joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400680c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140089040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140068193
cmp byte [rcx + 0x71], 0
je 0x140068193
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14006818f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140068154
sub eax, 1
je 0x140068158
cmp eax, 2
jne 0x14006818f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a150
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140068186
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14006818f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14006813c
xor al, al
jmp 0x14006813c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a150
add rsp, 0x60
pop rbx
ret

Function at 0x14006975c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140069796
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14006979b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400697e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140072c80]
cmp byte [rcx + rax], 0
je 0x1400697e4
dec r8
sub rdx, 1
jne 0x1400697ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14006ae4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006ae96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006ae96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006ae96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006ae96
cmp dword [rcx + 0x84], 0xe
jbe 0x14006ae96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006ae98
xor al, al
add rsp, 0x28
ret
Function at 0x140009c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov byte [rsp], 0x3e
mov byte [rsp + 1], 0x55
mov byte [rsp + 2], 0x5b
mov byte [rsp + 3], 0x4c
mov byte [rsp + 4], 0x50
mov byte [rsp + 5], 0x5b
mov byte [rsp + 6], 0x52
mov byte [rsp + 7], 0xd
mov byte [rsp + 8], 0xc
mov byte [rsp + 9], 0x10
mov byte [rsp + 0xa], 0x5a
mov byte [rsp + 0xb], 0x52
mov byte [rsp + 0xc], 0x52
mov byte [rsp + 0xd], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140009d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov byte [rsp], 0xe
mov byte [rsp + 1], 0x4f
mov byte [rsp + 2], 0x62
mov byte [rsp + 3], 0x62
mov byte [rsp + 4], 0x61
mov byte [rsp + 5], 0x6d
mov byte [rsp + 6], 0x4d
mov byte [rsp + 7], 0x61
mov byte [rsp + 8], 0x60
mov byte [rsp + 9], 0x7d
mov byte [rsp + 0xa], 0x61
mov byte [rsp + 0xb], 0x62
mov byte [rsp + 0xc], 0x6b
mov byte [rsp + 0xd], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140009dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov byte [rsp], 0x55
mov byte [rsp + 1], 0x13
mov byte [rsp + 2], 0x27
mov byte [rsp + 3], 0x30
mov byte [rsp + 4], 0x30
mov byte [rsp + 5], 0x16
mov byte [rsp + 6], 0x3a
mov byte [rsp + 7], 0x3b
mov byte [rsp + 8], 0x26
mov byte [rsp + 9], 0x3a
mov byte [rsp + 0xa], 0x39
mov byte [rsp + 0xb], 0x30
mov byte [rsp + 0xc], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140009e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov byte [rsp], 0x5f
mov byte [rsp + 1], 0x1c
mov byte [rsp + 2], 0x2d
mov byte [rsp + 3], 0x3a
mov byte [rsp + 4], 0x3e
mov byte [rsp + 5], 0x2b
mov byte [rsp + 6], 0x3a
mov byte [rsp + 7], 0xf
mov byte [rsp + 8], 0x2d
mov byte [rsp + 9], 0x30
mov byte [rsp + 0xa], 0x3c
mov byte [rsp + 0xb], 0x3a
mov byte [rsp + 0xc], 0x2c
mov byte [rsp + 0xd], 0x2c
mov byte [rsp + 0xe], 0x1e
mov byte [rsp + 0xf], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140009f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov byte [rsp], 0x1c
mov byte [rsp + 1], 0x4b
mov byte [rsp + 2], 0x7d
mov byte [rsp + 3], 0x75
mov byte [rsp + 4], 0x68
mov byte [rsp + 5], 0x5a
mov byte [rsp + 6], 0x73
mov byte [rsp + 7], 0x6e
mov byte [rsp + 8], 0x4f
