joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442bd0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov ebx, r8d
mov r12, rdx
mov rdi, rcx
mov rax, qword [0x011e4068]
test rax, rax
jne 0x442c08
lea rcx, [rsp + 0x48]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x4c]
mov qword [0x011e4068], rax
cmp rax, 0x8001
mov ecx, 0x8000
cmovae rcx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rcx, r12
call fcn.0043b360
test al, al
je 0x442cd2
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x442d0b
mov r14, qword [rdi + 0x10]
mov r15, qword [rdi + 0x18]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0
xor eax, eax
movabs rsi, 0x400100100002600
mov rcx, rbx
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
jbe 0x442ca3
jmp 0x442cae
mov qword [rdi + 0x18], rax
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
ja 0x442cae
bt rsi, rdx
jb 0x442c90
test rdx, rdx
je 0x442cf0
mov rcx, rdi
mov rdx, r12
call fcn.00442080
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
jbe 0x442ca3
jmp 0x442cae
mov al, 1
test bl, bl
jne 0x442d1a
mov r8d, dword [rsp + 0x34]
lea rcx, str.Failed_to_read_options_from__s:_error__d_n
mov rdx, r12
call fcn.0041ba00
xor eax, eax
jmp 0x442d1a
cmp dword [0x0074d3c4], 0
jg 0x442d03
mov dword [0x0074d3c4], 1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r15
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.0041d560
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x4442e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov ecx, 0xfffffff4
call qword [sym.imp.kernel32.dll_GetStdHandle]
test rax, rax
je 0x444323
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x444323
call qword [sym.imp.kernel32.dll_GetLastError]
nop
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x444330
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, rdx
mov r15, rcx
test rdx, rdx
je 0x444377
mov rax, 0xffffffffffffffff
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp byte [rdi + rax + 1], 0
lea rax, [rax + 1]
jne 0x444360
cmp rax, 0xf9d
jae 0x44455a
mov r14, qword [r15]
mov al, 1
xchg byte [r14], al
test al, al
jne 0x4444c9
mov rcx, qword [r15 + 8]
lea rax, [rcx + 1]
cmp rax, 3
ja 0x444495
cmp rax, 1
je 0x444495
mov qword [r15 + 8], 0xffffffffffffffff
mov eax, 2
test rdi, rdi
je 0x4444b1
cmp byte [rdi], 0x73
jne 0x444418
mov bl, 0x73
mov edx, 1
lea rcx, str.stderr
nop dword [rax]
test bl, bl
je 0x4444b1
movzx ebx, byte [rdi + rdx]
lea rsi, [rdx + 1]
cmp bl, byte [rdx + rcx]
mov rdx, rsi
je 0x4443d0
mov dl, 0x73
mov eax, 1
lea rcx, str.stdout
mov ebx, 1
nop dword [rax + rax]
test dl, dl
je 0x4444b1
movzx edx, byte [rdi + rbx]
lea rsi, [rbx + 1]
cmp dl, byte [rbx + rcx]
mov rbx, rsi
je 0x444400
lea rsi, [r15 + 0x10]
lea r8, [0x005ef61e]
mov edx, 0x1000
mov rcx, rsi
mov r9, rdi
call fcn.00423520
cmp byte [r15 + 0x10], 0
je 0x4444b5
lea rdi, [r15 + 0x11]
mov r13, qword [sym.imp.kernel32.dll_GetFileAttributesA]
mov r12, qword [sym.imp.kernel32.dll_CreateDirectoryA]
