joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c250
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140049090]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000c324
cmp byte [rcx + 0x72], 0
je 0x14000c324
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + SafeArrayPutElement]
cmp di, ax
je 0x14000c320
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14000c2e6
sub eax, 1
je 0x14000c2ea
cmp eax, 2
jne 0x14000c320
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000eef0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000c317
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1400187f0
cmp rdi, rax
jne 0x14000c320
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14000c2ce
xor al, al
jmp 0x14000c2ce
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000eef0
add rsp, 0x60
pop rbx
ret
Function at 0x140023d7c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140023aa2
call fcn.140019050
mov dword [rax], SafeArrayPutElement
call fcn.140015c1c
jmp 0x140023bed
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140023bed
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140023bed
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140023ad1
lock or dword [rcx + 0x14], 0x10
jmp 0x140023bed
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140023ae5
call fcn.140023a00
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140023af5
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140023af8
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14002215c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14002c59c
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140023bdb
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140023b89
mov rcx, rbx
call fcn.14002215c
cmp eax, 0xffffffff
je 0x140023b74
mov rcx, rbx
call fcn.14002215c
cmp eax, 0xfffffffe
je 0x140023b74
mov rcx, rbx
call fcn.14002215c
movsxd rdi, eax
lea r14, [0x14004bee0]
mov rcx, rbx
sar rdi, 6
call fcn.14002215c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140023b7b
lea rdx, [0x140049440]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140023b89
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140023bad
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140023bad
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140023bad
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140023bcb
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140023bd6
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140023bf2
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140023a6c
Function at 0x1400333d9
Capabilities:
Write file on windows

Disassembly:
jmp 0x140053760
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400ce282]
call fcn.14003571a
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1400537b7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400538c3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14005385c
cmp qword [rbp + 0x28], 0
jle 0x14005385c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1400537fc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400354c7
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1400538b2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1400538b2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14003347e
Capabilities:
Read file on windows

Disassembly:
jmp 0x14008ae90
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400ce90b]
call fcn.14003571a
mov rcx, qword [rbp + 0x160]
call fcn.140035abc
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_fseek]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_fgetc]
cmp eax, 0xffffffff
jne 0x14008af1b
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_ferror]
test eax, eax
je 0x14008af1b
xor r9d, r9d
xor r8d, r8d
mov edx, 5
mov rcx, qword [rbp + 0x160]
call fcn.140035170
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0x6c]
jmp 0x14008b0ac
mov r8d, 2
xor edx, edx
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_fseek]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [rbp + 4], eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_fseek]
cmp dword [rbp + 4], 0xffffffff
jne 0x14008af7e
xor r9d, r9d
xor r8d, r8d
mov edx, 5
mov rcx, qword [rbp + 0x160]
call fcn.140035170
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0x6c]
jmp 0x14008b0ac
cmp dword [rbp + 4], 0
jge 0x14008af85
int3
mov ecx, dword [rbp + 4]
call fcn.14003359b
movzx eax, al
test eax, eax
jne 0x14008afba
xor r9d, r9d
xor r8d, r8d
mov edx, 5
mov rcx, qword [rbp + 0x160]
call fcn.140035170
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0x6c]
jmp 0x14008b0ac
cmp dword [rbp + 4], 0
jne 0x14008afe6
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd
mov rcx, qword [rbp + 0x160]
call fcn.140035170
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0x6c]
jmp 0x14008b0ac
movsxd rax, dword [rbp + 4]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x160]
cmp qword [rax + 0x98], 0
je 0x14008b000
int3
mov rax, qword [rbp + 0x28]
inc rax
mov rcx, rax
call fcn.14003409f
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x128]
mov qword [rax + 0x98], rcx
mov r9, qword [rbp + 0x168]
mov r8, qword [rbp + 0x28]
mov edx, 1
mov rax, qword [rbp + 0x160]
mov rcx, qword [rax + 0x98]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x48], rax
je 0x14008b080
xor r9d, r9d
xor r8d, r8d
mov edx, 5
mov rcx, qword [rbp + 0x160]
call fcn.140035170
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0x6c]
jmp 0x14008b0ac
mov rax, qword [rbp + 0x160]
mov rax, qword [rax + 0x98]
mov rcx, qword [rbp + 0x28]
mov byte [rax + rcx], 0
mov rcx, qword [rbp + 0x160]
call fcn.140035ada
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0x6c]
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x1400345c2
Capabilities:
Terminate process

Disassembly:
jmp 0x140098b30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140034a68
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x14009aac0
jmp 0x14009aad0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
test rax, rax
je 0x14009ac48
mov ecx, dword [rsp + 0x60]
inc ecx
movsxd rbx, ecx
shl rbx, 3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x14009ac48
xor edi, edi
mov r14d, edi
cmp dword [rsp + 0x60], edi
jle 0x14009abe1
sub rax, r13
mov rsi, r13
mov qword [rsp + 0x68], rax
nop
mov rcx, qword [rsi]
call fcn.140034aea
mov r8, qword [rsi]
lea rdx, str.UTF_16LE
lea rcx, str.UTF_8
lea r9, [rax*2 + 2]
call fcn.14003559e
mov rbp, rax
test rax, rax
je 0x14009ac48
mov rcx, rax
call fcn.1400349dc
mov r12, rax
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x68]
mov qword [rcx + rsi], rax
test rax, rax
je 0x14009ac48
mov r8d, r12d
mov rdx, rbp
mov rcx, rax
call fcn.1400345d1
mov rcx, rbp
call fcn.1400331bd
inc r14d
add rsi, 8
cmp r14d, dword [rsp + 0x60]
jl 0x14009ab50
movsxd rax, r14d
mov rcx, r13
mov qword [r15 + rax*8], rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.140033b3b
mov ecx, dword [rsp + 0x60]
mov rdx, r15
call fcn.140034b7b
mov esi, eax
cmp dword [rsp + 0x60], edi
jle 0x14009ac30
mov rbx, r15
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
inc edi
lea rbx, [rbx + 8]
cmp edi, dword [rsp + 0x60]
jl 0x14009ac10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
jmp 0x14009ac64
xor r9d, r9d
lea r8, str.Out_of_memory___aborting
lea rdx, str.Fatal_Error
lea ecx, [r9 + 0x10]
call fcn.140033f3c
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140034b3a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140099650
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140099670
xor al, al
jmp 0x1400996f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140099683
xor al, al
jmp 0x1400996f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400996ad
xor al, al
jmp 0x1400996f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400996c1
xor al, al
jmp 0x1400996f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400996d3
xor al, al
jmp 0x1400996f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400996ef
xor al, al
jmp 0x1400996f1
mov al, 1
add rsp, 0x38
ret
Function at 0x140035689
Capabilities:
Write file on windows