mov byte [rsp + 9], 0x75
mov byte [rsp + 0xa], 0x72
mov byte [rsp + 0xb], 0x7b
mov byte [rsp + 0xc], 0x70
mov byte [rsp + 0xd], 0x79
mov byte [rsp + 0xe], 0x53
mov byte [rsp + 0xf], 0x7e
mov byte [rsp + 0x10], 0x76
mov byte [rsp + 0x11], 0x79
mov byte [rsp + 0x12], 0x7f
mov byte [rsp + 0x13], 0x68
mov byte [rsp + 0x14], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0x15
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14000a060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov byte [rsp], 0x11
mov byte [rsp + 1], 0x43
mov byte [rsp + 2], 0x65
mov byte [rsp + 3], 0x7d
mov byte [rsp + 4], 0x4b
mov byte [rsp + 5], 0x74
mov byte [rsp + 6], 0x63
mov byte [rsp + 7], 0x7e
mov byte [rsp + 8], 0x5c
mov byte [rsp + 9], 0x74
mov byte [rsp + 0xa], 0x7c
mov byte [rsp + 0xb], 0x7e
mov byte [rsp + 0xc], 0x63
mov byte [rsp + 0xd], 0x68
mov byte [rsp + 0xe], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14000a2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rsp], 0x60
mov byte [rsp + 1], 0x10
mov byte [rsp + 2], 0xf
mov byte [rsp + 3], 0x17
mov byte [rsp + 4], 5
mov byte [rsp + 5], 0x12
mov byte [rsp + 6], 0x13
mov byte [rsp + 7], 8
mov byte [rsp + 8], 5
mov byte [rsp + 9], 0xc
mov byte [rsp + 0xa], 0xc
mov byte [rsp + 0xb], 0x4e
mov byte [rsp + 0xc], 5
mov byte [rsp + 0xd], 0x18
mov byte [rsp + 0xe], 5
mov byte [rsp + 0xf], 0x40
mov byte [rsp + 0x10], 0x4d
mov byte [rsp + 0x11], 0x25
mov byte [rsp + 0x12], 0xe
mov byte [rsp + 0x13], 3
mov byte [rsp + 0x14], 0xf
mov byte [rsp + 0x15], 4
mov byte [rsp + 0x16], 5
mov byte [rsp + 0x17], 4
mov byte [rsp + 0x18], 0x23
mov byte [rsp + 0x19], 0xf
mov byte [rsp + 0x1a], 0xd
mov byte [rsp + 0x1b], 0xd
mov byte [rsp + 0x1c], 1
mov byte [rsp + 0x1d], 0xe
mov byte [rsp + 0x1e], 4
mov byte [rsp + 0x1f], 0x40
mov byte [rsp + 0x20], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x58]
mov rsi, rax
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14000a3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1400618c0]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov byte [rsp], 0x26
mov byte [rsp + 1], 0x65
mov byte [rsp + 2], 0x54
mov byte [rsp + 3], 0x43
mov byte [rsp + 4], 0x47
mov byte [rsp + 5], 0x52
mov byte [rsp + 6], 0x43
mov byte [rsp + 7], 0x76
mov byte [rsp + 8], 0x54
mov byte [rsp + 9], 0x49
mov byte [rsp + 0xa], 0x45
mov byte [rsp + 0xb], 0x43
mov byte [rsp + 0xc], 0x55
mov byte [rsp + 0xd], 0x55
mov byte [rsp + 0xe], 6
mov byte [rsp + 0xf], 0x40
mov byte [rsp + 0x10], 0x47
mov byte [rsp + 0x11], 0x4f
mov byte [rsp + 0x12], 0x4a
mov byte [rsp + 0x13], 0x43
mov byte [rsp + 0x14], 0x42
mov byte [rsp + 0x15], 6
mov byte [rsp + 0x16], 0xe
mov byte [rsp + 0x17], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.140017a40
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x18004a620
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x18004a662
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x18004a66a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x18004a67b
jmp 0x18004a692
xor r10d, r10d
jmp 0x18004a71d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x18004a692
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x18004a6a9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x18004a6c9
add r11, r8
jmp 0x18004a7fb
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x18004a792
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x18004a740
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x18004a7b0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x18004a7c2
jmp 0x18004a7dd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x18004a7dd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x18004a7f7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x1800dc0d0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 8], 0
