joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400849b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm2, xmmword [rcx]
vmovdqu xmm0, xmmword [rcx + 0x10]
mov rax, qword [rsp + 0x28]
vperm2i128 ymm1, ymm2, ymm2, 0
vpslldq xmm5, xmm2, 4
vaeskeygenassist xmm4, xmm0, 1
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rdx], ymm1
vperm2i128 ymm1, ymm0, ymm0, 0
vmovdqu ymmword [r8], ymm1
vpslldq xmm1, xmm5, 4
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm0, 4
vpxor xmm1, xmm1, xmm3
vpxor xmm1, xmm1, xmm2
vpslldq xmm2, xmm5, 4
vaeskeygenassist xmm4, xmm1, 0
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm1, 4
vpxor xmm3, xmm3, xmm4
vpxor xmm2, xmm2, xmm3
vpxor xmm2, xmm2, xmm0
vperm2i128 ymm0, ymm1, ymm1, 0
vmovdqu ymmword [r9], ymm0
vperm2i128 ymm0, ymm2, ymm2, 0
vaeskeygenassist xmm4, xmm2, 2
vmovdqu ymmword [rax], ymm0
vpslldq xmm0, xmm5, 4
vpshufd xmm4, xmm4, 0xff
mov rax, qword [rsp + 0x30]
vpslldq xmm3, xmm0, 4
vpxor xmm0, xmm0, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm2, 4
vpxor xmm0, xmm0, xmm3
vpxor xmm0, xmm0, xmm1
vpslldq xmm1, xmm5, 4
vaeskeygenassist xmm4, xmm0, 0
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm0, 4
vpxor xmm3, xmm3, xmm4
vpxor xmm1, xmm1, xmm3
vpxor xmm1, xmm1, xmm2
vperm2i128 ymm2, ymm0, ymm0, 0
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x38]
vperm2i128 ymm2, ymm1, ymm1, 0
vaeskeygenassist xmm4, xmm1, 4
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rax], ymm2
vpslldq xmm2, xmm5, 4
mov rax, qword [rsp + 0x40]
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm1, 4
vpxor xmm2, xmm2, xmm3
vpxor xmm2, xmm2, xmm0
vpslldq xmm0, xmm5, 4
vaeskeygenassist xmm4, xmm2, 0
vpslldq xmm3, xmm0, 4
vpxor xmm0, xmm0, xmm5
vpshufd xmm4, xmm4, 0xaa
vpslldq xmm5, xmm2, 4
vpxor xmm3, xmm3, xmm4
vpxor xmm0, xmm0, xmm3
vpxor xmm0, xmm0, xmm1
vperm2i128 ymm1, ymm2, ymm2, 0
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vperm2i128 ymm1, ymm0, ymm0, 0
vaeskeygenassist xmm4, xmm0, 8
vpshufd xmm4, xmm4, 0xff
vmovdqu ymmword [rax], ymm1
vpslldq xmm1, xmm5, 4
mov rax, qword [rsp + 0x50]
vpslldq xmm3, xmm1, 4
vpxor xmm1, xmm1, xmm5
vpxor xmm3, xmm3, xmm4
vpslldq xmm5, xmm0, 4
vpxor xmm1, xmm1, xmm3
vpxor xmm1, xmm1, xmm2
vpslldq xmm2, xmm5, 4
vaeskeygenassist xmm4, xmm1, 0
vpslldq xmm3, xmm2, 4
vpxor xmm2, xmm2, xmm5
vpshufd xmm4, xmm4, 0xaa
vinserti128 ymm1, ymm1, xmm1, 1
vmovdqu ymmword [rax], ymm1
vpxor xmm1, xmm3, xmm4
mov rax, qword [rsp + 0x58]
vpxor xmm2, xmm2, xmm1
vpxor xmm0, xmm2, xmm0
vinserti128 ymm0, ymm0, xmm0, 1
vmovdqu ymmword [rax], ymm0
vzeroupper
ret
Function at 0x140087af0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x40
mov r8, rcx
test rcx, rcx
je 0x140087bec
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140087bd3
mov eax, 0x101
lea rdi, [rcx + 0x48]
mov byte [rsp], dl
movabs r9, 0x3c6ef372fe94f82b
mov word [rsp + 2], ax
and rdi, 0xfffffffffffffff8
mov eax, ecx
movabs r10, 0xa54ff53a5f1d36f1
sub eax, edi
mov byte [rsp + 1], 0
movdqu xmm0, xmmword [0x140299120]
mov dword [rsp + 4], 0
mov qword [rsp + 8], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
lea ecx, [rax + 0xf0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov qword [r8 + 0x10], r9
xor eax, eax
movabs r9, 0x510e527fade682d1
mov qword [r8 + 0x18], r10
movabs r10, 0x9b05688c2b3e6c1f
mov qword [r8 + 0x20], r9
pxor xmm0, xmmword [rsp]
movabs r9, 0x1f83d9abfb41bd6b
mov qword [r8 + 0x28], r10
movabs r10, 0x5be0cd19137e2179
mov qword [r8 + 0x30], r9
mov qword [r8 + 0x38], r10
mov dword [r8 + 0xe4], edx
movups xmmword [r8], xmm0
add rsp, 0x40
pop rdi
ret
cmp byte [rcx + 0xe8], 0
je 0x140087be4
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [r8 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x140087bcd
Function at 0x140089800
