joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400646c0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x180
movaps xmmword [rsp + 0x170], xmm6
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0x168], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0x108], 0
movabs rax, 0x4000000070
mov qword [rsp + 0xa0], rax
lea rax, str.runas
mov qword [rsp + 0xb0], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], r15
movaps xmm6, xmmword [0x140206780]
movaps xmmword [rsp + 0x80], xmm6
lea r14, [rsp + 0x110]
mov rcx, r8
mov rdx, r14
call fcn.140091f70
cmp byte [r14 + 0x17], 0
js 0x140064911
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x110]
call fcn.1400fb8a0
cmp byte [rsp + 0x97], 0
jns 0x1400647d1
mov rax, qword [rsp + 0x80]
jmp 0x1400647d9
lea rax, [rsp + 0x80]
mov qword [rsp + 0xb8], rax
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], r15
movaps xmmword [r14], xmm6
mov rcx, rbx
mov rdx, r14
call fcn.1400931a0
cmp byte [r14 + 0x17], 0
jns 0x140064805
mov r14, qword [rsp + 0x60]
lea rbx, [rsp + 0xa0]
mov qword [rbx + 0x20], r14
mov dword [rbx + 0x30], 5
lea r14, [rsp + 0x110]
mov qword [r14 + 0x50], r15
movaps xmmword [r14 + 0x40], xmm6
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.RunElevatedProcess
lea r8, str.....operadesktopwindowsos_operationsos_operations_impl.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x176
call fcn.1400fc5d0
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1401089a0
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14006488a
mov rdx, qword [rsp + 0x108]
lea rbx, [rsp + 0x30]
mov rcx, rbx
jmp 0x140064894
lea rbx, [rsp + 0x20]
mov rcx, rbx
xor edx, edx
call fcn.14010e980
mov rax, qword [rdi]
mov rax, qword [rax + 0xc0]
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call qword [case.0x1401b1830.0]
lea rcx, [rsp + 0x110]
call fcn.140108a00
cmp byte [rsp + 0x77], 0
jns 0x1400648d0
mov rcx, qword [rsp + 0x60]
call fcn.14014847c
cmp byte [rsp + 0x97], 0
jns 0x1400648e7
mov rcx, qword [rsp + 0x80]
call fcn.14014847c
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140148f60
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x180
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
lea rcx, [rsp + 0x80]
call fcn.14008f3a0
jmp 0x1400647b0
Function at 0x1400649a0
Capabilities:
Check mutex on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov ebp, r9d
mov rbx, r8
mov rsi, rdx
mov r12, qword [rsp + 0x140]
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov ecx, SafeArrayCopy
call fcn.140148440
mov rdi, rax
mov qword [rsp + 0x58], r12
lea rax, fcn.1400658f0
mov qword [rdi], rax
mov byte [rdi + 0x10], 0
movaps xmm6, xmmword [0x140206780]
movaps xmmword [rsp + 0x40], xmm6
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x40], SafeArrayCopy
mov qword [rsp + 0x48], 0
movzx eax, bpl
mov dword [rsp + 0x50], eax
cmp byte [rbx + 0x17], 0
jns 0x140064a39
mov rbx, qword [rbx]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 8], rax
test rax, rax
je 0x140064b17
mov r14, rax
lea rbx, [rsp + 0x68]
movaps xmmword [rbx - 8], xmm6
movaps xmmword [rbx + 8], xmm6
movaps xmmword [rbx + 0x18], xmm6
movaps xmmword [rbx + 0x28], xmm6
movaps xmmword [rbx + 0x38], xmm6
movaps xmmword [rbx + 0x48], xmm6
mov qword [rbx + 0x58], r15
mov byte [rbx - 8], 0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov qword [rbx + 0x50], 0
test r12, r12
je 0x140064ae9
lea rdx, str.NamedMutexImpl
lea r8, str.....operadesktopwindowsos_operationsos_operations_impl.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0xd9
call fcn.1400fc5d0
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
call fcn.1401089a0
mov byte [rsp + 0x60], 1
mov edx, 0xffffffff
movabs rax, 0x7fffffffffffffff
cmp r12, rax
je 0x140064af6
lea rcx, [rsp + 0x58]
call fcn.140108f60
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
sete byte [rdi + 0x10]
cmp byte [rsp + 0x60], 0
je 0x140064b17
mov rcx, rbx
call fcn.140108a00
mov qword [rsi], rdi
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140148f60
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400650e0
Capabilities:
Query or enumerate registry value

Disassembly:
