.src_win_pipe.c
mov r8d, 0x7ae
lea rcx, [0x14029d38a]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [r12 + 0x78]
mov eax, dword [r12 + 0x58]
jmp 0x1400ba38e
movdqu xmm0, xmmword [0x14029d510]
lea r8, [rsp + 0x30]
mov rcx, r12
movups xmmword [rsp + 0x30], xmm0
call fcn.1400b8170
mov eax, dword [r12 + 0x58]
and eax, 0x11000
cmp eax, 0x1000
jne 0x1400ba3f7
mov rdx, r12
mov rcx, r13
add rsp, 0x50
pop rbx
pop r12
pop r13
jmp fcn.1400b7d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqu xmm1, xmmword [0x14029d510]
lea r8, [rsp + 0x30]
mov rcx, r12
mov edx, eax
movups xmmword [rsp + 0x30], xmm1
call fcn.1400b8170
jmp 0x1400ba441
Function at 0x1400bc670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa8]
mov r15, rcx
mov rbx, rdx
mov r13, r8
mov rsi, r9
cmp rdx, 2
jbe 0x1400bc7a0
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x1400bc808
cmp ax, 0x2f
je 0x1400bc808
cmp word [rcx + 2], 0x3a
je 0x1400bc8c0
nop dword [rax + rax]
lea rcx, [rsi + rbp + 4]
add rcx, r14
add rcx, rbx
add rcx, rcx
call fcn.1400a6950
mov rdx, qword [rsp + 0xa0]
mov r8, r14
mov r12, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
lea rdi, [r12 + r14*2]
test r14, r14
jne 0x1400bc850
mov rcx, rdi
mov r8, rbx
lea rdi, [rdi + rbx*2]
mov rdx, r15
call sub.msvcrt.dll_wcsncpy
test rbx, rbx
jne 0x1400bc890
mov r8, rsi
mov rdx, r13
lea rbx, [rdi + rsi*2]
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
test rbp, rbp
je 0x1400bc768
test rsi, rsi
je 0x1400bc751
cmp word [rbx - 2], 0x2e
je 0x1400bc751
mov edx, 0x2e
add rbx, 2
mov word [rbx - 2], dx
mov rdx, qword [rsp + 0x90]
mov rcx, rbx
mov r8, rbp
lea rbx, [rbx + rbp*2]
call sub.msvcrt.dll_wcsncpy
xor eax, eax
mov rcx, r12
mov word [rbx], ax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400bc880
test al, 0x10
jne 0x1400bc880
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x1400bc6d0
movzx eax, word [rcx]
cmp ax, 0x2f
je 0x1400bc819
cmp ax, 0x5c
je 0x1400bc819
cmp rdx, 2
jne 0x1400bc6d0
cmp word [rcx + 2], 0x3a
jne 0x1400bc6d0
cmp r14, 1
ja 0x1400bc8e0
lea rcx, [rsi + rbp + 4]
add rcx, rbx
add rcx, rcx
call fcn.1400a6950
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
mov rdi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov r12, rdi
jmp 0x1400bc706
movzx eax, word [r15 + 2]
cmp ax, 0x5c
je 0x1400bc7d7
cmp ax, 0x2f
je 0x1400bc7d7
mov edi, 4
mov r14d, 2
lea rcx, [rsi + rbp + 4]
add rcx, rbx
add rcx, r14
add rcx, rcx
call fcn.1400a6950
mov rdx, qword [rsp + 0xa0]
mov r8, r14
mov r12, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
add rdi, r12
movzx edx, word [rdi - 2]
lea rcx, [0x14029d870]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x1400bc706
mov r8d, 0x5c
add rdi, 2
mov word [rdi - 2], r8w
jmp 0x1400bc706
mov rcx, r12
xor r12d, r12d
call fcn.1400a6970
jmp 0x1400bc787
movzx edx, word [rdi - 2]
lea rcx, [0x14029d870]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x1400bc721
mov ecx, 0x5c
add rdi, 2
mov word [rdi - 2], cx
jmp 0x1400bc721
movzx eax, word [r15 + 4]
cmp ax, 0x2f
je 0x1400bc7d7
cmp ax, 0x5c
jne 0x1400bc7cd
jmp 0x1400bc7d7
mov rcx, qword [rsp + 0xa0]
mov r8d, 2
mov rdx, r15
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1400bc7d7
add r15, 4
sub rbx, 2
lea rdi, [r14 + r14]
jmp 0x1400bc824
Function at 0x1400bca00
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
mov r12, rcx
mov ebx, edx
cmp edx, 0x1c
ja 0x1400bcae0
cmp edx, 2
je 0x1400bca5f
jg 0x1400bca50
mov eax, 0xfffff02a
test edx, edx
jne 0x1400bca46
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400bcaa0
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
cmove eax, ebx
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
cmp edx, 9
je 0x1400bca5f
mov eax, 0xfffff02a
cmp edx, 0xf
jne 0x1400bca46
mov edx, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x1400bca46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp eax, 5
je 0x1400bcab0
mov ecx, r13d
call fcn.1400ab4e0
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400ab4e0
jmp 0x1400bca46
lea rdx, [rsp + 0x2c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400bca85
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
jne 0x1400bca46
jmp 0x1400bca85
mov eax, 0xfffff019
jmp 0x1400bca46
Function at 0x1400bf550
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x1400bf5c0
test ah, 0x80
je 0x1400bf5d0
mov eax, dword [rcx + 0x10]
cmp eax, 0xc
je 0x1400bf5a0
cmp eax, 0xe
je 0x1400bf5b0
mov r8d, 0xfffff008
cmp eax, 7
je 0x1400bf598
mov r8d, 0xbb
lea rdx, str.src_win_stream.c
lea rcx, [0x14029def1]
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0xfffff02a
mov eax, r8d
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1400c1a20
add rsp, 0x28
jmp 0x1400c8740
mov r8d, 0xfffff00d
jmp 0x1400bf598
mov r8d, 0xfffff031
jmp 0x1400bf598
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x1400c1a88
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov r8d, eax
mov eax, dword [rsp + 0x4c]
cmp r8d, 0xffffffff
je 0x1400c1a70
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400ab4e0
add rsp, 0x58
ret
mov eax, 0xfffff008
jmp 0x1400c1a67
push r13
push r12
sub rsp, 0x38
mov eax, dword [rcx + 0x100]
mov r12, rdx
mov r13d, r8d
test eax, eax
jne 0x1400c8798
lea r9, [rsp + 0x2c]
call fcn.1400c4b90
test eax, eax
jne 0x1400c8780
mov edx, r13d
mov rcx, r12
call fcn.1400a9050
add rsp, 0x38
pop r12
pop r13
ret
mov ecx, dword [rsp + 0x2c]
add rsp, 0x38
pop r12
pop r13
jmp fcn.1400ab4e0
mov eax, 0xfffff008
jmp 0x1400c8771