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r12, rdx
lea rax, [r8 + 1]
mov rsi, rcx
mov rbx, r8
movabs rdx, 0x5851f42d4c957f2d
lea r13, [rcx + 0x20]
lea rdi, [rsp + 0x20]
imul rax, rdx
lea rbp, [rcx + 0xc3e0]
movabs rdx, 0x810a978a59f5a1fc
xor rdx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa77099df38c2d846
xor rdx, rax
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8126b91cbf22495c
xor rdx, rax
mov qword [rsp + 0x38], rdx
movabs rdx, 0x494d2597179f8a62
xor rdx, rax
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9237efb9ceaaec0c
xor rdx, rax
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2f2a56746ce62d78
xor rdx, rax
mov qword [rsp + 0x50], rdx
movabs rdx, 0x84853bf7b62ce54e
xor rax, rdx
mov qword [rsp + 0x58], rax
nop word [rax + rax]
and ebx, 0x3fffff
mov rdx, r13
mov rcx, rdi
add r13, 0x1878
shl rbx, 6
add rbx, qword [rsi]
prefetchnta byte [rbx]
call fcn.14008b840
mov rax, qword [rbx]
xor qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x58], rax
movsxd rax, dword [r13 - 0x64]
mov rbx, qword [rsp + rax*8 + 0x20]
cmp rbp, r13
jne 0x1400898c0
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmm1, xmmword [rsp + 0x30]
movdqu xmm2, xmmword [rsp + 0x40]
movdqu xmm3, xmmword [rsp + 0x50]
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12 + 0x20], xmm2
movups xmmword [r12 + 0x30], xmm3
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14009bec0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rcx]
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
stmxcsr dword [rsp]
mov dword [rsp + 4], 0x5f80
ldmxcsr dword [rsp + 4]
mov rax, qword [rcx + 0x30]
mov r9, rcx
xor rax, qword [rcx + 0x10]
mov esi, 0x80000
mov r8, qword [rcx + 0x20]
mov r13d, 0x80000001
xor r8, qword [rcx]
mov r11, qword [rcx + 0x28]
mov r10, r8
mov rdx, qword [rcx + 0x38]
movq xmm4, rax
xor rdx, qword [rcx + 0x18]
xor r11, qword [rcx + 8]
mov rbx, qword [rcx + 0xe0]
mov rax, qword [r9 + 0x50]
xor rax, qword [r9 + 0x40]
movq xmm0, rdx
mov rcx, qword [rcx + 0x58]
xor rcx, qword [r9 + 0x48]
movq xmm3, qword [r9 + 0x68]
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
and r10d, 0x1ffff0
movq xmm5, rax
xor eax, eax
mov qword [rsp + 0x10], rax
mov ax, 0x3ff
shl rax, 0x34
movq xmm8, rax
mov r15, qword [r9 + 0x60]
punpcklqdq xmm4, xmm0
movq xmm0, rcx
punpcklqdq xmm5, xmm0
movdqu xmm6, xmmword [r10 + rbx]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400a4600
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov r13, rdx
mov rbp, r8
call sub.msvcrt.dll_wcslen
mov rdi, rax
mov rbx, rax
jmp 0x1400a4640
lea rsi, [rbx - 1]
movzx edx, word [r12 + rsi*2]
cmp dx, 0x2f
je 0x1400a46b0
cmp dx, 0x5c
je 0x1400a46b0
mov rbx, rsi
test rbx, rbx
jne 0x1400a4628
test r13, r13
je 0x1400a4689
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call rbx
mov r14d, eax
test eax, eax
je 0x1400a472e
mov ecx, eax
add rcx, rcx
call fcn.14009f970
mov qword [r13], rax
mov rdx, rax
test rax, rax
je 0x1400a474d
mov ecx, r14d
call rbx
test eax, eax
je 0x1400a4735
mov rcx, r12
call sub.msvcrt.dll__wcsdup
mov qword [rbp], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test rsi, rsi
je 0x1400a4645
test r13, r13
je 0x1400a46ea
lea r14, [rbx + rbx + 2]
mov rcx, r14
call fcn.14009f970
mov qword [r13], rax
mov rcx, rax
test rax, rax
je 0x1400a474d
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_wcsncpy
mov rax, qword [r13]
xor ecx, ecx
mov word [rax + r14 - 2], cx
sub rdi, rsi
lea rsi, [rdi + rdi]
mov rcx, rsi
call fcn.14009f970
mov qword [rbp], rax
mov rcx, rax
test rax, rax
je 0x1400a474d
lea rdx, [r12 + rbx*2]
lea r8, [rdi - 1]
call sub.msvcrt.dll_wcsncpy
mov rax, qword [rbp]
xor edx, edx
mov word [rax + rsi - 2], dx
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 0xffffffff
jmp 0x1400a471f