jmp 0x444466
mov rcx, rsi
xor edx, edx
call r12
test eax, eax
je 0x4444f8
mov byte [rdi], bl
add rdi, 1
movzx ebx, byte [rdi]
cmp bl, 0x2f
je 0x444480
cmp bl, 0x5c
je 0x444480
test bl, bl
jne 0x444462
jmp 0x4444b5
mov byte [rdi], 0
mov rcx, rsi
call r13
cmp eax, 0xffffffff
je 0x444450
and eax, 0x10
jne 0x444460
jmp 0x444450
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [r15 + 8], 0xffffffffffffffff
mov eax, 2
test rdi, rdi
jne 0x4443b9
mov qword [r15 + 8], rax
mov byte [r14], 0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
mov rbx, qword [sym.imp.kernel32.dll_Sleep]
jmp 0x4444d7
add esi, 1
cmp esi, 0x63
ja 0x4444e0
pause
jmp 0x4444e4
xor ecx, ecx
call rbx
cmp byte [r14], 0
jne 0x4444d4
mov al, 1
xchg byte [r14], al
test al, al
jne 0x4444d4
jmp 0x444387
mov qword [rsp + 0x20], 0
lea rdx, str.ERROR:_Cant_create_directory:
mov ecx, 2
mov r8d, 0x1f
xor r9d, r9d
call fcn.0043e540
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
nop dword [rax]
cmp byte [r15 + r8 + 0x11], 0
lea r8, [r8 + 1]
jne 0x444530
mov qword [rsp + 0x20], 0
mov ecx, 2
mov rdx, rsi
xor r9d, r9d
call fcn.0043e540
call fcn.0041ba30
movsx edx, byte [rdi]
movsx r8d, byte [rdi + 1]
movsx r9d, byte [rdi + 2]
movsx eax, byte [rdi + 3]
movsx ecx, byte [rdi + 4]
movsx ebx, byte [rdi + 5]
movsx esi, byte [rdi + 6]
movsx edi, byte [rdi + 7]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea rcx, str.ERROR:_Path_is_too_long:__c_c_c_c_c_c_c_c..._n
call fcn.00434070
call fcn.0041ba30
int3
Function at 0x446c40
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rdx - 1]
test rdx, rax
jne 0x446c69
lea rax, [rcx + rdx]
add rax, 0xffffffffffffffff
neg rdx
and rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x006b5bc0]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x446cff
lea rcx, [0x006b5bc0]
call fcn.0043e830
mov rcx, qword [0x006b5bc8]
cmp rcx, 0xffffffffffffffff
je 0x446d46
lea rax, [rcx - 1]
cmp rax, 1
ja 0x446cbf
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x446cea
mov qword [rsp + 0x20], 0
lea rdx, str.IsPowerOfTwo_boundary__n
lea r9, [rsp + 0x2c]
mov r8d, 0x17
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x446cf7
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.IsPowerOfTwo_boundary__n
call qword [sym.imp.kernel32.dll_OutputDebugStringA]
mov byte [rsi], 0
call fcn.0041ba30
xor edi, edi
mov rbx, qword [sym.imp.kernel32.dll_Sleep]
jmp 0x446d13
add edi, 1
cmp edi, 0x63
ja 0x446d30
pause
cmp byte [rsi], 0
jne 0x446d10
jmp 0x446d39
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x446d10
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x446d10
jmp 0x446c7c
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x250a
xor r9d, r9d
call fcn.004045b0
int3
Function at 0x448280
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov byte [rcx + 0x81008], 0
mov byte [rcx + 0x81009], 0
mov byte [rcx + 0x8100a], 0
mov byte [rcx + 0x8100b], 0
mov byte [rcx + 0x8100c], 0
