joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400791f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401c76e0]
xor rax, rsp
mov qword [rbp - 8], rax
mov edx, 1
mov rsi, rcx
lea r12d, [rdx + 1]
lea r8d, [rdx + 5]
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
or rbx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rbx
jne 0x14007926c
lea rdx, str.Failed_to_create_socket._n
mov ecx, 0xfffffffd
call fcn.14007e6c4
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14009c5b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
xor eax, eax
mov ecx, 0x7f000001
mov qword [rbp - 0x38], rax
mov word [rbp - 0x38], r12w
mov qword [rbp - 0x30], rax
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, 0xfae
mov dword [rbp - 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x36], ax
test rsi, rsi
je 0x1400792f5
and qword [rbp - 0x18], 0
cmp byte [rsi], 0
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], 0
jne 0x1400792b7
xor ebx, ebx
jmp 0x1400792c0
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400792b7
lea rcx, [rbp - 0x28]
mov r8, rbx
mov rdx, rsi
call fcn.1400031f8
lea r8, [rbp - 0x36]
lea rdx, [rbp - 0x34]
lea rcx, [rbp - 0x28]
mov word [rbp - 0x38], r12w
call fcn.1400795e8
cmp qword [rbp - 0x10], 0x10
jb 0x1400792f5
mov rcx, qword [rbp - 0x28]
call fcn.14009bc2c
lea r9, [rbp - 0x40]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov rcx, rdi
mov dword [rbp - 0x40], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140079331
lea rdx, str.Failed_to_set_SO_EXCLUSIVEADDRUSE_option._n
mov ecx, 0xfffffffe
call fcn.14007e6c4
lea rdx, [rbp - 0x38]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x140079354
lea rdx, str.Failed_to_bind_server._n
jmp 0x14007923f
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x140079372
lea rdx, str.Failed_to_listen._n
jmp 0x14007923f
mov ecx, 8
call fcn.14009bbc0
test rax, rax
je 0x140079249
mov qword [rax], rdi
jmp 0x14007924b

Function at 0x1400793a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
mov rax, qword [0x1401c76e0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
xor eax, eax
lea r8, [r11 - 0x28]
lea rdx, [r11 - 0x20]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
xor ebx, ebx
test eax, eax
je 0x1400793f4
lea rdx, str.Failed_to_retrieve_bound_address._n
lea ecx, [rbx - 3]
call fcn.14007e6c4
movzx eax, bx
jmp 0x1400793ff
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14009c5b0
add rsp, 0x40
pop rbx
ret
Function at 0x140079530
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
movsxd rdx, dword [rcx + 0x14]
mov r8d, 0x1000
mov rbx, rcx
sub r8d, dword [rcx + 0x14]
add rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x18]
jmp 0x1400795c7
je 0x1400795e3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400795a6
mov rcx, qword [rbx + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x140079587
lea rdx, str.Transport::ReadSomeData:_Failed_to_wait_on_socket_event_n
mov ecx, 0xfffffffc
call fcn.14007e6c4
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1400795b1
lea rdx, str.Transport::ReadSomeData:_Failed_to_reset_socket_event_n
lea ecx, [rax - 4]
call fcn.14007e6c4
jmp 0x1400795b1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
jne 0x1400795e3
movsxd rdx, dword [rbx + 0x14]
mov rcx, qword [rbx + 0x18]
mov r8d, 0x1000
sub r8d, dword [rbx + 0x14]
add rdx, qword [rbx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140079551
add dword [rbx + 0x14], eax
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
jmp 0x1400795dd

Function at 0x14007ca44
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x14007ca44
sub rsp, 0x1d8
mov rax, qword [0x1401c76e0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14007ca96
