joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076e00
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, qword [0x1401054a8]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov sil, 1
test dl, dl
je 0x140076eee
mov rbx, qword [rcx + 8]
movsx rdi, dl
movzx eax, byte [0x140146360]
test al, al
je 0x140076f0f
add rdi, rbx
mov r8d, dword [0x140148868]
mov rax, rbx
shr rax, 0x20
je 0x140076e5d
mov rax, rbx
xor edx, edx
div r8
mov rcx, rax
jmp 0x140076e66
mov eax, ebx
xor edx, edx
div r8d
mov ecx, eax
mov rax, rdi
shr rax, 0x20
je 0x140076e7e
mov rax, rdi
xor edx, edx
div r8
cmp rcx, rax
jne 0x140076e8a
jmp 0x140076eee
mov eax, edi
xor edx, edx
div r8d
cmp rcx, rax
je 0x140076eee
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov rdx, rdi
xor r8d, r8d
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140076ede
xor esi, esi
cmp qword [rsp + 0x68], 0
je 0x140076eee
cmp dword [rsp + 0x48], 0
je 0x140076eee
cmp dword [rsp + 0x58], 0x1000
jne 0x140076eee
cmp dword [rsp + 0x5c], 1
setne sil
jmp 0x140076eee
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
xor esi, esi
mov rax, qword [rsp + 0x70]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140076f0a
mov eax, esi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400d58e0
lea rcx, [0x140146360]
call fcn.1400d3f14
test eax, eax
je 0x140076e3d
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x3c]
mov dword [0x140148868], eax
lea rcx, [0x140146360]
call fcn.1400d3fef
jmp 0x140076e3d
Function at 0x140076f50
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r15, qword [0x1401054a8]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx eax, byte [0x140146368]
test al, al
je 0x14007703a
mov ebx, dword [0x14014886c]
mov dword [rsp + 0x20], ebp
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8d, ebx
mov r9, r14
call fcn.140012f40
movzx eax, byte [0x1401462d8]
test al, al
je 0x140077074
lea rcx, [0x140147fe8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140148010]
lea rdx, [rsp + 0x30]
call fcn.1400770c0
test rax, rax
je 0x140076ffb
mov r14, rax
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, ebx
call fcn.1400776f0
test eax, eax
je 0x140076ffb
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov byte [rsi + 0x10], 1
jmp 0x140077009
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
lea rcx, [0x140147fe8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x60]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x1400770b8
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x140146368]
call fcn.1400d3f14
test eax, eax
je 0x140076f89
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov dword [0x14014886c], eax
lea rcx, [0x140146368]
call fcn.1400d3fef
jmp 0x140076f89
lea rcx, [0x1401462d8]
call fcn.1400d3f14
test eax, eax
je 0x140076fb5
lea rcx, [0x140147fe8]
mov edx, 0xfa0
mov r8d, 0x1000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x1401486c0], 1
lea rcx, [0x1401462d8]
call fcn.1400d3fef
jmp 0x140076fb5
call fcn.1400d58e0
int3

Function at 0x1400776f0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, qword [0x1401054a8]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x68], rax
test edx, edx
je 0x140077779
mov rsi, rcx
cmp qword [rcx], 0
jne 0x140077774
mov rdi, r8
mov ebp, edx
movzx eax, byte [0x140146368]
test al, al
je 0x14007779d
mov ecx, dword [0x14014886c]
xor ebx, ebx
mov eax, ebp
xor edx, edx
div ecx
sub ecx, edx
test edx, edx
cmove ecx, edx
add ecx, ebp
mov dword [rsi + 8], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, dword [rsi + 8]
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
mov rcx, rsi
mov rdx, rax
call fcn.1400777e0
mov qword [rsi], rax
test rax, rax
je 0x14007777b
mov ebx, dword [rsi + 8]
jmp 0x14007777b
xor ebx, ebx
mov rax, qword [rsp + 0x68]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140077798
mov eax, ebx
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400d58e0
lea rcx, [0x140146368]
call fcn.1400d3f14
test eax, eax
je 0x140077729
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
mov dword [0x14014886c], eax
lea rcx, [0x140146368]
call fcn.1400d3fef
jmp 0x140077729
Function at 0x140077ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x1401054a8]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, dword [rdx + 0x10]
shl ebx, 7
mov rcx, rdx
mov edx, ebx
mov r8d, 0x80
