joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401145f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r9
test r8, r8
mov edi, 1
cmovne rdi, r8
mov rax, rdi
add rax, r9
jae 0x140114632
mov rdx, qword [str.SanitizerTool]
lea rcx, str.WARNING:__s:_CombinedAllocator_allocation_overflow:_0x_zx_bytes_with_0x_zx_alignment_requested_n
mov r8, rdi
mov r9, rsi
call fcn.1400ef4b0
xor eax, eax
jmp 0x140114725
mov r14, rdx
mov r15, rcx
mov rax, rdi
cmp rsi, 9
jb 0x14011464c
mov rcx, rdi
mov rdx, rsi
call fcn.14011adb0
cmp rsi, 0x20000
ja 0x14011466f
cmp rax, 0x20000
ja 0x14011466f
cmp rax, 0x100
ja 0x14011469a
add rax, 0xf
shr rax, 4
jmp 0x1401146d3
lea rcx, [r15 + 0x40dc0]
add r15, 0x81008
mov rdx, r15
mov r8, rdi
mov r9, rsi
call fcn.140114aa0
cmp rsi, 9
jae 0x14011471c
jmp 0x140114725
bsr rdx, rax
xor rdx, 0x3f
mov cl, 0x3d
sub cl, dl
mov rbx, rax
shr rbx, cl
and ebx, 3
mov edi, 0xffffffff
shl edi, cl
not edi
and eax, edi
xor rdx, 0x3f
shl rdx, 2
or rdx, rbx
cmp eax, 1
sbb rdx, 0xffffffffffffffff
add rdx, 0xfffffffffffffff0
mov rax, rdx
test rax, rax
je 0x140114731
cmp rax, 0x36
jae 0x140114755
mov rbx, rax
shl rbx, 0xa
lea rdi, [r14 + rbx]
mov rcx, qword [r14 + rbx]
test rcx, rcx
je 0x14011479d
lea rax, [rcx - 1]
mov qword [rdi], rax
mov rdx, qword [rdi + rcx*8 + 0x10]
mov rax, qword [rdi + rcx*8 + 0x18]
prefetchnta byte [rdx]
mov rcx, qword [r14 + rbx + 0x10]
add qword [r14 + 0xd810], rcx
cmp rsi, 9
jb 0x140114725
add rsi, 0xffffffffffffffff
and rsi, rax
jne 0x140114779
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_allocator_local_cache.h
lea r8, str.__class_id_______0UL__
mov edx, 0xa0
xor r9d, r9d
call fcn.1400c31d0
mov qword [rsp + 0x20], 0x36
lea rcx, str....._sanitizer_common_sanitizer_allocator_local_cache.h
lea r8, str.__class_id_______kNumClasses__
mov edx, 0xa1
mov r9, rax
call fcn.1400c31d0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_allocator_combined.h
lea r8, str.__reinterpret_cast_uptr__res____alignment___1_______0__
mov edx, 0x49
mov r9, rsi
call fcn.1400c31d0
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9, rax
call fcn.140118690
test al, al
je 0x1401147ba
mov rcx, qword [rdi]
jmp 0x1401146f6
xor eax, eax
cmp rsi, 9
jae 0x14011471c
jmp 0x140114725
Function at 0x1401161b0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
test rdx, rdx
je 0x140116368
mov rdi, rdx
mov rsi, rcx
mov r9, qword [rcx + 0x10]
cmp r9, rdx
ja 0x14011638c
shl rdi, 5
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x1401161fb
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
mov rcx, rdi
call fcn.14011adb0
mov r14, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401163a9
mov rbx, rax
mov rcx, qword [rsi]
mov rdi, qword [rsi + 0x10]
shl rdi, 5
je 0x14011634e
lea rax, [rcx + rdi]
cmp rbx, rax
jae 0x140116280
lea rax, [rbx + rdi]
cmp rcx, rax
jae 0x140116280
xor eax, eax
nop
movzx edx, byte [rcx + rax]
mov byte [rbx + rax], dl
movzx edx, byte [rcx + rax + 1]
mov byte [rbx + rax + 1], dl
movzx edx, byte [rcx + rax + 2]
mov byte [rbx + rax + 2], dl
movzx edx, byte [rcx + rax + 3]
mov byte [rbx + rax + 3], dl
add rax, 4
cmp rdi, rax
jne 0x140116250
jmp 0x14011634b
add rdi, 0xffffffffffffffe0
mov rdx, rdi
shr rdx, 5
add rdx, 1
mov eax, edx
and eax, 3
cmp rdi, 0x60
jae 0x14011629e
xor edi, edi
jmp 0x140116308
and rdx, 0xfffffffffffffffc
xor edi, edi
nop word cs:[rax + rax]
nop
movups xmm0, xmmword [rcx + rdi]
movups xmm1, xmmword [rcx + rdi + 0x10]
movups xmmword [rbx + rdi], xmm0
movups xmmword [rbx + rdi + 0x10], xmm1
movups xmm0, xmmword [rcx + rdi + 0x20]
movups xmm1, xmmword [rcx + rdi + 0x30]
movups xmmword [rbx + rdi + 0x20], xmm0
movups xmmword [rbx + rdi + 0x30], xmm1
movups xmm0, xmmword [rcx + rdi + 0x40]
movups xmm1, xmmword [rcx + rdi + 0x50]
movups xmmword [rbx + rdi + 0x40], xmm0
movups xmmword [rbx + rdi + 0x50], xmm1
movups xmm0, xmmword [rcx + rdi + 0x60]
movups xmm1, xmmword [rcx + rdi + 0x70]
movups xmmword [rbx + rdi + 0x60], xmm0
movups xmmword [rbx + rdi + 0x70], xmm1
sub rdi, 0xffffffffffffff80
add rdx, 0xfffffffffffffffc
jne 0x1401162b0
test rax, rax
je 0x14011634b
lea rdx, [rbx + rdi]