movzx eax, word [rsp + 0x20]
shr ax, 8
cmp al, 2
jne 0x14007cab3
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14009c5b0
add rsp, 0x1d8
ret
lea rdx, str.WSAStartup_failed_with_error:__d_n
mov r8d, eax
mov ecx, 0xfffffffd
call fcn.14007e6c4
or ecx, 0xffffffff
call fcn.14009d354
int3
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
mov ecx, 0xfffffffd
call fcn.14007e6c4
call qword [sym.imp.WS2_32.dll_WSACleanup]
or ecx, 0xffffffff
call fcn.14009d354
int3
Function at 0x14007e714
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.NACLLOG
call fcn.1400a2f40
test rax, rax
jne 0x14007e739
call fcn.14009dfec
lea rcx, [rax + 0x60]
call fcn.14007e980
jmp 0x14007e741
mov rcx, rax
call fcn.14007e9d0
mov rcx, rax
add rsp, 0x28
jmp 0x14007eb40
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400a26ec
mov rbx, rax
test rax, rax
jne 0x14007eb85
lea rcx, str.NaClLogSetFile
call fcn.1400a4268
call fcn.14009dfec
lea rdx, str.No_memory_for_log_buffers_n
lea rcx, [rax + 0x60]
call fcn.1400a2fac
call fcn.14007e6b0
mov rdx, rdi
mov rcx, rbx
call fcn.1400c3134
test eax, eax
jne 0x14007ebae
call fcn.14009dfec
lea rdx, str.NaClLog_module_internal_error:_GioFileRefCtor_failed_n
lea rcx, [rax + 0x60]
call fcn.1400a2fac
call fcn.14007e6b0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14007e750
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.NACLVERBOSITY
call fcn.1400a2f40
test rax, rax
je 0x14007e776
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3d94
test eax, eax
jns 0x14007e778
xor eax, eax
add rsp, 0x28
ret

Function at 0x14007ebbc
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14007e714
mov rbx, rax
call fcn.14007e750
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp 0x14007ebe0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, str.NACLVERBOSITY
mov rbx, rdx
call fcn.1400a2f40
mov r8, rbx
mov ecx, edi
mov rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14007ec14
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1401e4408], 0
mov rbx, r8
mov rdi, rdx
mov esi, ecx
jne 0x14007ec4a
lea rcx, [0x1401e4428]
call fcn.14007f49c
mov dword [0x1401e4408], 1
mov ecx, esi
call fcn.14007ef6c
mov rcx, rdi
call fcn.14007ec70
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007ee40

Function at 0x14007ebe0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14007e714
mov rbx, rax
call fcn.14007e750
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp 0x14007ebe0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, str.NACLVERBOSITY
mov rbx, rdx
call fcn.1400a2f40
mov r8, rbx
mov ecx, edi
mov rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14007ec14
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1401e4408], 0
mov rbx, r8
mov rdi, rdx
mov esi, ecx
jne 0x14007ec4a
lea rcx, [0x1401e4428]
call fcn.14007f49c
mov dword [0x1401e4408], 1
mov ecx, esi
call fcn.14007ef6c
mov rcx, rdi
call fcn.14007ec70
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007ee40
Function at 0x14007f678
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, rcx
xor edi, edi
lea rdx, str.Entered_NaClCalibrateWindowsClockQpc_n
lea ecx, [rdi + 5]
call fcn.14007e6c4
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rbp + 0x3c]
mov rbx, qword [rbp + 0x38]
mov dword [rbp + 0x44], eax
movabs r12, 0x346dc5d63886594b
mov dword [rbp + 0x40], ebx
mov rax, r12
mov qword [rbp - 0x20], rbx
mul qword [rbp + 0x40]
mov rsi, rdx
shr rsi, 0xb
add rsi, 0x3e8
lea rcx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14007f7ba
lea rcx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14007f7ba
mov r8, qword [rbp - 0x10]
mov r10d, dword [rbp + 0x4c]
mov rcx, qword [rbp + 0x48]
mov r9, r8