add rcx, 0x18
cmp byte [rdx + 0x17], 0
jns 0x1400650ed
mov rdx, qword [rdx]
jmp 0x1400ac060
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x1400653b0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r14, [rsp + 0x64]
mov dword [r14], 0x104
lea rbx, [rcx + 0x30]
mov edx, 0x104
mov rcx, rbx
call fcn.1400aa560
mov edx, dword [rdi + 0x78]
mov rcx, qword [rdi + 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
mov r8, rax
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [rdi + 0x78]
test eax, eax
je 0x140065451
add rdi, 0x60
mov rcx, rdi
call fcn.1401b1890
mov qword [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140148f60
mov rax, rsi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, [rdi + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x140206780]
movaps xmmword [r14], xmm0
lea r8, [0x140209916]
mov rcx, r14
call fcn.14003b350
movzx edx, byte [r14 + 0x17]
test dl, dl
jns 0x140065492
mov rdx, qword [rsp + 0x48]
jmp 0x140065495
and edx, 0x7f
mov rcx, r14
xor r8d, r8d
call fcn.1400fa130
movzx r8d, byte [rdi + 0x47]
test r8b, r8b
jns 0x1400654b4
mov r8, qword [rdi + 0x38]
mov rbx, qword [rdi + 0x30]
jmp 0x1400654b8
and r8d, 0x7f
mov rcx, r14
mov rdx, rbx
call fcn.14008fa00
cmp byte [rsp + 0x57], 0
jns 0x1400654cf
mov r14, qword [rsp + 0x40]
mov ecx, 0x50
call fcn.140148440
mov rbx, rax
mov ebp, dword [rdi + 0x28]
lea r15, [rsp + 0x68]
mov rcx, r15
mov rdx, r14
call fcn.140185a00
mov rdi, qword [rdi + 8]
lea rax, fcn.140065020
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], ebp
lea r14, [rbx + 0x18]
mov rcx, r14
call fcn.1400abe90
lea rcx, [rbx + 0x30]
mov al, byte [r15 + 0x17]
test al, al
js 0x140065578
mov rdx, qword [rsp + 0x78]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rcx], xmm0
test al, al
jns 0x140065536
mov r15, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9d, ebp
call fcn.1400abf90
mov dword [rbx + 0x48], eax
cmp byte [rsp + 0x7f], 0
jns 0x14006555b
mov rcx, qword [rsp + 0x68]
call fcn.14014847c
mov qword [rsi], rbx
cmp byte [rsp + 0x57], 0
jns 0x14006542e
mov rcx, qword [rsp + 0x40]
call fcn.14014847c
jmp 0x14006542e
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
call fcn.14008f3a0
mov al, byte [rsp + 0x7f]
jmp 0x14006552d
Function at 0x140078290
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, [0x140204248]
mov qword [rcx], rax
cmp byte [rcx + 0x38], 0
je 0x140078377
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
mov edx, VarR8FromUI1
call fcn.1400fc630
test eax, eax
jg 0x1400783f9
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.1400a6820
test al, al
jne 0x1400782f6
mov rcx, rdi
call fcn.1401aed10
cmp byte [rsi + 0x3a], 0
je 0x1400783a5
lea rcx, [rsi + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x140206780]
movaps xmmword [rdi], xmm0
mov rdx, rdi
call fcn.1400fb8b0
mov r14, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rbx, [rsp + 0x28]
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x140078344
mov rcx, qword [rsp + 0x40]
call r14
test eax, eax
je 0x14007836b
mov rcx, rdi
mov rdx, rbx
call fcn.1400fb8b0
mov rcx, rdi
mov rdx, rbx
call fcn.140094310
mov rcx, rbx
call fcn.1400fb8a0
jmp 0x140078335
lea rcx, [rsp + 0x40]
call fcn.1400fb8a0
jmp 0x1400783a5
cmp qword [rsi + 0x40], 0
je 0x1400783a5
lea rdi, [rsi + 0x40]
mov rcx, qword [0x14023b228]
test rcx, rcx
jne 0x14007839d
call fcn.14005f340
mov rcx, rax
mov qword [0x14023b228], rax
mov rdx, rdi
call fcn.1400602b0
mov rdi, qword [rsi + 0x40]
mov qword [rsi + 0x40], 0
test rdi, rdi
je 0x1400783c6
mov rcx, rdi
call fcn.140061110
mov rcx, rdi
call fcn.14014847c
lea rcx, [rsi + 0x20]
call fcn.1400fb8a0
add rsi, 8
mov rcx, rsi
call fcn.1400fb8a0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140148f60
nop
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x25
mov r9d, 0xffffffff
call fcn.140097d90
lea rcx, [rsp + 0x50]
lea rdx, str.Actual_removal_of
mov r8d, shutdown
call fcn.140185b20
lea rdx, [rsi + 0x20]
mov rcx, rax
call fcn.1400987b0
mov rcx, rdi
call fcn.140098280
jmp 0x1400782de
Function at 0x14007a100
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rdi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14007a2bc