mov byte [rcx + 0x8100d], 0
mov byte [rcx + 0x8100e], 0
mov byte [rcx + 0x8100f], 0
mov byte [rcx + 0x81010], 0
mov byte [rcx + 0x81011], 0
mov byte [rcx + 0x81012], 0
mov byte [rcx + 0x81013], 0
mov byte [rcx + 0x81014], 0
mov byte [rcx + 0x81015], 0
mov byte [rcx + 0x81016], 0
mov byte [rcx + 0x81017], 0
mov byte [rcx + 0x81018], 0
mov byte [rcx + 0x81019], 0
mov byte [rcx + 0x8101a], 0
mov byte [rcx + 0x8101b], 0
mov byte [rcx + 0x8101c], 0
mov byte [rcx + 0x8101d], 0
mov byte [rcx + 0x8101e], 0
mov byte [rcx + 0x8101f], 0
mov byte [rcx + 0x81020], 0
mov byte [rcx + 0x81021], 0
mov byte [rcx + 0x81022], 0
mov byte [rcx + 0x81023], 0
mov byte [rcx + 0x81024], 0
mov byte [rcx + 0x81025], 0
mov byte [rcx + 0x81026], 0
mov byte [rcx + 0x81027], 0
mov byte [rcx + 0x81028], 0
mov byte [rcx + 0x81029], 0
mov byte [rcx + 0x8102a], 0
mov byte [rcx + 0x8102b], 0
mov byte [rcx + 0x8102c], 0
mov byte [rcx + 0x8102d], 0
mov byte [rcx + 0x8102e], 0
mov byte [rcx + 0x8102f], 0
test r8, r8
jne 0x4484c3
mov rsi, rcx
mov byte [rcx], 0
xor eax, eax
nop
mov byte [rsi + rax + 8], 0
mov byte [rsi + rax + 9], 0
mov byte [rsi + rax + 0xa], 0
mov byte [rsi + rax + 0xb], 0
mov byte [rsi + rax + 0xc], 0
mov byte [rsi + rax + 0xd], 0
mov byte [rsi + rax + 0xe], 0
mov byte [rsi + rax + 0xf], 0
add rax, 8
cmp rax, 0x40000
jne 0x4483b0
lea rax, [rsi + 0x40dc0]
lea r8, [rsi + 0x40050]
cmp rax, r8
cmova r8, rax
lea rcx, [rsi + 0x40040]
sub r8, rsi
add r8, 0xfffffffffffbffcf
and r8, 0xffffffffffffffd0
xor edx, edx
call sub.msvcrt.dll_memset
mov rax, 0xfffffffffffbfdb8
nop dword [rax]
mov byte [rsi + rax + 0x81008], 0
mov byte [rsi + rax + 0x81009], 0
mov byte [rsi + rax + 0x8100a], 0
mov byte [rsi + rax + 0x8100b], 0
mov byte [rsi + rax + 0x8100c], 0
mov byte [rsi + rax + 0x8100d], 0
mov byte [rsi + rax + 0x8100e], 0
mov byte [rsi + rax + 0x8100f], 0
mov byte [rsi + rax + 0x81010], 0
mov byte [rsi + rax + 0x81011], 0
mov byte [rsi + rax + 0x81012], 0
mov byte [rsi + rax + 0x81013], 0
add rax, 0xc
jne 0x448420
mov rax, qword [0x011e4068]
test rax, rax
jne 0x4484a8
lea rcx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov qword [0x011e4068], rax
mov qword [rsi + 0x40dc0], rax
lea rax, [rsi + 0x40dd0]
mov qword [rsi + 0x40dc8], rax
add rsp, 0x60
pop rsi
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_allocator_primary32.h
lea r8, str.___heap_start______0_
mov edx, 0x7b
xor r9d, r9d
call fcn.004045b0
int3
Function at 0x448740
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
shr rax, 5
cmp r9, rax
jae 0x448875
mov rax, qword [rdi]
lea rcx, [r9 + 1]
mov qword [rdi + 0x10], rcx
shl r9, 5
mov cl, byte [rsi]
mov byte [rax + r9], cl
mov cl, byte [rsi + 1]
mov byte [rax + r9 + 1], cl
mov cl, byte [rsi + 2]
mov byte [rax + r9 + 2], cl
mov cl, byte [rsi + 3]
mov byte [rax + r9 + 3], cl
mov cl, byte [rsi + 4]
mov byte [rax + r9 + 4], cl
mov cl, byte [rsi + 5]
mov byte [rax + r9 + 5], cl
mov cl, byte [rsi + 6]
