joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802cd2b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1803467d0]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x2cc
call fcn.18010a970
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.180101470
cmp byte [rdi + 0x17], 0
jns 0x1802cd332
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1802cd3b0
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rsi, [rsp + 0x40]
mov qword [rsi], rbx
mov rcx, rsi
mov rdx, rax
call fcn.1800d3644
mov rax, qword [rsi]
inc rax
test rax, 0xfffffffffffffffe
setne bl
cmp rax, 2
jb 0x1802cd3b0
call fcn.18010a990
mov rcx, qword [rsp + 0x40]
call fcn.1800fd300
lea rcx, [rsp + 0x60]
call fcn.1801014d0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1802cdcf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1802cdcfc
mov rax, qword [rcx + 8]
test rax, rax
jne fcn.180176250
xor eax, eax
ret

Function at 0x1802d0b60
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, r8
mov rcx, qword [0x1803b6038]
xor rcx, rsp
mov qword [rsp + 0x88], rcx
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx r8d, byte [r8 + 0x17]
test r8b, r8b
js 0x1802d0b97
and r8d, 0x7f
jmp 0x1802d0b9e
mov r8, qword [rax + 8]
mov rax, qword [rax]
lea rdi, [rsp + 0x60]
mov rcx, rdi
mov rdx, rax
call fcn.1800d2a50
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov rdx, rdi
call fcn.1801021e0
cmp byte [rsi + 0x17], 0
jns 0x1802d0bc9
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1801021e0
cmp byte [rdi + 0x17], 0
jns 0x1802d0bee
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x1802d0c0d
mov rcx, qword [rsp + 0x48]
call fcn.1801e4f44
cmp byte [rsp + 0x87], 0
jns 0x1802d0c21
mov rcx, qword [rsp + 0x70]
call fcn.1801e4f44
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1802dd8c0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1803d4b90]
test rax, rax
jne 0x1802dd904
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1803d4b90]
test rax, rax
je 0x1802dd8f1
cmp eax, 2
jne 0x1802dd95c
mov ecx, 2
call fcn.180109be0
test al, al
je 0x1802dd9bf
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x94
mov r9d, 2
call fcn.180180f60
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch
mov r8d, 0x1d
call fcn.1800d33a5
mov rcx, rsi
call fcn.1801e3530
jmp 0x1802dd9bf
mov eax, 1
lock xadd qword [0x1803d4bc8], rax
inc rax
cmp rax, 2
jl 0x1802dd980
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1803d4b50], eax
mov qword [0x1803d4b48], rsi
mov rcx, qword [0x1803c6ec0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1801e6610
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret

Function at 0x1802dde98
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x158], rax
cmp qword [0x1803c6ec0], 0xffffffffffffffff
jne 0x1802ddf37
mov ecx, 2
call fcn.180109be0
test al, al
je 0x1802ddf09
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x36e
mov r9d, 2
call fcn.180180f60
lea rcx, [rsp + 0x30]
lea rdx, str.not_connected
mov r8d, 0xd
call fcn.1800d33a5
mov rcx, rsi
call fcn.1801e3530
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7003
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x160
pop rsi
ret
mov rsi, rcx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1801e6610
mov rcx, rsi
add rsp, 0x160
pop rsi
jmp fcn.1802dd8c0
Function at 0x1802de32b
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1802de352
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1802de36d
and eax, 0x410
cmp eax, 0x410
je 0x1802de405
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1802de379
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1802de3e9
mov ecx, 2
call fcn.180109be0
test al, al
je 0x1802de3e7
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1801815d0
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1800d33a5
mov rcx, rax
mov rdx, rsi
call fcn.180182c20
mov rcx, rdi
call fcn.180181650
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1801e6610
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1801e6610
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.1802de426

Function at 0x1802de426
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1802de44e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x1802de47c
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.180109be0
test al, al
je 0x1802de45a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1801815d0
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1800d33a5
mov rcx, rax
mov rdx, rsi
call fcn.180182c20
mov rcx, rbx
call fcn.180181650
jmp 0x1802de45a

