joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002ea0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140008e50
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140008e50
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002f10
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000f0a4]
mov rbx, rcx
test esi, esi
jle 0x140003040
mov rax, qword [0x14000f0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002f5b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002fe5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002f40
mov rcx, rbx
call fcn.140003960
mov rdi, rax
test rax, rax
je 0x140003062
mov rax, qword [0x14000f0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003aa0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000f0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003047
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002fde
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002ff0
add dword [0x14000f0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000f0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002fde
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002ea0
nop dword [rax]
xor esi, esi
jmp 0x140002f68
mov rax, qword [0x14000f0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002ea0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002ea0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400035d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000f100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000f0e0]
test rbx, rbx
je 0x14000362c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003623
test rsi, rsi
je 0x140003623
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003608
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003960
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000bd20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003980
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003988
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003980
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400039dd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400039d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003980
add rax, 0x28
cmp rax, r9
jne 0x1400039c0
xor eax, eax
ret

Function at 0x1400039e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000bd20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400039ff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003a08
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400039ff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003aa0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000bd20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003abf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003ac8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x180017920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x28], r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor r15d, r15d
mov qword [rcx], r15
mov qword [rsp + 0x20], r9
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r15
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x1c], eax
lea rax, [rcx + 0x20]
mov qword [rsp + 0x30], rax
mov r12, qword [rdx + 8]
test r12, r12
je 0x180017a18
lea r13, [rsp + 0x39]
lea rsi, [rsp + 0x38]
lea rdi, str._s:_d_WARNING:_UNSUPPORTED:_pCreateInfo__pNext__sType___s_n
lea rbp, str....._third_party_swiftshader_srcVulkanVkImage.cpp
jmp 0x1800179b9
cmp edx, 0x3b9bb468
je 0x1800179af
cmp edx, 0x3b9be341
jne 0x1800179dd
mov r12, qword [r12 + 8]
test r12, r12
je 0x180017a18
mov edx, dword [r12]
cmp edx, 0x3b9d0837
jle 0x18001799f
cmp edx, 0x3b9d0838
je 0x1800179af
cmp edx, 0x3b9e8af0
je 0x1800179af
cmp edx, 0x7fffffff
je 0x1800179af
mov rcx, rsi
call fcn.1800272a0
test byte [rsp + 0x38], 1
mov r9, r13
je 0x1800179f4
mov r9, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rbp
mov r8d, 0xa8
call fcn.180171480
test byte [rsp + 0x38], 1
je 0x1800179af
mov rcx, qword [rsp + 0x48]
call fcn.180363dac
jmp 0x1800179af
mov eax, dword [r14 + 0x18]
mov dword [rbx + 0x20], eax
mov rax, qword [r14 + 0x1c]
mov qword [rbx + 0x24], rax
mov eax, dword [r14 + 0x24]