lea r9, [rbp - 8]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.shell32.dll_SHGetKnownFolderPath]
mov rcx, qword [rbp - 8]
test eax, eax
je 0x1800dc11d
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1800dc14c
call qword [sym.imp.kernel32.dll_lstrlenW]
movsxd r8, eax
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.1801d5880
mov rcx, qword [rbp - 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x18012a3e0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov r12, qword [rdx + 0x70]
mov r15, qword [rdx + 0x178]
mov edi, r15d
and edi, 0x3f
mov ecx, edi
shr r12, cl
test r12, r12
je 0x18012a463
mov rax, r12
shr rax, 0x3d
lea rbx, [r12*4]
test rax, rax
jne 0x18012a558
movzx eax, byte [0x1802ea611]
mov r14d, 4
mov edx, 4
mov rcx, rbx
call fcn.180004690
test rax, rax
je 0x18012a55b
cmp r12, 8
jae 0x18012a46d
xor edx, edx
jmp 0x18012a510
mov eax, 4
jmp 0x18012a528
movabs rdx, 0x1ffffffffffffff8
and rdx, r12
movd xmm0, edi
movabs rcx, 0x7fffffffffffffe0
and rbx, rcx
movdqa xmm1, xmmword [0x180221ff0]
movdqa xmm2, xmmword [0x18021c590]
xor ecx, ecx
movdqa xmm3, xmmword [0x18021c5c0]
movdqa xmm4, xmmword [0x180222000]
nop dword [rax]
movdqa xmm5, xmm1
paddq xmm5, xmm3
movdqa xmm6, xmm2
movdqa xmm7, xmm2
psllq xmm7, xmm0
paddq xmm6, xmm3
movdqa xmm8, xmm1
psllq xmm8, xmm0
psllq xmm6, xmm0
psllq xmm5, xmm0
shufps xmm7, xmm8, 0x88
shufps xmm6, xmm5, 0x88
movups xmmword [rax + rcx], xmm7
movups xmmword [rax + rcx + 0x10], xmm6
paddq xmm2, xmm4
paddq xmm1, xmm4
add rcx, 0x20
cmp rbx, rcx
jne 0x18012a4b0
cmp r12, rdx
je 0x18012a528
nop word cs:[rax + rax]
mov r8, rdx
mov ecx, edi
shl r8, cl
mov dword [rax + rdx*4], r8d
lea rcx, [rdx + 1]
mov rdx, rcx
cmp r12, rcx
jne 0x18012a510
mov qword [rsi], r12
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r15
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor r14d, r14d
mov rcx, r14
mov rdx, rbx
call fcn.180201570
int3
Function at 0x18012a8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
tzcnt eax, edx
lea edx, [rax - 6]
cmp edx, 0xc
jae 0x18012aa08
xor edx, edx
lea r9, [0x1802250a0]
mov r10d, 1
xor ecx, ecx
movzx r11d, cx
cmp r11d, 0x100
mov esi, 0xff
cmovae esi, r11d
lea eax, [r11 - 1]
neg esi
nop word cs:[rax + rax]
lea edi, [rsi + rax]
cmp di, 0xffff
je 0x18012a9a5
lea edi, [rax + 2]
cmp byte [r11 + r9], 0
setne bl
movzx edi, dil
cmp byte [rdi + r9], 0
sete dil
xor dil, bl
inc eax
test dil, dil
jne 0x18012a900
test cl, cl
je 0x18012a963
dec cl
xor r11d, r11d
shld r11, r10, cl
mov ebx, ecx
mov esi, 1
shl rsi, cl
shr bl, 7
test cl, 0x40
cmovne r11, rsi
cmovne rsi, rdx
movzx ecx, bl
shl ecx, 4
or qword [r8 + rcx], rsi
or qword [r8 + rcx + 8], r11
xor r11d, r11d
mov ecx, eax
shld r11, r10, cl
mov ebx, eax
mov esi, 1
shl rsi, cl
shr bl, 7
test al, 0x40
cmovne r11, rsi
cmovne rsi, rdx
movzx ecx, bl
shl ecx, 4
or qword [r8 + rcx], rsi
or qword [r8 + rcx + 8], r11
lea ecx, [rax + 1]
movzx eax, ax
cmp eax, 0xff
jb 0x18012a8d8
jmp 0x18012aa00
cmp r11d, 0xff
ja 0x18012aa91
test cl, cl
je 0x18012a9e9
dec cl
mov eax, ecx
shr al, 7
mov edx, 1
xor r9d, r9d
shld r9, rdx, cl
shl rdx, cl
xor r10d, r10d
test cl, 0x40
cmovne r9, rdx
cmovne rdx, r10
movzx eax, al
shl eax, 4
or qword [r8 + rax], rdx
or qword [r8 + rax + 8], r9
add r8, 0x10
movabs r9, 0x8000000000000000
xor edx, edx
or qword [r8], rdx
or qword [r8 + 8], r9
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov edx, 0x3600
xor r9d, r9d
mov r10d, 3
bt r10d, eax
jb 0x18012aa00
mov r10d, 0xc
bt r10d, eax
jae 0x18012a9f9
movzx eax, byte [rcx]
test rax, rax
je 0x18012aa65
lea ecx, [rax - 1]
mov edx, ecx
shr dl, 7
mov r9d, 1
xor r10d, r10d
shld r10, r9, cl
