joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180268482
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x50]
mov qword [rsi + 0x28], rax
movaps xmm0, xmmword [0x1803467d0]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 8], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, fcn.180268ad0
mov qword [rsi], rcx
mov qword [rsi + 0x18], 0
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x28], 0
xor edi, edi
mov dword [rsi + 0x2c], edi
mov rcx, rsi
call fcn.18028d8d0
lea r9, [rsp + 0x4c]
mov dword [r9], edi
lea rdi, [section..crthunk]
mov edx, 0x80
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802685a2
lea rcx, [0x18034e7c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], rdi
lea rcx, [0x180268420]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x38], 0x80
lea r8, [0x180000000]
lea r9, str.NtMapViewOfSection
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.18028d9e0
test eax, eax
js 0x1802685a9
lea rcx, [section..crthunk]
lea r9, [rsp + 0x4c]
mov edx, 0x80
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801e6610
mov eax, esi
add rsp, 0x88
pop rdi
pop rsi
ret
mov esi, 0xf
jmp 0x180268586
mov dword [0x1803c9790], eax
mov esi, 0x10
jmp 0x180268586
Function at 0x18026a6c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea r9, [0x1802da6b0]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
add rsp, 0x38
ret

Function at 0x18026cdd2
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x18026ce64
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x18026ce97
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x18026ce52
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1801e81b0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
test r12, r12
je 0x18026cf49
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x18026cf75
lea rcx, [r15*8]
call fcn.1801e4f08
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x18026cf14
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x18026cf49
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x18026cefc
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.180143910
mov r12, qword [rsi + 0x10]
jmp 0x18026ce64
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3
Function at 0x18026ecd5
Capabilities:
Hide graphical window

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
xorps xmm6, xmm6
lea rcx, [rsp + 0x60]
movaps xmmword [rcx], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx + 0x40], xmm6
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
mov dword [rcx], 0x50
lea rax, [0x18026edc0]
mov qword [rcx + 8], rax
mov qword [rcx + 0x18], rsi
lea rdi, str.pwahelper_wnd
mov qword [rcx + 0x40], rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x50], rsi
movups xmmword [rsp + 0x40], xmm6
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x58], 0
lea r8, [0x18034fc2a]
xor ecx, ecx
mov rdx, rdi
mov r9d, 0xcf0000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1803b6da0], rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1801e6610
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
Function at 0x180273af0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x180273b03
cmp dword [0x1803c98e0], ecx
jle 0x180273b0a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.180273b50
test edi, edi
je 0x180273b03
cmp byte [rsi + rdi - 1], 0xa
je 0x180273b03
lea rcx, [0x180350209]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.180273b50

Function at 0x180273b50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180273b9e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x180273bdc
cmp rdi, rsi
jae 0x180273bdc
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x180273b97
jmp 0x180273b94
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x18027a9e5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
movdqa xmm0, xmmword [0x1803467d0]
movdqa xmmword [rax], xmm0
movdqa xmmword [rax - 0x10], xmm0
mov r8, qword [rdx]
mov ecx, 0x38
lea r9, str.000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
mov r10, r8
shr r10, cl
movzx r10d, r10b
movzx r10d, word [r9 + r10*2]
mov word [rax], r10w
add rcx, 0xfffffffffffffff8
add rax, 2
cmp rcx, 0xfffffffffffffff8
jne 0x18027aa22
lea rax, [rsp + 0x60]
or r8, 1
bsr rcx, r8
xor ecx, 0x3c
shr ecx, 2
mov r8d, 0x10
sub r8d, ecx
movzx r9d, byte [rdx + 8]
cmp r8d, r9d
jb 0x18027aa79
sub rax, r8
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rax
jmp 0x18027aab0
movzx ecx, byte [rdx + 9]
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x40], xmm0
neg r8
movdqu xmmword [rax + r8 - 0x10], xmm0
sub rax, r9
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov rdx, rax
mov r8, r9
call fcn.1800d2a50
mov rcx, rsi
mov rdx, rdi
call fcn.18027a524
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x18027bf25
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 2
call sym.msedge_elf.dll_OQS_CPU_has_extension
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
test eax, eax
je 0x18027bf62
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x180283c1b
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x18027c515
sub rsp, 0x28
mov rax, r8
mov r8, rdx
mov rdx, rcx
shr r8, 4
mov dword [rsp + 0x20], 0xe
mov rcx, r9
mov r9, rax
call fcn.18027c3e2
nop
add rsp, 0x28
ret
cmp rdx, 0x10
jb 0x180283cb1
shr rdx, 4
xor eax, eax
vmovdqa xmm0, xmmword [r8]
vpxor xmm0, xmm0, xmmword [rcx + rax]
vaesenc xmm0, xmm0, xmmword [r8 + 0x10]
vaesenc xmm0, xmm0, xmmword [r8 + 0x20]
vaesenc xmm0, xmm0, xmmword [r8 + 0x30]
vaesenc xmm0, xmm0, xmmword [r8 + 0x40]
vaesenc xmm0, xmm0, xmmword [r8 + 0x50]
vaesenc xmm0, xmm0, xmmword [r8 + 0x60]
vaesenc xmm0, xmm0, xmmword [r8 + 0x70]
vaesenc xmm0, xmm0, xmmword [r8 + 0x80]
vaesenc xmm0, xmm0, xmmword [r8 + 0x90]
vaesenc xmm0, xmm0, xmmword [r8 + 0xa0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xb0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xc0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xd0]
vaesenclast xmm0, xmm0, xmmword [r8 + 0xe0]
vmovdqu xmmword [r9 + rax], xmm0
add rax, 0x10
dec rdx
jne 0x180283c2b
ret
Function at 0x18027d0c0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18027d0ea
xor eax, eax
xor r9d, r9d
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x18027d0ca
movzx eax, r9b
neg eax
shr eax, 8
and eax, 1
ret
xor eax, eax
jmp 0x18027d0e1