mov byte [rax + r9 + 6], cl
mov cl, byte [rsi + 7]
mov byte [rax + r9 + 7], cl
mov cl, byte [rsi + 8]
mov byte [rax + r9 + 8], cl
mov cl, byte [rsi + 9]
mov byte [rax + r9 + 9], cl
mov cl, byte [rsi + 0xa]
mov byte [rax + r9 + 0xa], cl
mov cl, byte [rsi + 0xb]
mov byte [rax + r9 + 0xb], cl
mov cl, byte [rsi + 0xc]
mov byte [rax + r9 + 0xc], cl
mov cl, byte [rsi + 0xd]
mov byte [rax + r9 + 0xd], cl
mov cl, byte [rsi + 0xe]
mov byte [rax + r9 + 0xe], cl
mov cl, byte [rsi + 0xf]
mov byte [rax + r9 + 0xf], cl
mov cl, byte [rsi + 0x10]
mov byte [rax + r9 + 0x10], cl
mov cl, byte [rsi + 0x11]
mov byte [rax + r9 + 0x11], cl
mov cl, byte [rsi + 0x12]
mov byte [rax + r9 + 0x12], cl
mov cl, byte [rsi + 0x13]
mov byte [rax + r9 + 0x13], cl
mov cl, byte [rsi + 0x14]
mov byte [rax + r9 + 0x14], cl
mov cl, byte [rsi + 0x15]
mov byte [rax + r9 + 0x15], cl
mov cl, byte [rsi + 0x16]
mov byte [rax + r9 + 0x16], cl
mov cl, byte [rsi + 0x17]
mov byte [rax + r9 + 0x17], cl
mov cl, byte [rsi + 0x18]
mov byte [rax + r9 + 0x18], cl
mov cl, byte [rsi + 0x19]
mov byte [rax + r9 + 0x19], cl
mov cl, byte [rsi + 0x1a]
mov byte [rax + r9 + 0x1a], cl
mov cl, byte [rsi + 0x1b]
mov byte [rax + r9 + 0x1b], cl
mov cl, byte [rsi + 0x1c]
mov byte [rax + r9 + 0x1c], cl
mov cl, byte [rsi + 0x1d]
mov byte [rax + r9 + 0x1d], cl
mov cl, byte [rsi + 0x1e]
mov byte [rax + r9 + 0x1e], cl
mov cl, byte [rsi + 0x1f]
mov byte [rax + r9 + 0x1f], cl
add rsp, 0x28
pop rdi
pop rsi
ret
jne 0x448897
add r9, 1
mov rcx, r9
call fcn.0044d200
mov rcx, rdi
mov rdx, rax
call fcn.0044ff40
mov r9, qword [rdi + 0x10]
jmp 0x448761
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size_______capacity____
mov edx, 0x213
call fcn.004045b0
int3
Function at 0x449600
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov eax, dword [rdx + 0x400000]
mov qword [rcx], rax
xor esi, esi
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.kernel32.dll_GetSystemInfo]
xor ebx, ebx
jmp 0x44965a
mov ecx, 0x100000
call fcn.00446c40
add rsi, rax
add rbx, 1
cmp rbx, 0x8000
je 0x449686
mov rax, qword [rdi + rbx*8 + 0x400010]
test rax, rax
je 0x44964d
mov rdx, qword [0x011e4068]
test rdx, rdx
jne 0x449640
mov rcx, r15
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x011e4068], rdx
jmp 0x449640
mov r15, qword [0x0124e3a8]
xor edi, edi
lea rbx, [0x0120e398]
lea r12, [rsp + 0x28]
xor ebp, ebp
jmp 0x4496ba
mov ecx, 0x40000
call fcn.00446c40
add rdi, rax
add rbp, 1
cmp rbp, 0x8000
je 0x4496e3
mov rax, qword [rbx + rbp*8 + 8]
test rax, rax
je 0x4496ad
mov rdx, qword [0x011e4068]
test rdx, rdx
jne 0x4496a0
mov rcx, r12
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x011e4068], rdx
jmp 0x4496a0
add rsi, r15
lea rax, [rdi + rsi]
add rax, 0x10010
mov qword [r14 + 8], rax
mov rax, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x449720
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15, r8
mov r12, rdx
mov r14, rcx
test r8, r8
je 0x449742
mov byte [r15], 0
mov r8d, dword [r12 + 8]
