joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180191f50
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.18017f7a0
lea rcx, [0x1803ecf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x48]
mov qword [r8], rsi
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x44]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov r9, r8
call fcn.180195d70
mov qword [rsi + 0x28], rsi
lea rax, fcn.180060880
mov qword [rsi], rax
call fcn.18017f7a0
mov rcx, qword [rdi]
mov rdx, rax
call fcn.18017a550
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x180192030
mov r8, qword [rsi + 8]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x20], ecx
mov byte [rsp + 0x28], 0
mov rcx, rax
xor r9d, r9d
call fcn.1801795a0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x18]
mov qword [rcx], rax
jmp 0x180192019

Function at 0x180192960
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm9
movaps xmmword [rsp + 0x70], xmm8
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm6
movaps xmm6, xmm3
movaps xmm7, xmm2
movaps xmm8, xmm1
mov rsi, rcx
movss xmm9, dword [rsp + 0xc0]
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.18017f7a0
lea rcx, [0x1803ecf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x30]
mov qword [r8], rsi
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x2c]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov r9, r8
call fcn.180195d70
mov qword [rsi + 0x28], rsi
lea rax, fcn.180060880
mov qword [rsi], rax
movss dword [rsp + 0x20], xmm9
mov rcx, rsi
movaps xmm1, xmm8
movaps xmm2, xmm7
movaps xmm3, xmm6
call fcn.180192820
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm9, xmmword [rsp + 0x80]
add rsp, 0x90
pop rsi
ret
Function at 0x180192a70
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.18017f7a0
lea rcx, [0x1803ecf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x48]
mov qword [r8], rsi
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x44]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov r9, r8
call fcn.180195d70
mov qword [rsi + 0x28], rsi
lea rax, fcn.180060880
mov qword [rsi], rax
mov rcx, qword [rdi]
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x180192b40
mov r8, qword [rsi + 8]
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], eax
mov byte [rsp + 0x28], 0
xor r9d, r9d
call fcn.1801795a0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret
lea rax, [rsi + 0x18]
mov qword [rax], rcx
jmp 0x180192b29

Function at 0x180192b50
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.18017f7a0
lea rcx, [0x1803ecf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x48]
mov qword [r8], rsi
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x44]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov r9, r8
call fcn.180195d70
mov qword [rsi + 0x28], rsi
lea rax, fcn.180060880
mov qword [rsi], rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x180192c16
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x180192c5a
mov rdx, qword [rdi + 8]
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call fcn.1801792a0
mov rcx, rax
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x180192c51
mov r8, qword [rsi + 8]
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], eax
mov byte [rsp + 0x28], 0
xor r9d, r9d
call fcn.1801795a0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret
lea rax, [rsi + 0x18]
mov qword [rax], rcx
jmp 0x180192c3a
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call fcn.180177ea0
mov qword [rdi + 0x20], rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x180192bf4
xor edx, edx
test rax, rax
je 0x180192ca7
mov r8, qword [rdi + 8]
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x20], edx
mov byte [rsp + 0x28], 0
mov rdx, rax
xor r9d, r9d
call fcn.1801795a0
mov rax, qword [rdi + 0x20]
mov qword [rdi + 0x18], 0
jmp 0x180192bf4