shl r9, cl
xor r11d, r11d
test cl, 0x40
cmovne r10, r9
cmovne r9, r11
movzx ecx, dl
shl ecx, 4
or qword [r8 + rcx], r9
or qword [r8 + rcx + 8], r10
mov edx, 1
xor r9d, r9d
mov ecx, eax
shld r9, rdx, cl
xor r10d, r10d
shl rdx, cl
test al, 0x40
cmovne r9, rdx
cmovne rdx, r10
shr eax, 3
and eax, 0xfffffff0
add r8, rax
jmp 0x18012a9f9
lea rcx, str.assertion_failed:_b2___256
lea r8, str.C:Users_runneradmin_.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.6_srcutillook.rsC:Users_runneradmin_.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.6_srcdfa_remapper.rs
mov edx, 0x1b
call fcn.1802018d0
int3
Function at 0x180132090
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov r15, rcx
mov rbx, qword [rcx + 8]
mov r12, qword [rcx + 0x10]
test r12, r12
mov qword [rbp - 0x18], rcx
je 0x180132104
mov rax, r12
shr rax, 0x3d
lea rdi, [r12*4]
test rax, rax
jne 0x18013223c
movzx eax, byte [0x1802ea611]
mov r14d, 4
mov edx, 4
mov rcx, rdi
call fcn.180004690
test rax, rax
je 0x18013223f
mov r13, rax
jmp 0x18013210c
mov r13d, 4
xor edi, edi
mov rcx, r13
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rsi + 0x10]
test r8, r8
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r13
je 0x1801321a8
mov rcx, qword [r15 + 0x18]
and ecx, 0x3f
xor eax, eax
jmp 0x180132150
mov rdx, qword [r15 + 8]
mov dword [rdx + rax*4], r10d
inc rax
cmp rax, r8
je 0x1801321a8
mov r9, rax
shl r9, cl
cmp rax, r12
je 0x180132228
mov edx, dword [r13 + rax*4]
cmp edx, r9d
je 0x180132148
nop dword [rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, r12
jae 0x180132214
mov edx, dword [r13 + rdx*4]
cmp edx, r9d
jne 0x180132170
mov rdx, qword [r15 + 0x10]
cmp rax, rdx
jb 0x180132140
lea r8, str.C:Users_runneradmin_.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.1.2_srcutil_remapper.rs
mov rcx, rax
call fcn.180201960
jmp 0x18013224a
lea r8, [r15 + 0x18]
mov rcx, rsi
mov rdx, r15
call fcn.18012dc50
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x1801321d3
shl rdx, 2
mov r8d, 4
mov rcx, qword [rbp - 8]
call fcn.1800046a0
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
test rdx, rdx
je 0x180132202
mov rcx, qword [rax + 8]
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.1800046a0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.C:Users_runneradmin_.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.1.2_srcutil_remapper.rs
mov rcx, rdx
mov rdx, r12
call fcn.180201960
jmp 0x18013224a
lea r8, str.C:Users_runneradmin_.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.1.2_srcutil_remapper.rs
mov rcx, r12
mov rdx, r12
call fcn.180201960
jmp 0x18013224a
xor r14d, r14d
mov rcx, r14
mov rdx, rdi
call fcn.180201570
ud2
Function at 0x18018e2c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1802ea611]
mov ecx, 0x1818
mov edx, 4
call fcn.180004690
test rax, rax
je 0x18018e3de
xor ecx, ecx
lea rdx, [0x180256a40]
movdqa xmm0, xmmword [0x180221660]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x18018e310
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0x303
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1801920c0
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.180191bf0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.180201570
int3

Function at 0x18018e550
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1802ea611]
mov ecx, 0x200
mov edx, 4
call fcn.180004690
test rax, rax
je 0x18018e65d
xor ecx, ecx
lea rdx, [0x1802582a8]
movdqa xmm0, xmmword [0x180221660]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x18018e5a0
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1801920c0
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.180191bf0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.180201570
int3