add rdx, 0x10
add rcx, rdi
add rcx, 0x10
shl rax, 5
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
movups xmm0, xmmword [rcx + rdi - 0x10]
movups xmm1, xmmword [rcx + rdi]
movups xmmword [rdx + rdi - 0x10], xmm0
movups xmmword [rdx + rdi], xmm1
add rdi, 0x20
cmp rax, rdi
jne 0x140116330
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.1400d8c00
mov qword [rsi], rbx
mov qword [rsi + 8], r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__new_capacity_______0__
mov edx, 0x245
xor r9d, r9d
call fcn.1400c31d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________new_capacity__
mov edx, 0x246
call fcn.1400c31d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.InternalMmapVector
lea r8, str.allocate
mov rcx, r14
mov r9d, eax
call fcn.1400efa80
int3
Function at 0x140119690
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x1401196d4
mov eax, ebp
lea rbx, [rax*8]
shl rax, 4
lea rsi, [rax + rax*2]
mov rdi, qword [0x140dab558]
test rdi, rdi
je 0x1401196e0
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
jbe 0x140119703
jmp 0x14011978d
mov qword [r14], 0
jmp 0x1401197d5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
ja 0x14011978d
test rdi, rdi
jne 0x14011971e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
cmp rbx, rdi
ja 0x1401197e7
mov rax, rdi
or rax, rbx
shr rax, 0x20
je 0x14011973d
mov rax, rdi
xor edx, edx
div rbx
jmp 0x140119743
mov eax, edi
xor edx, edx
div ebx
bsr rcx, rax
shl rbx, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 3
lea rax, [rax + rax*2]
cmp rbx, rax
jne 0x14011980b
lea r15, [rbx + rbx]
test rdi, rdi
jne 0x140119784
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
cmp r15, rdi
jbe 0x14011982b
test rdi, rdi
jne 0x1401197a8
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
mov rcx, rbx
mov rdx, rdi
call fcn.14011adb0
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011984b
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x191
xor r9d, r9d
call fcn.1400c31d0
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rbx
call fcn.1400c31d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call fcn.1400c31d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call fcn.1400efa80
int3
Function at 0x140119870
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rcx
mov ebx, dword [rcx + 0x10]
mov r14, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x14011989d
mov rdx, r9
jmp 0x1401198cf
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov esi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x1401199a5
xor al, 0x3f
mov ecx, eax
shl rsi, cl
cmp rsi, r9
jae 0x1401199c2
mov rcx, rdi
call fcn.140119690
mov rax, qword [rdi]
test rax, rax
je 0x140119981
test r14, r14
je 0x140119936
shl rbx, 3
lea rbx, [rbx + rbx*2]
lea r8, [r14 + rbx]
mov rcx, rdi
mov rdx, r14
call fcn.140112360
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x140119921
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
mov rcx, rbx
call fcn.14011adb0
mov rcx, r14
mov rdx, rax
call fcn.1400d8c00
jmp 0x140119977
mov qword [rdi + 8], 0
mov ecx, dword [rdi + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x1401199df
test rcx, rcx
je 0x140119977
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
nop dword [rax + rax]
mov dword [rax], 0xffffffff
mov qword [rax + 8], 0xffffffffffffffff
add rax, 0x18
cmp rax, rcx
jne 0x140119960
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.1400c31d0
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1b9
call fcn.1400c31d0
mov qword [rsp + 0x20], rsi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1ba
call fcn.1400c31d0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.1400c31d0
int3
Function at 0x140119a10
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x140119a4b
mov esi, ebp
mov rbx, rsi
shl rbx, 5
mov rdi, qword [0x140dab558]
test rdi, rdi
je 0x140119a57
shl rsi, 4
cmp rbx, rdi
jbe 0x140119a7a
jmp 0x140119b00
mov qword [r14], 0
jmp 0x140119b48
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
shl rsi, 4
cmp rbx, rdi
ja 0x140119b00
test rdi, rdi
jne 0x140119a95
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
cmp rsi, rdi