xor eax, eax
jmp 0x180192c9a
Function at 0x180192cb0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.18017f7a0
lea rcx, [0x1803ecf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
xor ebp, ebp
mov dword [rsi + 0x10], ebp
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x48]
mov qword [r8], rsi
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x44]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov r9, r8
call fcn.180195d70
mov qword [rsi + 0x28], rsi
lea rax, fcn.180060880
mov qword [rsi], rax
mov ebx, dword [rdi + 8]
call fcn.18017f7a0
mov rcx, qword [rdi]
mov dword [rsp + 0x28], ebp
mov byte [rsp + 0x20], 0
mov rdx, rax
xor r8d, r8d
mov r9d, ebx
call fcn.1801792a0
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x180192da2
mov r8, qword [rsi + 8]
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x28], 0
mov rcx, rax
xor r9d, r9d
call fcn.1801795a0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x18]
mov qword [rcx], rax
jmp 0x180192d89
Function at 0x180192f30
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.18017f7a0
lea rcx, [0x1803ecf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x60]
mov qword [r8], rsi
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x5c]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
mov r9, r8
call fcn.180195d70
mov qword [rsi + 0x28], rsi
lea rax, fcn.180060880
mov qword [rsi], rax
mov ecx, 0x10
call fcn.180363d5c
mov qword [rsp + 0x40], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 0x50], rcx
test rax, rax
je 0x18019307a
mov dword [rax], 0
cmp rax, 0xfffffffffffffffc
je 0x18019307a
mov dword [rax + 4], 1
cmp rax, 0xfffffffffffffff8
je 0x18019307a
mov dword [rax + 8], 4
cmp rax, 0xfffffffffffffff4
je 0x18019307a
mov dword [rax + 0xc], 5
lea r8, [rsp + 0x40]
mov qword [r8 + 8], rcx
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call fcn.18017aeb0
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x180193071
mov r8, qword [rsi + 8]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x20], ecx
mov byte [rsp + 0x28], 0
mov rcx, rax
xor r9d, r9d
call fcn.1801795a0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x18]
mov qword [rcx], rax
jmp 0x180193056
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1803aa860
int3
Function at 0x1801930b0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
movaps xmm6, xmm2
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.18017f7a0
lea r14, [0x1803ecf00]
lea rbx, [rsp + 0x28]
mov qword [rbx], r14
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 0
mov eax, dword [0x1804c29cc]
mov rcx, qword gs:[0x58]
mov r15, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbx + 0x18], xmm0
mov rax, qword [r15 + 0x38]
lea r8, [rsp + 0x60]
mov qword [r8], rbx
lea rcx, [rax + 8]
mov edx, dword [rax]
lea r9d, [rdx + 1]
mov dword [rax], r9d
lea rax, [rsp + 0x5c]
mov dword [rax], edx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
mov r9, r8
call fcn.180195d70
mov qword [rbx + 0x28], rbx
lea rax, fcn.180060880
mov qword [rbx], rax
movss dword [rsp + 0x20], xmm6
mov rcx, rbx
movaps xmm1, xmm6
movaps xmm2, xmm6
movaps xmm3, xmm6
call fcn.180192820
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.180188d80
mov qword [rbx], r14
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x180193198
lea rdx, [rsp + 0x28]
call fcn.1801876a0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1801d9c00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov ebx, dword [rdx + 0x40]
mov rax, qword [rcx + 0x60]
cmp rax, qword [rcx + 0x68]
je 0x1801d9c4a
mov qword [rax], rdi
add rax, 8
mov qword [rsi + 0x60], rax
mov rax, qword [rsi + 0x320]
mov rax, qword [rax + rbx*8]
mov rcx, qword [rax]
test rcx, rcx
je 0x1801d9cf9
tzcnt rcx, rcx
jmp 0x1801d9d2b
lea rcx, [rsi + 0x58]
sub rax, qword [rcx]
mov r14, rax
sar r14, 3
lea rdx, [r14 + 1]