call fcn.140077ce0
test al, al
je 0x140077c65
mov ecx, ebx
add rcx, qword [rdi]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x80
mov byte [rsp + 0x5c], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140077c32
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
test rcx, rcx
je 0x140077c79
mov r8, qword [rsp + 0x38]
mov r9d, dword [rsp + 0x30]
movzx edx, byte [rsp + 0x5c]
test r8, r8
je 0x140077c8b
test rax, rax
je 0x140077c8b
test r9d, r9d
je 0x140077c8b
test dl, dl
jne 0x140077c88
jmp 0x140077c8b
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
jmp 0x140077cb1
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x5c]
inc dword [rdi + 0x10]
mov qword [rsi], rcx
mov dword [rsi + 8], r9d
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi + 0x20], xmm0
mov eax, dword [rsp + 0x58]
mov dword [rsi + 0x30], eax
mov byte [rsi + 0x34], dl
mov byte [rsi + 0x38], 1
mov rax, qword [rsp + 0x60]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140077cce
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400d58e0
int3
Function at 0x140077ce0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, qword [0x1401054a8]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx]
test rbx, rbx
je 0x140077d5f
mov rdi, rcx
lea ecx, [rdx + r8]
dec ecx
mov eax, dword [rdi + 0xc]
mov sil, 1
cmp ecx, eax
jb 0x140077d61
cmp eax, dword [rdi + 8]
jae 0x140077d5f
add rbx, rax
movzx eax, byte [0x140146360]
test al, al
je 0x140077d82
mov edx, dword [0x140148868]
mov rcx, rbx
mov r8d, 0x1000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140077d5f
movzx eax, byte [0x140146360]
test al, al
je 0x140077db8
mov eax, dword [0x140148868]
add dword [rdi + 0xc], eax
jmp 0x140077d61
xor esi, esi
mov rax, qword [rsp + 0x50]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140077d7d
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400d58e0
lea rcx, [0x140146360]
call fcn.1400d3f14
test eax, eax
je 0x140077d29
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [0x140148868], eax
lea rcx, [0x140146360]
call fcn.1400d3fef
jmp 0x140077d29
lea rcx, [0x140146360]
call fcn.1400d3f14
test eax, eax
je 0x140077d54
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [0x140148868], eax
lea rcx, [0x140146360]
call fcn.1400d3fef
jmp 0x140077d54
Function at 0x1400795e0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov r15, qword [0x1401054a8]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx eax, byte [0x140146360]
test al, al
je 0x140079696
mov rdi, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
test r12, r12
je 0x14007965d
shl r12, 4
add r12, rdi
mov ebx, dword [0x140148868]
lea r14, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [rax]
mov rcx, qword [rdi]
mov r8d, dword [rdi + 8]
mov rdx, rbx
mov r9, r14
call r13
add rdi, 0x10
cmp rdi, r12
jne 0x140079640
mov rdi, qword [rsi + 8]
mov qword [rsi + 0x10], 0
add rsi, 0x20
cmp rdi, rsi
je 0x140079676
mov rcx, rdi
call sub.mozglue.dll_free
mov rax, qword [rsp + 0x58]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x1400796d0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140146360]
call fcn.1400d3f14
test eax, eax
je 0x140079613
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
mov dword [0x140148868], eax
lea rcx, [0x140146360]
call fcn.1400d3fef
jmp 0x140079613
call fcn.1400d58e0
int3
Function at 0x140090680
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
xor edi, edi
cmp qword [rcx + 0x78], 0
je 0x1400907c9
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x14009084f
mov eax, dword [rsi + 0x9c]
test al, 0x10
jne 0x1400906e4
test al, 8
je 0x1400907c9
mov rax, qword [rsi + 0x90]
mov qword [rsp + 0x30], rax
cmp byte [rsi + 0xa2], 0
je 0x140090782
mov rbx, qword [rsi + 0x20]
sub rbx, qword [rsi + 0x18]
jmp 0x1400907a8
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x14009070a
mov rax, qword [rsi]
mov edi, 0xffffffff
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x68]
cmp eax, 0xffffffff
je 0x1400907c9
lea rdi, [rsi + 0x88]
lea r15, [rsp + 0x30]
nop word cs:[rax + rax]
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [rax + 0x28]
mov ebx, eax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, r14
jne 0x1400907c4
cmp ebx, 1
je 0x140090720
cmp ebx, 2
je 0x1400907c4
mov rcx, qword [rsi + 0x78]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov edi, 0