mov rcx, qword [r13]
call fcn.14009f990
mov qword [r13], 0
mov eax, 0xffffffff
jmp 0x1400a471f
lea rdx, [0x14029d520]
mov ecx, 0xe
call fcn.1400a4140
nop
nop
Function at 0x1400a6240
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x140587f00]
mov dword [0x1402feee0], eax
call fcn.1400bc290
test eax, eax
jne 0x1400a62a0
lea rax, [0x1402fff00]
lea rdx, [0x1402fef00]
lea rcx, [rax + 0x288000]
nop
mov qword [rdx + 8], rax
add rax, 0x2880
add rdx, 0x10
mov qword [rdx - 0x10], 0
cmp rax, rcx
jne 0x1400a6280
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.1400a4140
nop
nop
Function at 0x1400ae100
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x40]
mov rbx, rcx
mov qword [rcx + 0x48], 0
mov rcx, qword [rcx + 0x38]
lea r9, [rbx + 0x48]
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
cmp eax, 0x273f
je 0x1400ae1f0
jle 0x1400ae160
cmp eax, 0x2afa
je 0x1400ae1d0
jle 0x1400ae180
cmp eax, 0x2afb
jne 0x1400ae1e0
mov eax, 0xfffff444
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x2726
je 0x1400ae1c0
jle 0x1400ae1a0
cmp eax, 0x273c
jne 0x1400ae1e0
mov eax, 0xfffff43d
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x277d
je 0x1400ae1b0
cmp eax, 0x2af9
jne 0x1400ae1e0
mov eax, 0xfffff440
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
test eax, eax
je 0x1400ae150
cmp eax, 8
jne 0x1400ae1e0
mov eax, 0xfffff442
jmp 0x1400ae150
mov eax, 0xfffff43e
jmp 0x1400ae150
mov eax, 0xfffff446
jmp 0x1400ae150
mov eax, 0xfffff447
jmp 0x1400ae150
mov ecx, eax
call fcn.1400a4200
jmp 0x1400ae150
mov eax, 0xfffff443
jmp 0x1400ae150

Function at 0x1400af4b0
Capabilities:
Create pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp qword [r8 + 0x70], 0xffffffffffffffff
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
mov edi, r9d
je 0x1400af4e5
mov r8d, 0x212
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle__INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
cmp edi, 1
mov rcx, qword [rsi + 0x120]
mov qword [rsp + 0x38], 0
mov r9d, 0xff
sbb edx, edx
mov dword [rsp + 0x30], 0
xor r8d, r8d
and edx, 0xfff80000
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
add edx, 0x400c0003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400af570
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x1400af57b
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x118], rax
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateIoCompletionPort
mov ecx, eax
call fcn.1400a4140
nop
Function at 0x1400af600
Capabilities:
Connect pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rdi, rdx
mov rbx, r8
mov esi, r9d
test byte [rdx + 0x58], 0x40
je 0x1400af670
test esi, esi
je 0x1400af68e
cmp qword [rbx + 0x70], 0xffffffffffffffff
je 0x1400af730
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400af6d0
mov eax, dword [rdi + 0x78]
add eax, 1
mov dword [rdi + 0x78], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x3f7
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029dcd8]
call qword [sym.imp.msvcrt.dll__assert]
test esi, esi
jne 0x1400af61e
xor r9d, r9d
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.1400af4b0
test eax, eax
jne 0x1400af61e
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
test eax, eax
jle 0x1400af77c
call rsi
movzx eax, ax
or eax, 0x80070000
cdqe
jmp 0x1400af6f4
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
je 0x1400af65b
call rsi
mov r8d, eax
xor eax, eax
cmp r8d, 0x217
jne 0x1400af760
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1400af750
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rbp + 0x48], rbx
mov eax, dword [rdi + 0x78]
add eax, 1
mov dword [rdi + 0x78], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x400
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400af629
mov qword [rbx + 0x68], rbx
jmp 0x1400af719