mov r8, rdx
shr r8, 0x3d
jne 0x1801d9d9f
movabs rcx, 0x1fffffffffffffff
mov r15, rax
sar r15, 2
cmp r15, rdx
cmovbe r15, rdx
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
cmovae r15, rcx
test r15, r15
je 0x1801d9ccf
call fcn.1801d4910
lea rdx, [r15*8]
mov r8d, 8
mov rcx, rax
call fcn.180185210
lea rdx, [rax + r14*8]
lea rcx, [rax + r15*8]
mov qword [rdx], rdi
lea rax, [rax + r14*8]
add rax, 8
mov r8, qword [rsi + 0x58]
mov r9, qword [rsi + 0x60]
jmp 0x1801d9ce3
xor eax, eax
jmp 0x1801d9cb2
mov r10, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [rdx - 8], r10
add rdx, 0xfffffffffffffff8
cmp r9, r8
jne 0x1801d9cd3
mov qword [rsi + 0x58], rdx
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x68], rcx
jmp 0x1801d9c29
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1801d9d55
tzcnt rcx, rcx
or ecx, 0x40
jmp 0x1801d9d2b
cmp ecx, 0x7e
ja 0x1801d9d55
add cl, 0xc1
mov rdx, qword [rax + 8]
shr rdx, cl
shl rdx, cl
tzcnt rcx, rdx
or ecx, 0x40
test rdx, rdx
je 0x1801d9d55
mov edx, ecx
mov r8, qword [rsi + 0x100]
inc dword [r8 + rdx*4]
cmp ecx, 0x3e
ja 0x1801d9d0c
inc cl
mov rdx, qword [rax]
shr rdx, cl
shl rdx, cl
bsf rcx, rdx
jne 0x1801d9d2b
mov ecx, 0x3f
jmp 0x1801d9d11
mov rax, qword [rsi + 0x40]
cmp qword [rsi + 0x38], rax
je 0x1801d9d73
add rax, 0xfffffffffffffff8
mov qword [rsi + 0x40], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.vector::pop_back_called_on_an_empty_vector
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_vector
lea r9, str._empty__
mov r8d, 0x653
call fcn.1803aa860
call fcn.180007700
int3
Function at 0x1801d9db0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov ecx, dword [rdx + 0x10]
mov dword [rax + 0x44], ecx
mov eax, dword [rdx + 0x10]
mov rcx, qword [rsi + 0x320]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax]
test rcx, rcx
je 0x1801d9de5
tzcnt rcx, rcx
jmp 0x1801d9e17
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1801d9e41
tzcnt rcx, rcx
or ecx, 0x40
jmp 0x1801d9e17
cmp ecx, 0x7e
ja 0x1801d9e41
add cl, 0xc1
mov rdx, qword [rax + 8]
shr rdx, cl
shl rdx, cl
tzcnt rcx, rdx
or ecx, 0x40
test rdx, rdx
je 0x1801d9e41
mov edx, ecx
mov r8, qword [rsi + 0x100]
inc dword [r8 + rdx*4]
cmp ecx, 0x3e
ja 0x1801d9df8
inc cl
mov rdx, qword [rax]
shr rdx, cl
shl rdx, cl
bsf rcx, rdx
jne 0x1801d9e17
mov ecx, 0x3f
jmp 0x1801d9dfd
mov rax, qword [rsi + 0x60]
cmp rax, qword [rsi + 0x68]
je 0x1801d9e63
mov rcx, qword [rdi]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 0x60], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsi + 0x58]
sub rax, qword [rcx]
mov rbx, rax
sar rbx, 3
lea rdx, [rbx + 1]
mov r8, rdx
shr r8, 0x3d
jne 0x1801d9f15
movabs rcx, 0x1fffffffffffffff
mov r14, rax
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
cmovae r14, rcx
test r14, r14
je 0x1801d9eeb
call fcn.1801d4910
lea rdx, [r14*8]
mov r8d, 8
mov rcx, rax
call fcn.180185210
lea rdx, [rax + rbx*8]
lea rcx, [rax + r14*8]
mov r8, qword [rdi]
mov qword [rdx], r8
lea rax, [rax + rbx*8]
add rax, 8
mov r8, qword [rsi + 0x58]
mov r9, qword [rsi + 0x60]
jmp 0x1801d9eff
xor eax, eax
jmp 0x1801d9ecb
mov r10, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [rdx - 8], r10
add rdx, 0xfffffffffffffff8
cmp r9, r8
jne 0x1801d9eef
mov qword [rsi + 0x58], rdx
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x68], rcx
jmp 0x1801d9e59
call fcn.180007700
int3
Function at 0x1801d9f20
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
lea rcx, [rdx + 0x48]
lea rax, [rdx + 0x60]
test r8b, r8b
cmovne rax, rcx
mov rcx, qword [rax]
test rcx, rcx
je 0x1801d9f6d
tzcnt rax, rcx
mov rcx, qword [rdi]
mov dword [rcx + 0x44], eax
mov eax, eax
mov rcx, qword [rsi + 0x320]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax]
test rcx, rcx
je 0x1801d9f85
tzcnt rcx, rcx
jmp 0x1801d9fb7
mov rcx, qword [rax + 8]
tzcnt rdx, rcx