test eax, eax
jne 0x1400907c4
jmp 0x1400907c9
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r9, qword [rsi + 0x48]
mov rbx, qword [rsi + 0x50]
sub rbx, r9
test eax, eax
jle 0x140090810
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rbx, rcx
xor ebp, ebp
mov rcx, qword [rsi + 0x78]
neg rbx
mov rdx, rbx
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
je 0x1400907d8
mov edi, 0xffffffff
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test bpl, bpl
je 0x1400907e9
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x88], rax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x9c], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
jmp 0x1400907c9
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x1400907a8
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rax, qword [rsi + 0x10]
mov r10, qword [rcx]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [r10 + 0x40]
cdqe
add rbx, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rbx, rax
mov bpl, 1
jmp 0x1400907aa
call fcn.140090110
int3
Function at 0x1400cab80
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov rdi, rax
mov rcx, rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400cabc8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400cabc8
mov dword [rsi], 0
call fcn.140083320
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400cabf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400c82e0
mov edi, eax
mov rbx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rbx
mov dword [rax], edi
call rbx
mov edi, dword [rax]
call fcn.1400831b0
mov dword [rsi], edi
mov qword [rsi + 8], rax
mov al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400cb930
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov rdi, rcx
lea rax, str.create_directory
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
test rdx, rdx
je 0x1400cb974
mov rsi, rdx
mov dword [rdx], 0
call fcn.140083320
mov qword [rsi + 8], rax
lea rbx, [rdi + 2]
test byte [rdi], 1
mov rcx, rbx
je 0x1400cb984
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov esi, eax
test eax, eax
je 0x1400cbaed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x11
jne 0x1400cba24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebp, dword [rax]
call fcn.1400831b0
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
call fcn.140083320
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0
call fcn.140083320
mov qword [rsp + 0x40], rax
test byte [rdi], 1
je 0x1400cb9e6
mov rbx, qword [rdi + 0x10]
lea rdx, [rsp + 0x98]
mov rcx, rbx
xor r8d, r8d
call fcn.1400d1d40
cmp eax, 0xffffffff
je 0x1400cba52
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x20], xmm0
mov eax, 0xf000
and eax, dword [rsp + 0x98]
cmp eax, 0x4000
jne 0x1400cbade
jmp 0x1400cbaed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [rax]
call fcn.1400831b0
mov dword [rsp + 0x98], edi
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x98]
jmp 0x1400cbae8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call fcn.1400831b0
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
test ebx, ebx
je 0x1400cba08
cmp ebx, 2
je 0x1400cbade
cmp ebx, 0x14
je 0x1400cbade
lea rax, str.posix_stat
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x20], 0
call fcn.140083320
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0x38]
call fcn.1400d1f90
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x48]
call fcn.1400ca920
test esi, esi
sete al
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400cd3c0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
lea rax, str.remove
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 0
test rdx, rdx
je 0x1400cd402
mov rdi, rdx
mov dword [rdx], 0
call fcn.140083320
mov qword [rdi + 8], rax
test byte [rsi], 1
je 0x1400cd40d
mov rsi, qword [rsi + 0x10]
jmp 0x1400cd411
add rsi, 2
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x10000
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400cd4d8
mov rsi, rax
mov byte [rsp + 0x38], 1
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 4
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov edi, eax
test eax, eax
jne 0x1400cd48d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r14, rax
mov ecx, ebx
call fcn.1400c82e0
mov dword [r14], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
test edi, edi