ja 0x140119b5a
mov rax, rdi
or rax, rsi
shr rax, 0x20
je 0x140119ab4
mov rax, rdi
xor edx, edx
div rsi
jmp 0x140119aba
mov eax, edi
xor edx, edx
div esi
bsr rcx, rax
shl rsi, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 4
cmp rsi, rax
jne 0x140119b7e
lea r15, [rsi + rsi]
test rdi, rdi
jne 0x140119af7
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
cmp r15, rdi
jbe 0x140119b9e
test rdi, rdi
jne 0x140119b1b
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dab558], rdi
mov rcx, rsi
mov rdx, rdi
call fcn.14011adb0
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140119bbe
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x191
xor r9d, r9d
call fcn.1400c31d0
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rsi
call fcn.1400c31d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call fcn.1400c31d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call fcn.1400efa80
int3
Function at 0x140119bf0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov r14d, dword [rcx + 0x10]
mov rsi, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x140119c1e
mov rdx, r9
jmp 0x140119c50
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov edi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x140119d1f
xor al, 0x3f
mov ecx, eax
shl rdi, cl
cmp rdi, r9
jae 0x140119d3c
mov rcx, rbx
call fcn.140119a10
mov rax, qword [rbx]
test rax, rax
je 0x140119cfb
test rsi, rsi
je 0x140119cb3
shl r14, 4
lea r8, [rsi + r14]
mov rcx, rbx
mov rdx, rsi
call fcn.140112a30
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x140119c9e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
mov rcx, r14
call fcn.14011adb0
mov rcx, rsi
mov rdx, rax
call fcn.1400d8c00
jmp 0x140119cf1
mov qword [rbx + 8], 0
mov ecx, dword [rbx + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x140119d59
test rcx, rcx
je 0x140119cf1
shl rcx, 4
xor edx, edx
nop word cs:[rax + rax]
mov qword [rax + rdx], 0xffffffffffffffff
add rdx, 0x10
cmp rcx, rdx
jne 0x140119ce0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.1400c31d0
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1b9
call fcn.1400c31d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1ba
call fcn.1400c31d0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.1400c31d0
int3
Function at 0x14011adb0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rdx - 1]
test rdx, rax
jne 0x14011add9
lea rax, [rcx + rdx]
add rax, 0xffffffffffffffff
neg rdx
and rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x14012cde0]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011ae6f
lea rcx, [0x14012cde0]
call fcn.1400f94b0
mov rcx, qword [0x14012cde8]
cmp rcx, 0xffffffffffffffff
je 0x14011aeb6
lea rax, [rcx - 1]
cmp rax, 1
ja 0x14011ae2f
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x14011ae5a
mov qword [rsp + 0x20], 0
lea rdx, str.IsPowerOfTwo_boundary__n
lea r9, [rsp + 0x2c]
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14011ae67
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.IsPowerOfTwo_boundary__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call fcn.1400d6f10
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011ae83
add edi, 1
cmp edi, 0x63
ja 0x14011aea0
pause
cmp byte [rsi], 0
jne 0x14011ae80
jmp 0x14011aea9
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x14011ae80
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011ae80
jmp 0x14011adec
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call fcn.1400c31d0
int3

Function at 0x14011e300
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011e37e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x14011e371
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x14011e343
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
mov ecx, 0x100000
call fcn.14011adb0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011e3ac
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011e38c
add ebx, 1
cmp ebx, 0x63
ja 0x14011e395
pause
jmp 0x14011e39a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x14011e389
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011e389
jmp 0x14011e317
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400efa80