xor eax, eax
cmp rcx, 1
sbb eax, eax
or eax, edx
or eax, 0x40
jmp 0x1801d9f4b
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1801d9fe1
tzcnt rcx, rcx
or ecx, 0x40
jmp 0x1801d9fb7
cmp ecx, 0x7e
ja 0x1801d9fe1
add cl, 0xc1
mov rdx, qword [rax + 8]
shr rdx, cl
shl rdx, cl
tzcnt rcx, rdx
or ecx, 0x40
test rdx, rdx
je 0x1801d9fe1
mov edx, ecx
mov r8, qword [rsi + 0x100]
inc dword [r8 + rdx*4]
cmp ecx, 0x3e
ja 0x1801d9f98
inc cl
mov rdx, qword [rax]
shr rdx, cl
shl rdx, cl
bsf rcx, rdx
jne 0x1801d9fb7
mov ecx, 0x3f
jmp 0x1801d9f9d
mov rax, qword [rsi + 0x60]
cmp rax, qword [rsi + 0x68]
je 0x1801da003
mov rcx, qword [rdi]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 0x60], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsi + 0x58]
sub rax, qword [rcx]
mov rbx, rax
sar rbx, 3
lea rdx, [rbx + 1]
mov r8, rdx
shr r8, 0x3d
jne 0x1801da0b5
movabs rcx, 0x1fffffffffffffff
mov r14, rax
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
cmovae r14, rcx
test r14, r14
je 0x1801da08b
call fcn.1801d4910
lea rdx, [r14*8]
mov r8d, 8
mov rcx, rax
call fcn.180185210
lea rdx, [rax + rbx*8]
lea rcx, [rax + r14*8]
mov r8, qword [rdi]
mov qword [rdx], r8
lea rax, [rax + rbx*8]
add rax, 8
mov r8, qword [rsi + 0x58]
mov r9, qword [rsi + 0x60]
jmp 0x1801da09f
xor eax, eax
jmp 0x1801da06b
mov r10, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [rdx - 8], r10
add rdx, 0xfffffffffffffff8
cmp r9, r8
jne 0x1801da08f
mov qword [rsi + 0x58], rdx
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x68], rcx
jmp 0x1801d9ff9
call fcn.180007700
int3
Function at 0x1801ee890
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rdi, [rsp + 0x48]
mov r8d, 0x210
mov rcx, rdi
mov dl, 0xaa
call fcn.180366c80
mov qword [rdi - 0x18], rdi
mov qword [rdi - 0x10], rdi
lea rcx, [rsp + 0x250]
mov qword [rdi - 8], rcx
mov eax, 0x104
lea r14, [rsp + 0x30]
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r10, rdi
jmp 0x1801ee93e
add r8, r8
mov r9d, 2
mov rcx, r14
mov rdx, rdi
call fcn.1801efbb0
mov r10, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
sub rcx, r10
shr rcx, 1
mov rdx, r10
call r15
test eax, eax
je 0x1801ee971
mov r9d, eax
mov r10, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
sub rdx, r10
sar rdx, 1
cmp rdx, r9
jae 0x1801ee951
mov r8d, eax
sub rcx, r10
mov rax, rcx
sar rax, 1
cmp rax, r8
jae 0x1801ee916
jmp 0x1801ee8f5
lea rax, [r10 + r9*2]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov edx, 0xfde9
mov r8, r10
call fcn.1801eeea0
jmp 0x1801ee981
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.1801ec6f0
mov rcx, qword [rsp + 0x30]
cmp rcx, rdi
je 0x1801ee990
call fcn.18037e050
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1801eead0
Capabilities:
Delete directory
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1a0
movaps xmmword [rsp + 0x190], xmm6
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x188], rax
lea rdi, [rsp + 0x80]
mov r8d, 0x108
mov rcx, rdi
mov dl, 0xaa
call fcn.180366c80
mov qword [rdi - 0x18], rdi
mov qword [rdi - 0x10], rdi
lea rax, [rsp + 0x180]
mov qword [rdi - 8], rax
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov qword [r8 + 0x20], 0
movaps xmm6, xmmword [0x1803ff180]
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm6
mov rcx, r15
mov rdx, r14
call fcn.1801edee0
cmp dword [r15], 0
je 0x1801eebd0
call fcn.1803aa270
cmp qword [rsp + 0x28], rax
jne 0x1801eebc6
cmp dword [rsp + 0x20], 2
jne 0x1801eebc6
test bl, bl
je 0x1801eebc6
mov dword [rsi], 0
call fcn.1803aa360
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x68]
cmp rcx, rdi
je 0x1801eeb9c
call fcn.18037e050
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x190]
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
jmp 0x1801eeb8d
movups xmmword [rsi], xmm6
lea r8, [rsp + 0x68]
mov rcx, rsi
mov rdx, r14