mov dword [rbx + 0x2c], eax
mov eax, dword [r14 + 0x28]
mov dword [rbx + 0x30], eax
mov eax, dword [r14 + 0x2c]
mov dword [rbx + 0x34], eax
mov eax, dword [r14 + 0x30]
mov dword [rbx + 0x38], eax
mov eax, dword [r14 + 0x34]
mov dword [rbx + 0x3c], eax
mov eax, dword [r14 + 0x38]
mov dword [rbx + 0x40], eax
mov qword [rbx + 0x48], 0
mov dword [rbx + 0x50], r15d
xorps xmm0, xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
movups xmmword [rbx + 0x78], xmm0
mov dword [rbx + 0x88], r15d
mov dword [rbx + 0x90], 0x3f800000
mov r15, qword [rsp + 0x30]
mov rcx, r15
call fcn.180010b10
test al, al
je 0x180017ac8
lea rbp, [rsp + 0x38]
mov ecx, 0xb
mov rdi, rbp
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
mov rcx, r15
call fcn.180010b20
mov dword [rbp + 0x18], eax
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
mov rdx, rbp
xor r8d, r8d
mov r9, qword [rsp + 0x20]
call fcn.180017920
mov qword [rbx + 0x48], rsi
mov rax, qword [r14 + 8]
test rax, rax
je 0x180017ae5
cmp dword [rax], 0x3b9be341
je 0x180017adf
mov rax, qword [rax + 8]
jmp 0x180017acc
mov eax, dword [rax + 0x10]
mov dword [rbx + 0x50], eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180364a40
mov rax, rbx
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800249c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1800249ff
test r15, r15
je 0x180024aed
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x180024a49
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.1803665d0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x1800249dd
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x180024b19
lea rcx, [r12*8]
call fcn.180363d5c
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x180024abd
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x180024aed
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x180024aa5
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x1800249dd
mov rcx, r14
call fcn.180363dac
mov r15, qword [rsi + 0x10]
jmp 0x1800249dd
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1803aa860
call fcn.18039c870
int3
Function at 0x180024b20
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x180024b62
mov r14, rbx
add r14, 0xfffffffffffffff8
je 0x180024c54
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x180024baf
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
shl r12, 2
and r12, 0xfffffffffffffff8
lea r14, [r15 + r12]
sub r15, rbx
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1803665d0
mov qword [rsi + 8], r14
add qword [rsi + 0x10], r12
jmp 0x180024b3f
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x180024c80
lea rcx, [r12*8]
call fcn.180363d5c
lea r14, [r12*2 + 6]
and r14, 0xfffffffffffffff8
add r14, rax
mov rcx, r14
sub r15, rbx
je 0x180024c27
mov rdx, r15
sar rdx, 3
and r15, 0xfffffffffffffff8
mov rcx, r15
add rcx, r14
shl rdx, 3
xor r8d, r8d
mov r9, r14
add r9, r8
je 0x180024c54
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x180024c0f
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
test rbx, rbx
je 0x180024b3f
mov rcx, rbx
call fcn.180363dac
mov r14, qword [rsi + 8]
jmp 0x180024b3f
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1803aa860
call fcn.18039c870
int3
Function at 0x180036660
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rdx + 0x18], 0
je 0x180036710
mov rsi, qword [rdx]
mov eax, dword [0x1804ca890]
mov ecx, dword [0x1804c29cc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800367e4
mov ecx, dword [0x1804c29cc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18003678d
mov ecx, dword [0x1804c29cc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180036742
mov eax, dword [0x1804ca88c]
sub rsi, rax
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180364a40
nop
add rsp, 0x58
pop rdi
pop rsi
ret
cmp qword [rdx + 0x10], 2
jae 0x18003671c
mov rsi, qword [rdx]
jmp 0x180036727
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov rsi, qword [rax + rcx]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180364a40
mov rcx, rsi
add rsp, 0x58
pop rdi
pop rsi
jmp fcn.18037e050
lea rcx, [0x1804ca890]
call fcn.180363ed0
cmp dword [0x1804ca890], 0xffffffff