Function at 0x1802df5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.18030563a
Function at 0x1802ed7d2
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
jne 0x1802ed86c
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, rbx
jbe 0x1802ed88b
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov rbx, rax
neg rbx
cmp r14, r15
jne 0x1802ed84e
shl rax, 3
sub r14, rax
jmp 0x1802ed860
lea rcx, [r14 + r12]
mov rdx, qword [r14]
mov qword [r14], 0
call fcn.1802eae16
add r14, 8
cmp r14, r15
je 0x1802ed858
test r12, r12
je 0x1802ed83e
jmp 0x1802ed82b
lea r12, [rbx*8]
jmp 0x1802ed847
mov r15, qword [rsi + 8]
lea r14, [r14 + rbx*8]
mov qword [rsi + 0x10], r14
lea rax, [r15 + rbx*8]
mov qword [rsi + 8], rax
mov rcx, qword [rsi + 0x10]
mov rdx, rdi
call fcn.1802eba15
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1802ed97f
lea rcx, [r12*8]
call fcn.1801e4f08
mov rcx, r12
and rcx, 0xfffffffffffffffc
mov r8, r15
sub r8, r14
lea rdx, [rax + rcx*2]
lea rcx, [rax + r12*8]
sub r15, r14
jne 0x1802ed8f7
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rcx
test rbx, rbx
je 0x1802ed86c
mov rcx, rbx
call fcn.1801e4f44
jmp 0x1802ed86c
sar r8, 3
lea r9, [r15 + rdx]
shl r8, 3
xor r10d, r10d
mov r11, rdx
add r11, r10
je 0x1802ed953
mov rbx, qword [r14 + r10]
mov qword [r14 + r10], 0
mov qword [r11], rbx
add r10, 8
cmp r8, r10
jne 0x1802ed906
mov rbx, qword [rsi]
mov r15, qword [rsi + 8]
mov r14, qword [rsi + 0x10]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], rcx
cmp r14, r15
je 0x1802ed8e5
add r14, 0xfffffffffffffff8
mov rcx, r14
call fcn.1802ebace
jmp 0x1802ed940
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3
Function at 0x1802efb55
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebx, 0x57
test rcx, rcx
je 0x1802efc06
mov rdi, rdx
test rdx, rdx
je 0x1802efc06
mov rsi, rcx
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1802efbfe
test byte [rsp + 0x54], 0xf0
lea r9, [rsp + 0x2c]
mov dword [r9], 0
mov eax, 4
mov r8d, 0x40
cmove r8d, eax
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802efbfe
mov rax, qword [rdi]
mov qword [rsi], rax
lea r9, [rsp + 0x2c]
mov r8d, dword [r9]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
jmp 0x1802efc06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x1802f7a70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1802f7aa0
cmp rbx, 2
jb 0x1802f7b88
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x18039a900]
movdqa xmm7, xmmword [0x18039a910]
movdqa xmm8, xmmword [0x18039a920]
movdqa xmm9, xmmword [0x18039a930]
mov rcx, rsi
call fcn.1802f8760
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x1802f7afe
mov rcx, rsi
call fcn.1802f8c40
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1802f7b5c
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x1802f7af4
mov rcx, rsi
call fcn.1802f8760
xor eax, eax
movdqa xmm0, xmmword [0x18039a900]
movdqa xmm1, xmmword [0x18039a910]
movdqa xmm2, xmmword [0x18039a920]
movdqa xmm3, xmmword [0x18039a930]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x1802f7bb2
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1802f7c0d
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1802f8440
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1803467d0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test r9, r9
je 0x1802f84a8
xor edi, edi
cmp r9, 0x30
ja 0x1802f84ca
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r9, rax
jne 0x1802f8498
mov r8d, 0x30
mov rcx, rsi
call fcn.1801965f0
test eax, eax
je 0x1802f84e0
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e6610
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x1802f84ca
Function at 0x1802faac0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x1802fab52
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1802fab85
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1802fab40
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1801e81b0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
test r12, r12
je 0x1802fac37
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x1802fac63
lea rcx, [r15*8]
call fcn.1801e4f08
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x1802fac02
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1802fac37
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1802fabea
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.18017e330
mov r12, qword [rsi + 0x10]
jmp 0x1802fab52
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3
Function at 0x1802fac70
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1802faccf
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1802fade0
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1802fad2a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1802fad19
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1801e81b0
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1802fac9e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1802fae0c
lea rcx, [r12*8]
call fcn.1801e4f08
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1802fadab
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1802fade0
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1802fad93
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.18017e330
mov r15, qword [rsi + 8]
jmp 0x1802fac9e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3
Function at 0x1802fae20
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1802fae7f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1802faf90
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1802faeda
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1802faec9
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1801e81b0
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1802fae4e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1802fafbc
lea rcx, [r12*8]
call fcn.1801e4f08
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1802faf5b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1802faf90
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1802faf43
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.18017e330
mov r15, qword [rsi + 8]
jmp 0x1802fae4e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
call fcn.180267d05
int3

Function at 0x1802fb950
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1802fb96a
xor edx, edx
mov r8d, 1
add rsp, 0x28
jmp fcn.1801c7ad0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.18027be54
int3
Function at 0x18030fa50
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x18030fa60
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x18030fa81
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x18030faa1
cmp byte [r14 + 0x50], 0
je 0x18030fb65
or edi, 0x80000000
test dil, 8
je 0x18030fab8
cmp byte [r14 + 0x68], 0
je 0x18030fb70
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x18030facc
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x18030fadd
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
je 0x18030faf0
lea rcx, [r14 + 0x20]
call fcn.1801e0370
mov r15, rax
cmp byte [r14 + 0x18], 0
je 0x18030fb60
mov rcx, r14
call fcn.1801e0370
mov r9, rax
cmp ebx, 4
ja case.default.0x18030fb1b
mov eax, ebx
lea rcx, [0x18039dda4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x18030fb4b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
jmp 0x18030fb02
or edi, 0x20000000
jmp 0x18030faa1
or edi, 0x10000000
jmp 0x18030fab8
mov edx, 6
jmp 0x18030fb22
mov edx, 1
jmp 0x18030fb22
mov edx, 4
jmp 0x18030fb22
xor edx, edx
jmp 0x18030fb22

Function at 0x1803169ef
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x180316a2e
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1803169fe
mov dword [rsi], 7
jmp 0x1803169fe
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1801a4f2f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x180316a0a
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x180316a0a
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x180316ae0
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x180316a00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1803169fe