Disassembly:
jmp 0x14004f770
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1400bf178]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1400ce282]
call fcn.14003571a
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x14004f7d6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004f7dd
mov al, 1
jmp 0x14004f937
call fcn.140033a8c
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140033a8c
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400350c1
movzx eax, al
test eax, eax
je 0x14004f838
xor al, al
jmp 0x14004f937
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x14004f89d
cmp dword [rbp + 0x194], 1
je 0x14004f8a8
cmp dword [rbp + 0x194], 3
je 0x14004f926
jmp 0x14004f935
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14004f8f8
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14004f8f8
xor al, al
jmp 0x14004f937
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004f913
mov dword [rbp + 0x194], 1
jmp 0x14004f91d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x14004f937
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14004f937
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400a7ed0]
call fcn.14003506c
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.1400342d4
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140035977
Capabilities:
Write file on windows

Disassembly:
jmp 0x140094a20
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400ce90b]
call fcn.14003571a
mov rax, qword [rbp + 0x100]
cmp qword [rax + 0x78], 0
je 0x140094a7d
mov rax, qword [rbp + 0x100]
mov r9, qword [rax + 0x78]
mov r8, qword [rbp + 0x110]
mov edx, 1
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ucrtbased.dll_fwrite]
jmp 0x140094aca
mov rax, qword [rbp + 0x100]
add rax, 0x110
mov edx, dword [rbp + 0x110]
mov rcx, rax
call fcn.140033181
dec rax
mov qword [rbp + 8], rax
mov r8, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 8]
call fcn.1400342de
mov rax, qword [rbp + 0x110]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov byte [rax], 0
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x6bac13d0
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x4c], 0
mov rsi, rcx
mov ebx, edx
lea rcx, [0x6bac7920]
mov qword [rsp + 0x38], 0
mov edx, 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov r12, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x6bac147c
xor edx, edx
mov rcx, r12
lea rdi, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x6bac147c
test ebx, ebx
jle 0x6bac1466
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x6bac1471
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6bac147c
mov edx, dword [rsp + 0x4c]
add rsi, rdx
sub ebx, edx
jmp 0x6bac1443
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x6bac14a4
Capabilities:
Read file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov dword [rsp + 0x4c], 0
mov rsi, rcx
mov ebx, edx
lea rcx, [0x6bac7920]
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea rdi, [rsp + 0x4c]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
xor eax, eax
cmp r12, 0xffffffffffffffff
je 0x6bac153c
test ebx, ebx
jle 0x6bac1521
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6bac1531
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x6bac153c
mov edx, dword [rsp + 0x4c]
add rsi, rdx
sub ebx, edx
jmp 0x6bac14fe
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x6bac1598
Capabilities:
Create thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
movsxd rcx, dword [rbx + 4]
call sub.msvcrt.dll_malloc
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, rax
mov ecx, 0x400
call rsi
mov edx, dword [rbx + 4]
mov rcx, r12
call fcn.6bac14a4
test eax, eax
je 0x6bac1568
mov edx, dword [rbx + 4]
lea r8, [rbx + 8]
mov rcx, r12
call fcn.6bac16f5
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
lea rcx, [0x6bac7920]
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cMSSE__d_server
call sub.msvcrt.dll_sprintf
xor ecx, ecx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
lea r8, [0x6bac1486]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x6bac1546

Function at 0x6bac1657
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x6bac168b
mov qword [0x6bac7960], rcx
xor r9d, r9d
lea r8, [0x6bac1640]
xor edx, edx
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x6bac16f5
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r9d, 4
movsxd r12, edx
mov rdi, rcx
mov rbp, r8
xor ecx, ecx
mov r8d, 0x3000
mov rdx, r12
mov rsi, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
xor eax, eax
cmp esi, eax
jle 0x6bac1740
mov rdx, rax
and edx, 3
mov dl, byte [rbp + rdx]
xor dl, byte [rdi + rax]
mov byte [rbx + rax], dl
inc rax
jmp 0x6bac1727
mov rcx, rbx
call fcn.6bac16c3
lea r9, [rsp + 0x3c]
mov rdx, r12
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
lea r8, [0x6bac16c0]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x6bac1b10
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6bac2d80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.6bac2d80
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x14001b1f4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b20a
mov al, 1
jmp 0x14001b26a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b21b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b268
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019348
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b268
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b268
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b268
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b26a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f680
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f6a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f6a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001b18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b64
xor al, al
add rsp, 0x28
ret