jne 0x1800366e1
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1804ca88c], eax
lea rcx, [0x1804ca890]
call fcn.180363f68
jmp 0x1800366e1
lea rcx, [0x1804ca890]
call fcn.180363ed0
mov eax, dword [0x1804ca890]
cmp eax, 0xffffffff
jne 0x1800366c6
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1804ca88c], eax
lea rcx, [0x1804ca890]
call fcn.180363f68
mov eax, dword [0x1804ca890]
jmp 0x1800366c6
lea rcx, [0x1804ca890]
call fcn.180363ed0
mov eax, dword [0x1804ca890]
cmp eax, 0xffffffff
jne 0x1800366a7
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1804ca88c], eax
lea rcx, [0x1804ca890]
call fcn.180363f68
mov eax, dword [0x1804ca890]
jmp 0x1800366a7
Function at 0x18003d0f0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor edi, edi
mov qword [rcx], rdi
lea r15, [rsp + 0x58]
mov qword [r15], rdi
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9, r15
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov r15, qword [r15]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], rdi
test r15, r15
je 0x18003d17d
js 0x18003d2f2
mov rcx, r15
call fcn.180363d5c
mov rdi, rax
xor eax, eax
mov rcx, rdi
add rcx, rax
je 0x18003d2c6
mov byte [rcx], 0
inc rax
cmp r15, rax
jne 0x18003d166
lea r9, [rsp + 0x58]
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [r14 + 8]
test rax, rax
je 0x18003d1ef
mov rcx, qword [r14 + 0x58]
movzx edx, byte [rcx]
mov word [rsp + 0x68], dx
xor edx, edx
xor r8d, r8d
mov r9b, byte [rcx + rdx*2 + 1]
bts r8, r9
mov qword [rsp + 0x60], r8
inc rdx
cmp rax, rdx
jne 0x18003d1b2
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 0x10
lea r9, [rsp + 0x60]
mov r8d, 0x30003
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov ecx, 0x30
call fcn.180363d5c
mov r14, rax
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18003d29c
lea rax, [rbx + 8]
cmp rcx, rax
je 0x18003d2a9
mov qword [r14 + 0x20], rcx
mov qword [rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0
lea r9, [0x18003d5e0]
mov rcx, rax
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov qword [r14 + 0x28], rax
mov qword [rsi], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
test rdi, rdi
je 0x18003d275
mov rcx, rdi
call fcn.180363dac
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [r14 + 0x20], 0
jmp 0x18003d222
mov rdx, r14
add rdx, 8
mov qword [r14 + 0x20], rdx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1804ec008]
jmp 0x18003d222
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1803aa860
lea rcx, [rsp + 0x40]
call fcn.18039c9b0
int3
Function at 0x180076080
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, r9
mov rbx, r8
mov rsi, rdx
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdx + 0x110], rax
lea rcx, [rdx + 8]
xor r14d, r14d
mov r8d, 0x108
xor edx, edx
call fcn.180366c80
mov eax, dword [rdi + 0x18]
mov ecx, dword [rdi + 0x148]
shl rcx, 0x20
or rax, rcx
mov qword [rsi], rax
mov rax, qword [rbx + 8]
mov eax, dword [rax]
mov dword [rsi + 8], eax
cmp dword [rbx + 4], 0
sete al
add al, al
or al, byte [rdi + 0x270]
mov cl, byte [rbx + 0x14]
mov dl, byte [rbx + 0x15]
shl cl, 2
or cl, al
shl dl, 3
or dl, cl
mov byte [rsi + 0x10c], dl
mov rax, qword [rdi + 0x98]
mov rcx, qword [rdi + 0xa0]
sub rcx, rax
sar rcx, 1
mov edx, 0x288
add rdx, qword [rsp + 0x70]
mov r8d, dword [rdx]
mov dword [rsi + r14*2 + 0xc], r8d
cmp rcx, r14
jbe 0x180076171
movzx r8d, byte [rax + r14*2]
mov r9d, dword [rsi + r14*2 + 0x10]
and r8d, 3
and r9d, 0xfffffffc
or r9d, r8d
mov dword [rsi + r14*2 + 0x10], r9d
add r14, 4
add rdx, 0x28
cmp r14, 0x80
jne 0x180076116
xor eax, eax
xor ecx, ecx
xor ecx, dword [rsi + rax*4]
inc rax
cmp rax, 0x44
jne 0x180076152
mov dword [rsi + 0x110], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_vector
lea r9, str.__n___size__
mov r8d, 0x5c1
call fcn.1803aa860
int3
Function at 0x180111580
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x1801115b0
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x1801115e7
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1801116d0
lea rax, [rdx - 1]
test rdx, rax
je 0x1801115c6
mov rcx, rdx
call fcn.180362200
mov rdi, rax
jmp 0x180111595