xor esi, esi
test r8, r8
je 0x449949
mov rbp, qword [r12]
test rbp, rbp
je 0x449949
movabs rax, 0xc6a4a7935bd1e995
movabs rdx, 0x35253c9ade8f4ca8
imul rdx, r8
movabs rbx, 0x9747b28c9747b28c
xor rbx, rdx
cmp r8d, 1
jne 0x44978e
xor edi, edi
jmp 0x4497e5
mov edx, r8d
and edx, 0xfffffffe
xor edi, edi
nop word cs:[rax + rax]
mov rcx, qword [rbp + rdi*8]
imul rcx, rax
mov rsi, rcx
shr rsi, 0x2f
xor rsi, rcx
imul rsi, rax
xor rsi, rbx
imul rsi, rax
mov rcx, qword [rbp + rdi*8 + 8]
imul rcx, rax
mov rbx, rcx
shr rbx, 0x2f
xor rbx, rcx
imul rbx, rax
xor rbx, rsi
imul rbx, rax
add rdi, 2
cmp rdx, rdi
jne 0x4497a0
test r8b, 1
je 0x44980c
mov rdx, qword [rbp + rdi*8]
imul rdx, rax
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rax
xor rcx, rbx
imul rcx, rax
mov rbx, rcx
mov ecx, dword [r12 + 0xc]
imul rcx, rax
mov rdx, rcx
shr rdx, 0x2f
xor rdx, rcx
imul rdx, rax
xor rdx, rbx
imul rdx, rax
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rax
mov rdi, rcx
shr rdi, 0x2f
xor rdi, rcx
mov eax, edi
and eax, 0xfffff
lea rbx, [r14 + rax*4]
mov r13d, 0x7fffffff
and r13d, dword [r14 + rax*4]
lea rcx, [r14 + 0x400008]
mov ebp, r13d
nop word cs:[rax + rax]
nop dword [rax + rax]
test ebp, ebp
je 0x4498b3
mov esi, ebp
mov ebp, ebp
mov rdx, rbp
shr rdx, 0x10
mov rax, qword [r14 + rdx*8 + 0x400010]
test rax, rax
je 0x4498a2
movzx edx, bp
shl rdx, 4
mov ebp, dword [rax + rdx + 8]
cmp qword [rax + rdx], rdi
jne 0x449870
jmp 0x449949
mov qword [rsp + 0x28], rcx
call fcn.00451a20
mov rcx, qword [rsp + 0x28]
jmp 0x44988c
mov rbp, rcx
mov qword [rsp + 0x28], r15
mov rcx, rbx
call fcn.004519a0
mov r15d, eax
cmp eax, r13d
je 0x4498f3
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov rcx, r14
mov edx, r15d
mov r9, rdi
call fcn.00451920
test eax, eax
je 0x4498f3
mov esi, eax
mov dword [rbx], r15d
jmp 0x449949
mov esi, 1
lock xadd dword [r14 + 0x400000], esi
add esi, 1
js 0x44995c
mov r13, rbx
mov rdx, rsi
shr rdx, 0x10
mov rbx, qword [r14 + rdx*8 + 0x400010]
test rbx, rbx
je 0x449983
movzx ebp, si
shl rbp, 4
lea rcx, [rbx + rbp]
mov r8, r12
mov r9, rdi
call fcn.00441620
mov dword [rbx + rbp + 8], r15d
mov dword [r13], esi
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x449949
mov byte [rax], 1
mov eax, esi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r9d, esi
and r9d, 0x7fffffff
mov qword [rsp + 0x20], rsi
lea rcx, str....._sanitizer_common_sanitizer_stackdepotbase.h
lea r8, str.__s__kUnlockMask______s__
mov edx, 0x8c
call fcn.004045b0
mov rcx, rbp
call fcn.00451a20
mov rbx, rax
jmp 0x44991d
Function at 0x449f00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r9
test r8, r8
mov edi, 1
cmovne rdi, r8
mov rax, rdi
add rax, r9
jae 0x449f42
mov rdx, qword [str.SanitizerTool]
lea rcx, str.WARNING:__s:_CombinedAllocator_allocation_overflow:_0x_zx_bytes_with_0x_zx_alignment_requested_n
mov r8, rdi
mov r9, rsi
call fcn.00434070
xor eax, eax
jmp 0x44a036
mov r14, rdx
mov r15, rcx
mov rax, rdi