Function at 0x18027d2e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x50], rax
vmovups ymm0, ymmword [rcx]
vmovups ymm1, ymmword [rcx + 0x10]
vmovups ymmword [rsp + 0x30], ymm1
vmovups ymmword [rsp + 0x20], ymm0
test rdx, rdx
je 0x18027d31f
xor eax, eax
mov cl, byte [rdx + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x30
jne 0x18027d30f
vxorps xmm0, xmm0, xmm0
vmovups ymmword [0x1803d1840], ymm0
vmovups ymmword [0x1803d1830], ymm0
lea rcx, [rsp + 0x20]
vzeroupper
call fcn.18027d35d
mov dword [0x1803d1860], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x58
ret

Function at 0x18027d35d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x60], rax
vpbroadcastb ymm0, byte [0x180351ef0]
vmovdqu ymmword [rsp + 0x40], ymm0
vmovdqu ymmword [rsp + 0x30], ymm0
xor r12d, r12d
lea rdi, [0x1803d1830]
lea rbx, [rsp + 0x28]
lea r14, [0x1803d1850]
jmp 0x18027d3fb
inc cl
mov byte [rax + rdi + 0x20], cl
mov rax, r12
shl rax, 4
lea r15, [rsp + rax]
add r15, 0x30
mov qword [rsp + 0x28], 0
mov rcx, rdi
mov rdx, rbx
vzeroupper
call fcn.18027be57
mov edx, 0x10
mov rcx, r14
mov r8, rdi
mov r9, r15
call fcn.18027bebc
mov rcx, qword [rsp + 0x28]
call fcn.18027be8e
inc r12
cmp r12, 3
je 0x18027d417
mov eax, 0xf
mov eax, eax
mov cl, byte [rax + rdi + 0x20]
cmp cl, 0xff
jne 0x18027d3a9
mov byte [rax + rdi + 0x20], 0
add eax, 0xffffffff
jb 0x18027d400
jmp 0x18027d3af
test rsi, rsi
je 0x18027d42e
xor eax, eax
mov cl, byte [rsi + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x30
jne 0x18027d41e
vmovups ymm0, ymmword [rsp + 0x30]
vmovups ymmword [0x1803d1830], ymm0
vmovaps xmm0, xmmword [rsp + 0x50]
vmovups xmmword [0x1803d1850], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
vzeroupper
call fcn.1801e6610
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180285246
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18028526c
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x180285250
xor eax, eax
test r9b, r9b
setne al
ret
xor eax, eax
ret

Function at 0x18028526f
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180285296
neg r9b
xor eax, eax
mov r10b, byte [rcx + rax]
mov r11b, byte [rdx + rax]
xor r11b, r10b
and r11b, r9b
xor r11b, r10b
mov byte [rcx + rax], r11b
inc rax
cmp r8, rax
jne 0x180285279
ret
Function at 0x18028884e
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x1802888e0
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x180288913
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1802888ce
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1801e81b0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
test r12, r12
je 0x1802889c5
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x1802889f1
lea rcx, [r15*8]
call fcn.1801e4f08
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x180288990
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1802889c5
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x180288978
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1802884f0
mov r12, qword [rsi + 0x10]
jmp 0x1802888e0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3
Function at 0x1802889f8
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x180288a57
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x180288b68
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x180288ab2
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x180288aa1
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1801e81b0
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x180288a26
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x180288b94
lea rcx, [r12*8]
call fcn.1801e4f08
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x180288b33
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x180288b68
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x180288b1b
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1802884f0
mov r15, qword [rsi + 8]
jmp 0x180288a26
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3
Function at 0x180288b9a
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x180288c2c
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x180288c5f
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x180288c1a
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1801e81b0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
test r12, r12
je 0x180288d11
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x180288d3d
lea rcx, [r15*8]
call fcn.1801e4f08
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x180288cdc
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x180288d11
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x180288cc4
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1802884f0
mov r12, qword [rsi + 0x10]
jmp 0x180288c2c
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3
Function at 0x180288d44
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x180288da3
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x180288eb4
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x180288dfe
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x180288ded
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1801e81b0
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x180288d72
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x180288ee0
lea rcx, [r12*8]
call fcn.1801e4f08
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x180288e7f
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x180288eb4
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x180288e67
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1802884f0
mov r15, qword [rsi + 8]
jmp 0x180288d72
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3

Function at 0x18028d01a
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x18028d024
ret
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x18028d054
mov edx, dword [rcx + 8]
movsxd r8, dword [rax + 0x3c]
lea r9, [r8 + 0x18]
mov edx, edx
cmp r9, rdx
ja 0x18028d07d
add rax, r8
cmp dword [rax], 0x4550
jne 0x18028d07d
add rax, 4
mov qword [rcx + 0x18], rax
jmp 0x18028d023
mov rax, qword [rcx]
test rax, rax
je 0x18028d07d
mov qword [rcx + 0x10], rax
mov edx, dword [rcx + 8]
cmp edx, 0x40
jb 0x18028d075
movzx r8d, word [rax]
cmp r8d, 0x5a4d
je 0x18028d030
mov qword [rcx + 0x10], 0
xor eax, eax
ret