mov rdi, rdx
jmp 0x180111595
mov rcx, rdx
call fcn.180362200
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x18011159e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
jae 0x1801115df
mov rax, qword [rsi + 0x18]
test rax, rax
jns 0x180111609
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x18011160e
cvtsi2ss xmm0, rax
divss xmm0, dword [rsi + 0x20]
call fcn.18039b6a0
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1803ff190]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x1801115cb
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x1801115cb
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x1801115d3
Function at 0x180171480
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x850
mov rdi, rcx
lea rbx, [rsp + 0x878]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [rbx + 0x10], r9
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x848], rax
mov qword [rsp + 0x38], rbx
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.180366c80
call fcn.1803611d0
mov rcx, qword [rax]
or rcx, 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x800
mov rdx, rsi
mov r9, rdi
call fcn.180367c00
mov ecx, 2
call fcn.180367904
mov rcx, rsi
mov rdx, rax
call fcn.18037dabc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
call fcn.180364a40
nop
add rsp, 0x850
pop rbx
pop rdi
pop rsi
ret

Function at 0x180187360
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x1804cdc0c]
mov ecx, dword [0x1804c29cc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18018740f
movsxd rbx, dword [0x1804cdc08]
add rdi, rbx
dec rdi
mov r14, rbx
neg r14
and rdi, r14
lea rcx, [rbx + rdi]
add rcx, 8
call fcn.180363dec
test rax, rax
je 0x1801873e5
add rbx, rax
add rbx, 7
and rbx, r14
mov qword [rbx - 8], rax
je 0x1801873e5
mov rcx, rbx
xor edx, edx
mov r8, rdi
call fcn.180366c80
jmp 0x1801873e7
xor ebx, ebx
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
call fcn.180187470
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180364a40
mov rax, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1804cdc0c]
call fcn.180363ed0
cmp dword [0x1804cdc0c], 0xffffffff
jne 0x18018739e
movaps xmm0, xmmword [0x1803ff180]
lea rbx, [rsp + 0x20]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x1804cdc08], eax
lea rcx, [0x1804cdc0c]
call fcn.180363f68
jmp 0x18018739e
Function at 0x180187470
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rdx, rdx
je 0x18018752e
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov eax, dword [0x1804cdc0c]
mov ecx, dword [0x1804c29cc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180187546
movsxd rdx, dword [0x1804cdc08]
lea rax, [rbx + rdx]
dec rax
neg rdx
and rdx, rax
mov dword [rsp + 0x20], 0xaaaaaaaa
dec edi
cmp edi, 6
ja case.0x1801874f0.2
lea rax, [0x180428088]
movsxd rcx, dword [rax + rdi*4]
add rcx, rax
jmp rcx
mov r8d, 0x20
jmp 0x180187520
mov r8d, 1
jmp 0x180187520
mov r8d, 0x10
jmp 0x180187520
mov r8d, 4
jmp 0x180187520
mov r8d, 0x40
jmp 0x180187520
mov r8d, 2
lea r9, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180364a40
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1804cdc0c]
call fcn.180363ed0
cmp dword [0x1804cdc0c], 0xffffffff
jne 0x1801874bf
movaps xmm0, xmmword [0x1803ff180]
lea r14, [rsp + 0x20]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 4]
mov dword [0x1804cdc08], eax
lea rcx, [0x1804cdc0c]
call fcn.180363f68
jmp 0x1801874bf

Function at 0x180187ce0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.18001ecf0
lea rcx, [0x1803ecf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x48]
mov qword [r8], rsi
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x44]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov r9, r8
call fcn.180195d70
lea rax, [0x1803ecf00]
mov qword [rsi], rax
mov ecx, ebx
call fcn.18017b1b0
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x180187db2
mov r8, qword [rsi + 8]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x20], ecx
mov byte [rsp + 0x28], 0
mov rcx, rax
xor r9d, r9d
call fcn.1801795a0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
ret
lea rcx, [rsi + 0x18]
mov qword [rcx], rax
jmp 0x180187d9b