int3
Function at 0x14011e3e0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011e45e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x14011e451
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x14011e423
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
mov ecx, 0x40000
call fcn.14011adb0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011e48c
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011e46c
add ebx, 1
cmp ebx, 0x63
ja 0x14011e475
pause
jmp 0x14011e47a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x14011e469
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011e469
jmp 0x14011e3f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400efa80
int3

Function at 0x14011e4c0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011e53e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x14011e531
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x14011e503
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
mov ecx, 0x1000
call fcn.14011adb0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011e56c
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011e54c
add ebx, 1
cmp ebx, 0x63
ja 0x14011e555
pause
jmp 0x14011e55a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x14011e549
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011e549
jmp 0x14011e4d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400efa80
int3
Function at 0x14011e790
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov eax, dword [rdx + 0x400000]
mov qword [rcx], rax
xor esi, esi
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
jmp 0x14011e7ea
mov ecx, 0x100000
call fcn.14011adb0
add rsi, rax
add rbx, 1
cmp rbx, 0x8000
je 0x14011e816
mov rax, qword [rdi + rbx*8 + 0x400010]
test rax, rax
je 0x14011e7dd
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x14011e7d0
mov rcx, r15
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
jmp 0x14011e7d0
mov r15, qword [0x140e158a8]
xor edi, edi
lea rbx, [0x140dd5898]
lea r12, [rsp + 0x28]
xor ebp, ebp
jmp 0x14011e84a
mov ecx, 0x40000
call fcn.14011adb0
add rdi, rax
add rbp, 1
cmp rbp, 0x8000
je 0x14011e873
mov rax, qword [rbx + rbp*8 + 8]
test rax, rax
je 0x14011e83d
mov rdx, qword [0x140dab558]
test rdx, rdx
jne 0x14011e830
mov rcx, r12
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140dab558], rdx
jmp 0x14011e830
add rsi, r15
lea rax, [rdi + rsi]
add rax, 0x10010
mov qword [r14 + 8], rax
mov rax, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001530
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0x258
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 0x10], rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov qword [r11 + 0x18], rsi
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140001580
mov rax, qword [0x14000b0d8]
lea rsi, [0x14000b0c0]
xor ebp, ebp
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x250], rdi
cmp rdx, rax
ja 0x1400015df
lea rbx, [rdx + rdx]
mov qword [0x14000b0d0], rdx
cmp rax, 7
lea rdx, [rsp + 0x30]
mov rdi, rsi
mov r8, rbx
cmova rdi, qword [0x14000b0c0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], bp
jmp 0x1400015e9
lea r9, [rsp + 0x30]
call fcn.1400051a0
mov rdx, qword [0x14000b0d8]
mov rcx, qword [0x14000b0d0]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x140001639
cmp rdx, 7
lea rdi, [rcx + 8]
mov rbx, rsi
mov qword [0x14000b0d0], rdi
cmova rbx, qword [0x14000b0c0]
lea rdx, str.WPDNSE_
mov r8d, 0x10
lea rcx, [rbx + rcx*2]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], bp
jmp 0x140001656
lea r9, str.WPDNSE_
mov qword [rsp + 0x20], 8
mov edx, 8
mov rcx, rsi
call fcn.140005310
cmp qword [0x14000b0d8], 7
mov r8, qword [0x14000b0d0]
cmova rsi, qword [0x14000b0c0]
mov rdx, rsi
call fcn.140005500
lea rdx, [0x14000761c]
mov rcx, rax
call fcn.1400048d0
lea rcx, [0x14000b0e8]
call fcn.140004580
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x260]
test rax, rax
jne 0x1400016d8
mov rax, qword [0x14000b0e0]
xor r8d, r8d
mov edx, 2
movsxd rcx, dword [rax + 4]
lea rax, [0x14000b0e0]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140005770
add rsp, 0x258
ret