jne 0x1400cd4ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
je 0x1400cd4cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [rax]
call fcn.1400831b0
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x38]
call fcn.1400ca920
xor eax, eax
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
mov ecx, esi
call fcn.1400c82e0
mov dword [rdi], eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
jne 0x1400cd4a7
jmp 0x1400cd4cc
Function at 0x1400d4b50
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.1400d5e00
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x1400d58e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, str._stack_smashing_detected_:_terminated_n
mov ecx, 2
mov r8d, 0x2c
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x1400d5910
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
Function at 0x1400de820
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
jne 0x1400de943
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x1400de88b
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
lea r14, [rcx + rax]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rdx
sub rcx, r14
mov r8, rbx
sub r8, rdx
call sub.ntdll.dll_memmove
sub rbx, r14
mov qword [rsi + 0x10], rbx
sub qword [rsi + 8], r14
jmp 0x1400de943
mov rcx, rbx
sub rcx, rax
sar rcx, 2
cmp rbx, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x1400de9ad
mov r14, rbx
shr r14, 2
lea rcx, [rbx*8]
call fcn.1400d4140
lea rdx, [rax + r14*8]
mov rcx, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
mov r10, r9
sub r10, rcx
lea r8, [rax + rbx*8]
mov rbx, rdx
sub r9, rcx
je 0x1400de923
and r10, 0xfffffffffffffff8
mov rbx, r10
add rbx, rdx
add r9, 0xfffffffffffffff8
cmp r9, 0x68
jb 0x1400de901
lea r10, [rax + r14*8]
sub r10, rcx
cmp r10, 0x20
jae 0x1400de95c
mov r10, rdx
mov r11, rcx
nop word [rax + rax]
mov rcx, qword [r11]
mov qword [r10], rcx
add r10, 8
add r11, 8
cmp r10, rbx
jne 0x1400de910
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r8
test rcx, rcx
je 0x1400de943
call fcn.1400d4220
mov rbx, qword [rsi + 0x10]
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shr r9, 3
inc r9
shl r14, 3
mov r15, r9
and r15, 0xfffffffffffffffc
lea r10, [rdx + r15*8]
lea r11, [rcx + r15*8]
add r14, rax
add r14, 0x10
xor r12d, r12d
movups xmm0, xmmword [rcx + r12*8]
movups xmm1, xmmword [rcx + r12*8 + 0x10]
movups xmmword [r14 + r12*8 - 0x10], xmm0
movups xmmword [r14 + r12*8], xmm1
add r12, 4
cmp r15, r12
jne 0x1400de980
cmp r9, r15
jne 0x1400de910
jmp 0x1400de923
call fcn.14000f870
int3
Function at 0x1400de9c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
jne 0x1400deae3
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x1400dea2d
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shl r14, 2
and r14, 0xfffffffffffffff8
lea rbx, [r8 + r14]
sub r8, rdx
sub rbx, r8
mov rcx, rbx
call sub.ntdll.dll_memmove
mov qword [rsi + 8], rbx
add qword [rsi + 0x10], r14
mov rdx, rbx
jmp 0x1400deae3
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x1400deb5d
lea rbx, [r14 + 3]
shr rbx, 2
lea rcx, [r14*8]
call fcn.1400d4140
lea rdx, [rax + rbx*8]
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
mov r11, r10
sub r11, rcx
lea r8, [rax + r14*8]
mov r9, rdx
sub r10, rcx
je 0x1400deac3
and r11, 0xfffffffffffffff8
mov r9, r11
add r9, rdx
add r10, 0xfffffffffffffff8
cmp r10, 0x68
jb 0x1400deaa5
lea r11, [rax + rbx*8]
sub r11, rcx
cmp r11, 0x20
jae 0x1400deafd
mov r11, rdx
mov r14, rcx
nop dword [rax + rax]
mov rcx, qword [r14]
mov qword [r11], rcx
add r11, 8
add r14, 8
cmp r11, r9
jne 0x1400deab0
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rcx, rcx
je 0x1400deae3
call fcn.1400d4220
mov rdx, qword [rsi + 8]
mov rax, qword [rdi]
mov qword [rdx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shr r10, 3
inc r10
shl rbx, 3
mov r15, r10
and r15, 0xfffffffffffffffc
lea r11, [rdx + r15*8]
lea r14, [rcx + r15*8]
add rbx, rax
add rbx, 0x10
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rcx + r12*8]
movups xmm1, xmmword [rcx + r12*8 + 0x10]
movups xmmword [rbx + r12*8 - 0x10], xmm0
movups xmmword [rbx + r12*8], xmm1
add r12, 4
cmp r15, r12
jne 0x1400deb30
cmp r10, r15
jne 0x1400deab0
jmp 0x1400deac3
call fcn.14000f870
int3

Function at 0x1400dec40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.1400d5e00
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3