cmp rsi, 9
jb 0x449f5c
mov rcx, rdi
mov rdx, rsi
call fcn.00446c40
cmp rsi, 0x20000
ja 0x449f7f
cmp rax, 0x20000
ja 0x449f7f
cmp rax, 0x100
ja 0x449faa
add rax, 0xf
shr rax, 4
jmp 0x449fe3
lea rcx, [r15 + 0x40dc0]
add r15, 0x81008
mov rdx, r15
mov r8, rdi
mov r9, rsi
call fcn.0044a0e0
cmp rsi, 9
jae 0x44a02d
jmp 0x44a036
bsr rdx, rax
xor rdx, 0x3f
mov cl, 0x3d
sub cl, dl
mov rbx, rax
shr rbx, cl
and ebx, 3
mov edi, 0xffffffff
shl edi, cl
not edi
and eax, edi
xor rdx, 0x3f
shl rdx, 2
or rdx, rbx
cmp eax, 1
sbb rdx, 0xffffffffffffffff
add rdx, 0xfffffffffffffff0
mov rax, rdx
test rax, rax
je 0x44a042
cmp rax, 0x36
jae 0x44a066
mov rbx, rax
shl rbx, 0xa
lea rdi, [r14 + rbx]
mov rcx, qword [r14 + rbx]
test rcx, rcx
je 0x44a0ae
lea rax, [rcx - 1]
mov qword [rdi], rax
mov rdx, qword [rdi + rcx*8 + 0x10]
mov rax, qword [rdi + rcx*8 + 0x18]
prefetchnta byte [rdx]
mov rcx, qword [r14 + rbx + 0x10]
lock add qword [r14 + 0xd810], rcx
cmp rsi, 9
jb 0x44a036
add rsi, 0xffffffffffffffff
and rsi, rax
jne 0x44a08a
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_allocator_local_cache.h
lea r8, str.__class_id_______0UL__
mov edx, 0xa0
xor r9d, r9d
call fcn.004045b0
mov qword [rsp + 0x20], 0x36
lea rcx, str....._sanitizer_common_sanitizer_allocator_local_cache.h
lea r8, str.__class_id_______kNumClasses__
mov edx, 0xa1
mov r9, rax
call fcn.004045b0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_allocator_combined.h
lea r8, str.__reinterpret_cast_uptr__res____alignment___1_______0__
mov edx, 0x49
mov r9, rsi
call fcn.004045b0
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9, rax
call fcn.0044a400
test al, al
je 0x44a0cb
mov rcx, qword [rdi]
jmp 0x44a006
xor eax, eax
cmp rsi, 9
jae 0x44a02d
jmp 0x44a036
Function at 0x44b1e0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x44b25e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x44b251
mov rdx, qword [0x011e4068]
test rdx, rdx
jne 0x44b223
lea rcx, [rsp + 0x28]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x011e4068], rdx
mov ecx, 0x1000
call fcn.00446c40
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x44b28c
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.kernel32.dll_Sleep]
jmp 0x44b26c
add ebx, 1
cmp ebx, 0x63
ja 0x44b275
pause
jmp 0x44b27a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x44b269
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x44b269
jmp 0x44b1f7
call qword [sym.imp.kernel32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.00434660
int3
Function at 0x44bd60
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rax, rdx
shr rax, 0x2f
jne 0x44bdca
mov rdx, rsi
shr rdx, 0x20
mov rax, qword [rdi + rdx*8 + 8]
test rax, rax
je 0x44bdca
mov rbx, rsi
shr rbx, 0x14
mov rax, qword [rdi + rdx*8 + 8]
test rax, rax
je 0x44bdb6
and ebx, 0xfff
cmp byte [rax + rbx], 0
je 0x44bdca
mov rcx, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp 0x44c160
mov rcx, rdi
call fcn.0044b1e0
and ebx, 0xfff