sub r9, qword [rbp - 0x18]
imul rax, r9, 0x3e8
cqo
idiv qword [r14 + 0x48]
mov r11, rax
cmp r10d, dword [rbp - 0x1c]
jne 0x14007f736
mov eax, edi
cmp ecx, ebx
je 0x14007f73b
mov eax, 1
test r9, r9
js 0x14007f74a
cmp r11, 4
jg 0x14007f74a
test eax, eax
jne 0x14007f770
test eax, eax
mov rax, r12
mov dword [rbp + 0x44], r10d
cmovne rbx, rcx
mov dword [rbp + 0x40], ecx
mov qword [rbp - 0x20], rbx
mul qword [rbp + 0x40]
shr rdx, 0xb
cmp rdx, rsi
jae 0x14007f775
jmp 0x14007f6d9
mov edi, 1
mov dword [rbp + 0x40], ecx
mov dword [rbp + 0x44], r10d
mov qword [r14 + 0x58], r8
mov rax, r12
mov r8d, edi
mov ecx, 5
mul qword [rbp + 0x40]
mov rax, r9
shr rdx, 0xb
mov qword [r14 + 0x28], rdx
cqo
sub rax, rdx
lea rdx, str.Leaving_NaClCalibrateWindowsClockQpc_:__d_n
sar rax, 1
add rax, qword [rbp - 0x18]
mov qword [r14 + 0x50], rax
call fcn.14007e6c4
mov eax, edi
jmp 0x14007f7bc
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400803a0
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call fcn.1400a4aec
test eax, eax
je 0x1400803bd
call fcn.1400a0dec
mov ecx, dword [rax]
call fcn.14007feb4
neg eax
jmp 0x1400803bf
xor eax, eax
add rsp, 0x28
ret
Function at 0x140080be0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov ebx, r9d
mov edi, r8d
mov r13, rcx
test rcx, rcx
jne 0x140080c22
lea rdx, str.NaClHostDescOpen:_this_is_NULL_n
lea ecx, [r13 - 4]
call fcn.14007e6c4
mov rdx, qword [rsp + 0x88]
test edi, 0xfffff9bc
je 0x140080c34
mov eax, 0xffffffea
jmp 0x140080de9
mov esi, edi
and esi, 3
mov ecx, esi
je 0x140080c75
dec ecx
je 0x140080c68
dec ecx
je 0x140080c5b
lea rdx, str.NaClHostDescOpen:_bad_access_flags_0x_x._n
mov r8d, edi
mov ecx, 0xfffffffd
call fcn.14007e6c4
jmp 0x140080c2a
mov ebp, 0xe0000000
mov r14d, 0x8002
jmp 0x140080c80
mov ebp, 0xe0000000
mov r14d, 0x8001
jmp 0x140080c80
mov ebp, 0xa0000000
mov r14d, 0x8000
mov eax, 0x1000001
test bl, 0x80
mov ecx, edi
lea r12d, [rax + 0x7f]
cmove r12d, eax
mov eax, 4
lea r10d, [rax - 3]
and ecx, 0x240
je 0x140080cd0
sub ecx, 0x40
je 0x140080ccc
sub ecx, 0x1c0
je 0x140080cc2
cmp ecx, 0x40
jne 0x140080cb9
mov ebx, eax
jmp 0x140080cc7
mov ebx, dword [rsp + 0x90]
jmp 0x140080cd5
mov ebx, 5
mov r15d, r10d
jmp 0x140080cd5
mov ebx, eax
jmp 0x140080cd5
mov ebx, 3
bt edi, 0xa
jae 0x140080cdf
or r14d, 8
mov r8, rdx
lea rdx, str.NaClHostDescOpen:_CreateFileA_path_s__desired_access0x_x__share_modeALL__security_attributesNULL__creation_disposition_d__flags_and_attributes_d__template_fileNULL__n
mov r9d, ebp
mov ecx, r10d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebx
call fcn.14007e6c4
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
mov edx, ebp
mov dword [rsp + 0x28], r12d
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140080d54
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescOpen:_CreateFile_failed__d_n
lea ecx, [rbp + 4]
mov r8d, eax
mov ebx, eax
call fcn.14007e6c4
mov ecx, ebx
call fcn.140081dac
neg eax
jmp 0x140080de9
test r15d, r15d
je 0x140080db0
test esi, esi
je 0x140080db0
lea rdx, str.NaClHostDescOpen:_Truncating_file_n
mov ecx, 4
call fcn.14007e6c4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140080db0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescOpen:_could_not_truncate_file:_last_error__d._n
mov ecx, 0xfffffffd
mov r8d, eax
mov ebx, eax
call fcn.14007e6c4
cmp ebx, 0x4c8
jne 0x140080db0
lea rdx, str.NaClHostDescOpen:_this_is_due_to_an_existing_mapping_of_the_same_file._n
mov ecx, 0xfffffffd
call fcn.14007e6c4
mov edx, r14d
mov rcx, rbp
call fcn.14009fba0
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140080dda
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescOpen_failed:_err__d_n
lea ecx, [rbx - 3]
mov r8d, eax