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call rsi
test eax, eax
jg 0x1400af6b8
call rsi
cdqe
jmp 0x1400af6f4

Function at 0x1400affb0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
mov rbp, rcx
mov rdi, rdx
lea r13, [rsp + 0x4c]
mov esi, r8d
nop dword [rax + rax]
mov edx, ebx
mov r8d, esi
mov r9, r13
mov rcx, rbp
mov qword [rsp + 0x20], 0
add rdx, rdi
sub r8d, ebx
call r12
test eax, eax
je 0x1400b0050
add ebx, dword [rsp + 0x4c]
cmp esi, ebx
ja 0x1400affd8
mov eax, 0
jne 0x1400b0018
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x72f
lea rdx, str.src_win_pipe.c
lea rcx, str.bytes_read__count
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400b0ab0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rdx + 0x58]
mov rsi, rcx
mov rbx, rdx
test ah, 0x10
je 0x1400b0c90
test eax, 0x10000
jne 0x1400b0cb8
cmp qword [rbx + 0x118], 0xffffffffffffffff
je 0x1400b0ce0
mov eax, dword [rbx + 0x58]
lea rdi, [rbx + 0x80]
test eax, 0x1000000
je 0x1400b0b68
mov r8d, 0x10
mov rdx, rdi
mov qword [rbx + 0x238], 0
lea rcx, [0x1400af790]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x1400b0c30
mov eax, dword [rbx + 0x58]
test al, 0x80
je 0x1400b0d00
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x1400b0b49
xor r9d, r9d
mov r8d, 0x32
lea rdx, [0x1400b0d90]
call fcn.14009f210
or dword [rbx + 0x58], 0x10000
mov eax, dword [rbx + 0x78]
add eax, 1
mov dword [rbx + 0x78], eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rbx + 0xc0]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xc8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
test eax, 0x80000
je 0x1400b0bb7
mov rax, qword [rbx + 0xf0]
test rax, rax
je 0x1400b0d60
or rax, 1
mov qword [rbx + 0xd8], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, qword [rbx + 0x118]
lea rdx, [0x140587f40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b0d20
mov eax, dword [rbx + 0x58]
test eax, 0x80000
je 0x1400b0b20
cmp qword [rbx + 0xf8], 0xffffffffffffffff
jne 0x1400b0b20
mov dword [rsp + 0x28], 4
mov rdx, qword [rbx + 0xf0]
lea rcx, [rbx + 0xf8]
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x1400af2e0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1400b0b1d
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
test eax, eax
jle 0x1400b0d40
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xe8], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400b0d50
mov rax, qword [rax + 0x68]
mov qword [rbx + 0xe8], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1400b0b49
mov r8d, 0x508
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029df18]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x58]
test eax, 0x10000
je 0x1400b0ad5
mov r8d, 0x509
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029df40]
call qword [sym.imp.msvcrt.dll__assert]
cmp qword [rbx + 0x118], 0xffffffffffffffff
jne 0x1400b0ae3
mov r8d, 0x50b
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b0ae3
mov r8d, 0x89d
lea rdx, str.src_win_pipe.c
lea rcx, str.pipe__flags__UV_HANDLE_CONNECTION
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b0b28
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x1400b0bde
jmp 0x1400b0c37
call rbp
cdqe
jmp 0x1400b0c4d
mov qword [rbx + 0xe8], rdi
jmp 0x1400b0c7f
mov r8d, 0x51b
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029df6a]
call qword [sym.imp.msvcrt.dll__assert]
mov rax, qword [rbx + 0xf0]
jmp 0x1400b0bac
Function at 0x1400b0fc0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov r12, rcx
mov ebx, edx
mov edi, r8d
xor edx, edx
xor r8d, r8d
lea rsi, [rsp + 0x50]
mov rcx, rbp
call fcn.14009fb30
movdqu xmm0, xmmword [rsp + 0x30]
mov edx, ebx
mov r8, rsi
mov rcx, r12
movups xmmword [rsp + 0x50], xmm0
call qword [r12 + 0x68]
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1400b1015
mov r8d, dword [rsp + 0x50]
test r8d, r8d
jne 0x1400b1038
mov r8, rsi
mov rdx, 0xfffffffffffff024
mov rcx, r12
call qword [r12 + 0x70]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r8d, edi
mov rcx, qword [r12 + 0x118]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
cmova r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b1080
mov edx, dword [rsp + 0x4c]
mov r8, rsi
mov rcx, r12
call qword [r12 + 0x70]
mov eax, dword [rsp + 0x4c]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqu xmm1, xmmword [rsp + 0x50]
mov r8, rbp
mov rcx, r12
mov edx, eax
movups xmmword [rsp + 0x30], xmm1
call fcn.1400b0e90
xor eax, eax
jmp 0x1400b1029

Function at 0x1400b2fb0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r13, rdx
mov edx, dword [r8 + 0x110]
mov r12, rcx
mov rbx, r8
test edx, edx
jne 0x1400b3048
test rax, rax
je 0x1400b3010
mov qword [rsp + 0x28], r9
mov r8d, 0x6e2
lea rdx, str.src_win_pipe.c
lea rcx, str.send_handle__NULL
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x28]
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400b0070
mov rdx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400b2b70
Function at 0x1400b3060
Capabilities:
Read file on windows
Read pipe

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
cmp dword [rdx + 0x10], 7
mov r13, rcx
mov r12, rdx
mov rbx, r8
je 0x1400b3092
mov r8d, 0x7ab
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__type__UV_NAMED_PIPE
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [r12 + 0x58]
mov edx, dword [r12 + 0x78]
and eax, 0xffdeffff
mov dword [r12 + 0x58], eax
test edx, edx
je 0x1400b3210
sub edx, 1
mov dword [r12 + 0x78], edx
jne 0x1400b30c0
test al, 1
jne 0x1400b31c0
test al, 0x80
je 0x1400b31f0
mov rcx, qword [r12 + 0x128]
test rcx, rcx
je 0x1400b30da
call fcn.14009f1b0
test byte [r12 + 0x59], 0x10
je 0x1400b3117
mov rax, qword [rbx + 0x40]
mov ecx, eax
test eax, eax
jns 0x1400b3128
mov rax, qword [0x1402b0d30]
call qword [rax]
mov edx, eax
cmp eax, 0x3e3
jne 0x1400b3240
mov eax, dword [r12 + 0x58]
and eax, 0x11000
cmp eax, 0x1000
je 0x1400b326f
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
lea rax, [rsp + 0x4c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x4c], 0
mov rcx, qword [r12 + 0x118]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400b3288
mov edx, dword [rsp + 0x4c]
mov eax, dword [r12 + 0x58]
test edx, edx
jne 0x1400b3194
jmp 0x1400b3107
mov rcx, r12
call fcn.1400b10b0
test eax, eax
je 0x1400b3102
mov edx, dword [rsp + 0x4c]
cmp edx, eax
jb 0x1400b3102
sub edx, eax
mov dword [rsp + 0x4c], edx
je 0x1400b3102
mov eax, dword [r12 + 0x58]
test ah, 0x10
je 0x1400b3107
mov eax, dword [r12 + 0x110]
test eax, eax
jne 0x1400b3170
mov r8d, 0xffffffff
mov rcx, r12
call fcn.1400b0fc0
jmp 0x1400b3178
test al, 0x20
jne 0x1400b30c0
or eax, 0x20
mov dword [r12 + 0x58], eax
mov rax, qword [r13 + 0x50]
mov qword [r12 + 0x50], rax
mov qword [r13 + 0x50], r12
mov eax, dword [r12 + 0x58]
test al, 0x80
jne 0x1400b30c8
nop word [rax + rax]
mov r8d, 0x8a6
lea rdx, str.src_win_pipe.c
lea rcx, str.pipe__flags__UV_HANDLE_CONNECTION
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b30c8
lea rdx, str.src_win_pipe.c
mov r8d, 0x7ae
lea rcx, [0x14029e18a]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [r12 + 0x78]
mov eax, dword [r12 + 0x58]
jmp 0x1400b30ae
movdqu xmm0, xmmword [0x14029e310]
lea r8, [rsp + 0x30]
mov rcx, r12
movups xmmword [rsp + 0x30], xmm0
call fcn.1400b0e90
mov eax, dword [r12 + 0x58]
and eax, 0x11000
cmp eax, 0x1000
jne 0x1400b3117
mov rdx, r12
mov rcx, r13
add rsp, 0x50
pop rbx
pop r12
pop r13
jmp fcn.1400b0ab0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqu xmm1, xmmword [0x14029e310]
lea r8, [rsp + 0x30]
mov rcx, r12
mov edx, eax
movups xmmword [rsp + 0x30], xmm1
call fcn.1400b0e90
jmp 0x1400b3161