movabs rax, 0x1fffffffffffffff
mov r8, qword [rdi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14007a17b
cmp r14, rax
ja 0x14007a2c1
lea rcx, [r14*8]
call fcn.140148440
jmp 0x14007a17d
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x14007a290
lea rax, [rax + r14*8]
mov rcx, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rsi, qword [rdi]
mov rdx, qword [rdi + 8]
cmp rdx, rsi
je 0x14007a238
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rsi
jne 0x14007a1af
mov rsi, qword [rdi]
mov r14, qword [rdi + 8]
mov qword [rdi], rbx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rax
cmp r14, rsi
je 0x14007a243
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14007a264
mov rdi, qword [r14]
mov qword [r14], 0
test rdi, rdi
je 0x14007a22a
mov rcx, qword [rdi + 0x20]
mov qword [rdi + 0x20], 0
test rcx, rcx
je 0x14007a214
call fcn.1401484c4
cmp byte [rdi + 0x17], 0
jns 0x14007a222
mov rcx, qword [rdi]
call fcn.14014847c
mov rcx, rdi
call fcn.14014847c
lea rax, [r14 - 8]
cmp r14, rsi
mov r14, rax
jne 0x14007a1ea
jmp 0x14007a243
mov qword [rdi], rbx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rax
test rsi, rsi
je 0x14007a259
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014847c
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140186340
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140186340
call fcn.140162470
call fcn.140185b10
int3
Function at 0x14007a2d0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14007a46c
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14007a34b
cmp r14, rax
ja 0x14007a471
lea rcx, [r14*8]
call fcn.140148440
jmp 0x14007a34d
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x14007a440
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rdi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x14007a3e8
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rdi
jne 0x14007a37b
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x14007a3f3
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14007a414
mov rsi, qword [r14]
mov qword [r14], 0
test rsi, rsi
je 0x14007a3da
mov rcx, rsi
call fcn.140079f60
mov rcx, rsi
call fcn.14014847c
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x14007a3b6
jmp 0x14007a3f3
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
je 0x14007a409
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014847c
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140186340
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140186340
call fcn.140162470
call fcn.140185b10
int3
Function at 0x14007a4f0
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [0x140204288]
mov qword [rcx], rax
cmp byte [rcx + 0x40], 0
je 0x14007a590
lea rcx, [rsi + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x140206780]
movaps xmmword [rdi], xmm0
mov rdx, rdi
call fcn.1400fb8b0
mov r14, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rbx, [rsp + 0x28]
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x14007a55f
mov rcx, qword [rsp + 0x40]
call r14
test eax, eax
je 0x14007a586
mov rcx, rdi
mov rdx, rbx
call fcn.1400fb8b0
mov rcx, rdi
mov rdx, rbx
call fcn.140094310
mov rcx, rbx
call fcn.1400fb8a0
jmp 0x14007a550
lea rcx, [rsp + 0x40]
call fcn.1400fb8a0
lea rcx, [rsi + 0x28]
call fcn.1400fb8a0
lea rcx, [rsi + 0x10]
call fcn.1400fb8a0
mov rcx, qword [rsi + 8]
mov rax, qword [0x14022d7e0]
and rax, rcx
cmp rax, qword [0x14022d7c8]
jne 0x14007a5be
call fcn.1400fe6c0
mov qword [rsi + 8], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140148f60
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007d2d0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14007d46d
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14007d34b
cmp r14, rax
ja 0x14007d472
lea rcx, [r14*8]
call fcn.140148440
jmp 0x14007d34d
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x14007d441
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rdi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x14007d3e9
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rdi
jne 0x14007d37b
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x14007d3f4
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14007d415