call fcn.14007e6c4
mov r8d, edi
mov edx, ebx
mov rcx, r13
call fcn.140080460
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008127c
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call fcn.1400a44f8
test eax, eax
je 0x140081299
call fcn.1400a0dec
mov ecx, dword [rax]
call fcn.14007feb4
neg eax
jmp 0x14008129b
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400813cc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
xor r9d, r9d
mov rdi, rdx
mov dword [rax - 0x20], 0x1000080
lea r8d, [r9 + 7]
mov edx, 0xc0000000
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14008142e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescTruncate:_CreateFile_failed__d_n
lea ecx, [rbx + 4]
mov r8d, eax
mov ebx, eax
call fcn.14007e6c4
mov ecx, ebx
call fcn.140081dac
neg eax
jmp 0x14008149e
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140081458
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescTruncate:_SetFilePointerEx_failed:_last_error__d._n
mov ecx, 0xfffffffd
jmp 0x140081419
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14008149c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescTruncate:_could_not_truncate_file:_last_error__d._n
mov ecx, 0xfffffffd
mov r8d, eax
mov ebx, eax
call fcn.14007e6c4
cmp ebx, 0x4c8
jne 0x140081423
lea rdx, str.NaClHostDescTruncate:_this_is_due_to_an_existing_mapping_of_the_same_file._n
mov ecx, 0xfffffffd
call fcn.14007e6c4
jmp 0x140081423
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140081c00
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0xffffffff
mov rax, r9
cmp r9, rcx
jbe 0x140081c33
call fcn.1400a0dec
lea rdx, str.NaClThreadCtor:__beginthreadex_failed__stack_request_out_of_range_n
mov r8d, dword [rax]
mov ecx, 0xfffffffd
call fcn.14007e6c4
xor eax, eax
jmp 0x140081c74
and qword [rsp + 0x28], 0
mov r9, r8
mov r8, rdx
mov edx, eax
xor ecx, ecx
mov dword [rsp + 0x20], 4
call fcn.1400a50d0
test rax, rax
jne 0x140081c63
call fcn.1400a0dec
lea rdx, str.NaClThreadCtor:__beginthreadex_failed__errno__d_n
jmp 0x140081c22
mov rcx, rax
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1400870c4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test r8, r8
je 0x140087128
mov r14d, 0xffffffff
mov eax, edi
mov r8d, r14d
mov r9, rdi
sub r9, rbx
sub eax, ebx
lea rdx, [rbx + rsi]
cmp r9, r14
lea r9, [rsp + 0x60]
mov rcx, rbp
cmovbe r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008713d
mov eax, dword [rsp + 0x60]
add rbx, rax
cmp rbx, rdi
jb 0x1400870ec
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
or rax, 0xffffffffffffffff
test rbx, rbx
cmovne rax, rbx
jmp 0x14008712a
Function at 0x140087544
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test r8, r8
je 0x1400875a8
mov r14d, 0xffffffff
mov eax, edi
mov r8d, r14d
mov r9, rdi
sub r9, rbx
sub eax, ebx
lea rdx, [rbx + rsi]
cmp r9, r14
lea r9, [rsp + 0x60]
mov rcx, rbp
cmovbe r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400875bd
mov eax, dword [rsp + 0x60]
add rbx, rax
cmp rbx, rdi
jb 0x14008756c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
or rax, 0xffffffffffffffff
test rbx, rbx
cmovne rax, rbx
jmp 0x1400875aa

Function at 0x1400875cc
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1401c76e0]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x60]
call fcn.14008705c
test al, al
jne 0x1400875fb
or rax, 0xffffffffffffffff
jmp 0x140087661
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14008701c
cmp qword [rax + 0x18], 8
jb 0x140087614
mov rax, qword [rax]
and qword [rsp + 0x38], 0
mov ecx, 0x1000
mov dword [rsp + 0x30], 0x3e8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov edx, 0x80003
mov rcx, rax
mov r9d, 0xff