cmp byte [rax + rbx], 0
jne 0x44bda4
mov rdx, qword [rdi + 0x40dc0]
lea rax, [rdx - 1]
test rax, rsi
jne 0x44bded
sub rsi, rdx
mov rcx, qword [rsi + 0x10]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.00446c40
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_allocator_secondary.h
lea r8, str.__IsAligned_p__page_size________0_
mov edx, 0x129
xor r9d, r9d
call fcn.004045b0
int3
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, rdx
shr rax, 0x2f
jne 0x44c224
mov rsi, rdx
mov rdi, rcx
mov rbx, rdx
shr rbx, 0x20
mov rax, qword [rcx + rbx*8 + 8]
test rax, rax
je 0x44c224
shr rsi, 0x14
mov rax, qword [rdi + rbx*8 + 8]
test rax, rax
je 0x44c20d
and esi, 0xfff
cmp byte [rax + rsi], 0
je 0x44c224
mov rax, qword [rdi + rbx*8 + 8]
test rax, rax
je 0x44c1db
mov rax, qword [rdi + rbx*8 + 8]
test rax, rax
je 0x44c248
movzx edx, byte [rax + rsi]
mov eax, 0x200
cmp rdx, 0x35
je 0x44c205
cmp dl, 0x10
ja 0x44c1e3
shl rdx, 4
jmp 0x44c202
xor edx, edx
shl rdx, 4
jmp 0x44c202
lea ecx, [rdx - 0x10]
shr ecx, 2
mov eax, 0x100
shl rax, cl
mov rcx, rax
shr rcx, 2
and edx, 3
imul rdx, rcx
add rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rbx
call fcn.0044b1e0
and esi, 0xfff
cmp byte [rax + rsi], 0
jne 0x44c1a9
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_allocator_primary32.h
lea r8, str.__PointerIsMine_p_______0_
mov edx, 0xda
xor r9d, r9d
call fcn.004045b0
mov rcx, rdi
mov rdx, rbx
call fcn.0044b1e0
movzx edx, byte [rax + rsi]
mov eax, 0x200
cmp rdx, 0x35
jne 0x44c1d0
jmp 0x44c205
Function at 0x44dbc0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rcx
mov ebx, dword [rcx + 0x10]
mov r14, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x44dbed
mov rdx, r9
jmp 0x44dc1f
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov esi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x44dcf5
xor al, 0x3f
mov ecx, eax
shl rsi, cl
cmp rsi, r9
jae 0x44dd12
mov rcx, rdi
call fcn.0044dd60
mov rax, qword [rdi]
test rax, rax
je 0x44dcd1
test r14, r14
je 0x44dc86
shl rbx, 3
lea rbx, [rbx + rbx*2]
lea r8, [r14 + rbx]
mov rcx, rdi
mov rdx, r14
call fcn.0044df40
mov rdx, qword [0x011e4068]
test rdx, rdx
jne 0x44dc71
lea rcx, [rsp + 0x28]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x011e4068], rdx
mov rcx, rbx
call fcn.00446c40
mov rcx, r14
mov rdx, rax
call fcn.0041d560
jmp 0x44dcc7
mov qword [rdi + 8], 0
mov ecx, dword [rdi + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x44dd2f
test rcx, rcx
je 0x44dcc7
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
nop dword [rax + rax]
mov dword [rax], 0xffffffff
mov qword [rax + 8], 0xffffffffffffffff
add rax, 0x18
cmp rax, rcx
jne 0x44dcb0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.004045b0
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1c4
call fcn.004045b0
mov qword [rsp + 0x20], rsi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1c5
call fcn.004045b0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.004045b0
int3