mov rcx, qword [r14]
mov qword [r14], 0
test rcx, rcx
je 0x14007d3db
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x1401b1830.0]
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x14007d3b6
jmp 0x14007d3f4
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
je 0x14007d40a
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014847c
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140186340
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140186340
call fcn.140162470
call fcn.140185b10
int3
Function at 0x1400809b0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x140080af8
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x140080afd
cmp r14, rax
ja 0x140080b04
lea rcx, [r14*8]
call fcn.140148440
shl rbx, 3
add rbx, rax
je 0x140080b09
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rdi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
jne 0x140080a68
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
jmp 0x140080ad7
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rdi
jne 0x140080a68
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x140080ad7
add r14, 0xfffffffffffffff8
test r14, r14
je 0x140080b35
mov rsi, qword [r14]
mov qword [r14], 0
test rsi, rsi
je 0x140080acb
mov rcx, rsi
call fcn.1400ac010
mov rcx, rsi
call fcn.14014847c
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x140080aa3
test rdi, rdi
je 0x140080aed
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014847c
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140162470
xor eax, eax
jmp 0x140080a2d
call fcn.140185b10
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140186340
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140186340
int3
Function at 0x140091460
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14023d028]
test rdi, rdi
jne 0x140091513
mov ecx, 0x50
call fcn.140148440
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, SafeArrayCopy
call fcn.140148440
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x140091535
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x14023d028], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140091561
mov rcx, rax
call fcn.140170424
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140091570
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140148f60
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140186340
int3
Function at 0x140091570
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1400aa3e0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x140091704
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x14020fc14]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x140091781
lea rdx, [0x14020fc64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140091794
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x1401b1830.0]
mov r15, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x14009179c
shl r12, 3
movabs rax, 0x5555555555555551
cmp r12, rax
jae 0x1400917a6
lea r14, [r12 + r12*2]
mov rcx, r14
call fcn.140148440
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, r14
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov r14, rbx
test r14, r14
je 0x140091729
mov rdx, qword [r15 + r13]
mov rcx, r14
call fcn.140185a00
add r14, 0x18
add r13, 8
cmp r12, r13
jne 0x14009167c
mov qword [rsp + 0x38], r14
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140091270
movups xmmword [rsi], xmm6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400916ca
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140091704
cmp r14, rbx
je 0x1400916fc
add r14, 0xffffffffffffffe8
test r14, r14
je 0x140091755
cmp byte [r14 + 0x17], 0
js 0x1400916f2
lea rax, [r14 - 0x18]
cmp r14, rbx
mov r14, rax
jne 0x1400916d8
jmp 0x1400916fc
mov rcx, qword [r14]
call fcn.14014847c
jmp 0x1400916e4
mov rcx, rbx
call fcn.14014847c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140148f60
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140186340
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140186340
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140091621
xor r15d, r15d
jmp 0x140091624
xor r14d, r14d
xor ebx, ebx
jmp 0x1400916a3
call fcn.140162470
int3