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp qword [rsp + 0x58], 8
mov rbx, rax
jb 0x14008765e
mov rcx, qword [rsp + 0x40]
call fcn.14009bc2c
mov rax, rbx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14009c5b0
add rsp, 0xa0
pop rbx
ret
Function at 0x1400876a4
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov rdi, rcx
mov rcx, rdx
mov esi, r8d
mov rbp, rdx
call fcn.140087eb8
test eax, eax
jne 0x1400876df
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1400877e8
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
test eax, eax
je 0x1400876d7
test byte [rsp + 0x40], 1
jne 0x140087725
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call fcn.14008714c
jmp 0x1400877e8
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x140087725
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x217
je 0x140087765
dec eax
jne 0x1400876d7
and dword [rsp + 0x78], eax
test sil, 1
jne 0x1400876d7
lea rdx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
jmp 0x140087725
and dword [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov r9b, 1
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call fcn.14008714c
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rdx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
cmp r14d, 0xffffffff
jne 0x1400877e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1400877e5
test sil, 1
je 0x140087725
mov ecx, 0x218
jmp 0x1400876d1
mov eax, r14d
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x140087abc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1401c76e0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
cmp dword [rcx + 0x18], 8
mov rsi, r8
mov r15d, edx
mov r14, rcx
jbe 0x140087b0a
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x140087cbd
call fcn.140087eb8
xor r12d, r12d
test eax, eax
je 0x140087af7
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.14008705c
test al, al
je 0x140087b02
lea ebx, [r12 + 0xa]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.14008701c
cmp qword [rax + 0x18], 8
jb 0x140087b42
mov rax, qword [rax]
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], 0x110000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp qword [rbp - 0x11], 8
mov rdi, rax
jb 0x140087b7e
mov rcx, qword [rbp - 0x29]
call fcn.14009bc2c
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r12
mov word [rbp - 0x29], r12w
cmp rdi, 0xffffffffffffffff
jne 0x140087ca2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x140087bd6
test r15b, 1
jne 0x140087bcc
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, ebx
cmp ebx, 0x3e8
jle 0x140087b2b
mov ebx, 0x3e8
jmp 0x140087b2b
mov ecx, 0x218
jmp 0x140087afc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140087b02
test rsi, rsi
je 0x140087af7
movsx ecx, byte [rsi]
call fcn.1400a101c
test eax, eax
je 0x140087af7
lea r9, str..pipegoogle_nacl_
lea r8, str._s_.s
lea rcx, [rbp - 9]
mov edx, gethostbyname
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x1c
call fcn.14009ca5c
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x49]
call fcn.14008701c
cmp qword [rax + 0x18], 8
jb 0x140087c3e
mov rax, qword [rax]
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], 0x110000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp qword [rbp - 0x31], 8
mov rdi, rax
jb 0x140087c7a
mov rcx, qword [rbp - 0x49]
call fcn.14009bc2c
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], r12
mov word [rbp - 0x49], r12w
cmp rdi, 0xffffffffffffffff
jne 0x140087ca2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x140087b02
mov r8d, r15d
mov rdx, r14
mov rcx, rdi
call fcn.140087800
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14009c5b0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret