joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031920
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x17], 0
mov rsi, rcx
jns 0x140031948
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003197b
test al, 0x10
jne 0x140031a0e
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.140031b00
xor edi, edi
jmp 0x140031a27
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
movzx r9d, byte [rdi + 0x17]
mov rax, rdi
test r9b, r9b
jns 0x1400319a0
mov rax, qword [rdi]
mov r9, qword [rdi + 8]
add r9, r9
test r9, r9
je 0x1400319c2
movzx ecx, word [rax + r9 - 2]
add r9, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x1400319bc
cmp ecx, 0x2f
jne 0x1400319a3
cmp r9, 0xfffffffffffffffe
jne 0x140031a41
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400319fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
je 0x140031aa3
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.140031b00
xor edi, edi
cmp byte [rsp + 0x57], 0
jns 0x140031a27
mov rcx, qword [rsp + 0x40]
call fcn.14008dd88
jmp 0x140031a27
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.140031b00
mov dil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008f1f0
mov eax, edi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
sar r9, 1
lea rax, [rsp + 0x67]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x28]
mov rdx, rdi
xor r8d, r8d
call fcn.140026960
cmp byte [rsp + 0x57], 0
jns 0x140031a6f
mov rcx, qword [rsp + 0x40]
call fcn.14008dd88
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rcx], xmm0
call fcn.140031920
test al, al
jne 0x1400319c2
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.140031b00
jmp 0x1400319f9
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rsi
call fcn.1400c2010
cmp byte [r14 + 0x17], 0
jns 0x140031abf
mov r14, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
setne al
and ebp, 0x10
shr ebp, 4
and bpl, al
cmp byte [rsp + 0x3f], 0
jns 0x140031aea
mov rcx, qword [rsp + 0x28]
call fcn.14008dd88
test bpl, bpl
je 0x1400319e7
jmp 0x1400319fb
Function at 0x140031b00
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.14005e700
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x14013bb10]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.140092744
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008f1f0
nop
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140033a20
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x140033c39
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x14012b0e0], rax
jne 0x140033c3c
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.14006cbe0
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140033bfb
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x140033b94
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140033b8d
lea rdx, [rsi + 0x48]
bswap rcx
mov r14d, dword [rdx + r12*8 + 0x18]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x140033c08
mov edx, ecx
and edx, 0x1fc000
je 0x140033c08
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.14006cd70
mov ecx, dword [0x14013c338]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140138ecc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008f1f0
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x140033aee
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.14007c840
test rax, rax
je 0x140033c3f
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x140033b08
mov rcx, rbx
call fcn.14006d9d0
jmp 0x140033a9e
movaps xmm0, xmmword [0x14010cb00]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.1400dbc20
mov rcx, rsi
call fcn.1400189d0
mov rcx, r14
call fcn.1400dbc90
int3
int3
xor edi, edi
jmp 0x140033b32
Function at 0x140036cc0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14013c488]
mov ecx, dword [0x140138ecc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140036d20
lea rsi, [0x14013c480]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14008f1f0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14013c488]
call fcn.14008dea0
cmp dword [0x14013c488], 0xffffffff
jne 0x140036cfc
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140091340
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14008dd4c
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14013c4d0]
mov ecx, dword [0x140138ecc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140036de0
lea r8, [0x14013c4a0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140036ee0
mov qword [0x14013c480], rsi
lea rcx, [0x14013c488]
call fcn.14008df38
jmp 0x140036cfc
lea rcx, [0x14013c4d0]
call fcn.14008dea0
cmp dword [0x14013c4d0], 0xffffffff
jne 0x140036db1
xorps xmm0, xmm0
movups xmmword [0x14013c4c0], xmm0
movups xmmword [0x14013c4b0], xmm0
movups xmmword [0x14013c4a0], xmm0
lea rcx, [0x14013c4a0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14013c4d0]
call fcn.14008df38
jmp 0x140036db1

Function at 0x140036e30
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14013c4d0]
mov ecx, dword [0x140138ecc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140036e6b
movzx eax, word [0x14013c4a0]
cmp eax, 9
jne 0x140036eb3
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14013c4d0]
call fcn.14008dea0
cmp dword [0x14013c4d0], 0xffffffff
jne 0x140036e55
xorps xmm0, xmm0
movups xmmword [0x14013c4c0], xmm0
movups xmmword [0x14013c4b0], xmm0
movups xmmword [0x14013c4a0], xmm0
lea rcx, [0x14013c4a0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14013c4d0]
call fcn.14008df38
jmp 0x140036e55
test eax, eax
je 0x140036e66
cmp eax, 6
jne 0x140036ec3
mov eax, 2
jmp 0x140036e66
cmp eax, 0xc
jne 0x140036ecf
mov eax, 3
jmp 0x140036e66
mov eax, 4
jmp 0x140036e66
Function at 0x140037790
Capabilities:
Create thread

Disassembly:
jmp 0x140037790
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14008dd4c
mov rsi, rax
movabs r12, 0xfffffffc00000000
mov rax, r15
and rax, r12
cmp rax, qword [0x140137148]
je 0x14003785e
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x140037c50]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140037868
test r14, r14
je 0x1400378ac
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008f1f0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.14005efd0
jmp 0x1400377f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x140037881
mov ebp, eax
cmp eax, 0x5af
je 0x140037881
cmp ebp, 0xe
jne 0x1400378b7
mov rcx, rbx
call fcn.1400df950
test rsi, rsi
je 0x140037838
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x140137148]
jne 0x1400378a2
call fcn.14005f120
mov rcx, rsi
call fcn.14008dd88
jmp 0x140037838
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140037838
mov eax, dword [0x14013c528]
mov ecx, dword [0x140138ecc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003792a
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.14003ab70
movzx eax, byte [rbx + 0x17]
test al, al
mov rcx, qword [rbx]
cmovns rcx, rbx
cmovs rax, qword [rbx + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x14013c520]
call fcn.14007c410
cmp byte [rbx + 0x17], 0
jns 0x140037889
mov rcx, qword [rsp + 0x38]
call fcn.14008dd88
jmp 0x140037889
lea rcx, [0x14013c528]
call fcn.14008dea0
cmp dword [0x14013c528], 0xffffffff
jne 0x1400378d8
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400448f0
mov qword [0x14013c520], rax
lea rcx, [0x14013c528]
call fcn.14008df38
jmp 0x1400378d8
Function at 0x140038170
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x14010c310]
mov qword [rcx], rax
add rcx, 8
call fcn.140074cd0
lea rcx, [rsi + 0x10]
call fcn.140074cd0
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140074cd0
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xd0], ebp
mov dword [rsi + 0xd8], ebx
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebp
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebp
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebp
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebp
mov qword [rsi + 0x198], rbx
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebx
mov eax, dword [0x140117030]
mov dword [rsi + 0x1a0], eax
lea rcx, [rsi + 0x1a8]
call fcn.14004e280
movups xmmword [rsi + 0x2e0], xmm6
movups xmmword [rsi + 0x2f0], xmm6
mov dword [rsi + 0x300], ebp
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
movups xmmword [rsi + 0x328], xmm6
mov byte [rsi + 0x338], bl
mov dword [rsi + 0x33c], edi
mov byte [rsi + 0x340], bl
movups xmmword [rsi + 0x348], xmm6
mov qword [rsi + 0x358], rbx
call fcn.1400189d0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov edx, dword [rsi + 0x1a0]
mov rax, qword [rsi + 0x1b0]
mov rcx, rax
shr rcx, 6
test dword [0x140117034], edx
je 0x14003836b
cmp rax, 0x40
mov eax, 0x3e8
cmovb rcx, rax
call fcn.14007fe50
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14003838f
call fcn.14004de30
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.14004dee0
mov qword [0x14013c8a8], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
test dword [0x140117038], edx
jne 0x1400383a2
test dword [0x14011703c], edx
jne 0x1400383b0
cmp rax, 0x40
mov eax, 0xfa0
cmovb rcx, rax
call fcn.14004e070
jmp 0x14003832c
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x14014f008]
jmp 0x140038339
cmp rax, 0x40
mov eax, 0x100
jmp 0x140038323
cmp rax, 0x40
mov eax, 0x7a1200
jmp 0x140038384
Function at 0x140039c20
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x140039c50
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x140039c5e
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140073b40
lea rax, [rdx - 1]
test rdx, rax
jne 0x140039c74
mov rdi, rdx
jmp 0x140039c35
jae 0x140039d61
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x140039c81
cvtsi2ss xmm0, rax
jmp 0x140039c96
mov rcx, rdx
call fcn.1400625f0
mov rdi, rax
jmp 0x140039c35
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.1400c1040
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1401102b8]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x140039d49
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x140039d49
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x140039d51
mov rcx, rdx
call fcn.1400625f0
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x140039c3e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003a2d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x50]
mov qword [r14 + 0x40], r12
movaps xmm0, xmmword [0x14010cb00]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x97
call fcn.140070830
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140072010
test esi, esi
js 0x14003a3da
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.1400807b0
test al, al
jne 0x14003a3e1
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.140080840
lea rcx, [rsp + 0x50]
call fcn.140072240
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008f1f0
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14003a3ad
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400eb540
jmp 0x14003a372
Function at 0x14003a540
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x14010cb00]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x173
call fcn.140070830
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140072010
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov edx, 1
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov r8d, 2
cmove r8d, edx
test bl, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x14003a7ba
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov r8d, ebx
rol r8d, 0x1a
and r8d, 0x80000100
or r8d, ecx
bt ebx, 0x12
jb 0x14003a78f
mov edx, ebx
shr edx, 4
and edx, 0x10000
or edx, r8d
mov ecx, ebx
shr ecx, 8
and ecx, 3
mov r8d, ebx
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r15d, ebx
and r15d, 0x400
mov ecx, r15d
shl ecx, 0x14
mov r9d, ebx
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, ebx
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r10d, ebx
shl r10d, 0xd
and r10d, 0x4000000
or r10d, ecx
mov r9d, ebx
shl r9d, 8
and r9d, 0xa000000
or r9d, r10d
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x14003a6b1
mov rcx, qword [rdi]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp qword [rsi], rax
je 0x14003a70b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003a7a1
mov rax, r14
inc rax
cmp rax, 2
jb 0x14003a700
mov qword [rsi], r14
call fcn.140070850
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
inc r14
cmp r14, 2
jb 0x14003a762
shr r15d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r15b
test bl, 4
jne 0x14003a774
test bl, 0xa
je 0x14003a731
mov byte [rsi + 0x28], 1
bt ebx, 0x15
jb 0x14003a785
lea rcx, [rsp + 0x60]
call fcn.140072240
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14008f1f0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003a400
mov dword [rsi + 0x24], eax
jmp 0x14003a737
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x14003a731
mov rcx, rdi
call fcn.140028770
jmp 0x14003a737
bt ebx, 0x15
jb 0x14003a7d6
or r8d, 0x20000000
jmp 0x14003a62f
call fcn.140070850
mov rcx, qword [rsi]
call fcn.140072520
mov qword [rsi], 0
jmp 0x14003a6ec
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
call fcn.1400db190
jmp 0x14003a737
int3
Function at 0x14003a9d0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400745a0
mov qword [rsi], 0
test rax, rax
je 0x14003aa23
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003aa57
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14003aa1b
mov qword [rsi], rbx
call fcn.140070850
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14006a050
lea rcx, [rsi + 0x20]
call fcn.1400807d0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140070850
mov rcx, qword [rsi]
call fcn.140072520
mov qword [rsi], 0
jmp 0x14003aa09
Function at 0x140042170
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1400421af
test r15, r15
je 0x14004229d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1400421f9
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.140090c90
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x14004218d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1400422c9
lea rcx, [r12*8]
call fcn.14008dd4c
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x14004226d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x14004229d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x140042255
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x14004218d
mov rcx, r14
call fcn.14008dd88
mov r15, qword [rsi + 0x10]
jmp 0x14004218d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1400c29f0
call fcn.1400c2170
int3
Function at 0x140044a30
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x14010cb00]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x140044bac
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x140140200]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1400ae164
mov rcx, rbx
call fcn.1400add10
sub r14, rax
lea rdx, [0x1401109aa]
mov rcx, rbx
mov r8, r14
call fcn.1400ae164
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140091340
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140044b0c
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400ae1ac
test eax, eax
je 0x140044bd0
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140044b47
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400ae1ac
test eax, eax
je 0x140044bd0
xor eax, eax
mov byte [0x14013fdf5], al
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140113b42]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140044bd7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14014f008]
test eax, eax
je 0x140044bd7
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x140140400], al
mov byte [0x14013fdf4], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008f1f0
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x140044b49
xor eax, eax
jmp 0x140044b9f