call fcn.1801ee3e0
cmp dword [rsi], 0
jne 0x1801eeb8d
cmp dword [rsp + 0x54], 3
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
je 0x1801eec14
cmp rax, rcx
jae 0x1801eec88
mov word [rax], 0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1801eec29
cmp rax, rcx
jae 0x1801eec69
mov word [rax], 0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1801eeb7e
movups xmmword [rsi], xmm6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.1801ec6f0
call fcn.1803aa270
cmp qword [rsi + 8], rax
jne 0x1801eeb8d
cmp dword [rsi], 2
jne 0x1801eeb8d
test bl, bl
jne 0x1801eeb7e
jmp 0x1801eeb8d
lea r14, [rsp + 0x68]
mov r9d, 2
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
call fcn.1801efbb0
mov rax, qword [r14 + 8]
jmp 0x1801eec19
lea r14, [rsp + 0x68]
mov r9d, 2
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
call fcn.1801efbb0
mov rax, qword [r14 + 8]
jmp 0x1801eec02
Function at 0x1801eecb0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x1804a9038]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp rdx, 0xffffffffffffffff
je case.default.0x1801eecf5
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, eax
lea rcx, [0x18042c5ec]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1801eedb9
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
movabs rax, 0x900000000
jmp 0x1801eed45
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
movabs rax, 0x700000000
jmp 0x1801eed45
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
movabs rax, 0x600000000
mov qword [rdi + 0x20], rax
mov dword [rdi + 0x28], 0xffff
mov dword [rsi], 0
call fcn.1803aa360
mov qword [rsi + 8], rax
jmp 0x1801eedc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xorps xmm0, xmm0
cmp ecx, 2
je 0x1801eed9d
cmp eax, 0x20
je 0x1801eed8a
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x20], 0
jmp 0x1801eedb2
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
movabs rcx, 0x900000000
jmp 0x1801eedae
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
movabs rcx, 0x100000000
mov qword [rdi + 0x20], rcx
mov dword [rdi + 0x28], 0xffff
mov rcx, rsi
mov edx, eax
call fcn.1801ec6f0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180364a40
mov rax, rsi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
movaps xmm0, xmmword [0x1803ff180]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov dword [rdx + 0x30], 0xaaaaaaaa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je case.default.0x1801eecf5
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x2c]
and eax, 0x10
cmp eax, 1
mov eax, 3
sbb eax, 0
mov edx, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x44]
mov r10d, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x3c]
mov ebx, dword [rsp + 0x34]
mov ebp, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x30]
mov dword [rdi], r14d
mov dword [rdi + 4], ecx
mov dword [rdi + 8], ebp
mov dword [rdi + 0xc], ebx
mov dword [rdi + 0x10], r11d
mov dword [rdi + 0x14], r10d
mov dword [rdi + 0x18], r9d
mov dword [rdi + 0x1c], r8d
mov dword [rdi + 0x20], edx
mov dword [rdi + 0x24], eax
jmp 0x1801eed49
Function at 0x18027c190
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
je 0x18027c1b9
lea rax, [rdx - 1]
test rdx, rax
je 0x18027c1d4
mov rcx, rdx
call fcn.180362200
mov rdi, rax
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x18027c1f5
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.18027c2e0
mov rdi, rdx
jmp 0x18027c1b9
mov rcx, rdx
call fcn.180362200
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x18027c1c2
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
jae 0x18027c1ed
mov rax, qword [rsi + 0x18]
test rax, rax
jns 0x18027c217
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x18027c21c
cvtsi2ss xmm0, rax
divss xmm0, dword [rsi + 0x20]
call fcn.18039b6a0
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1803ff190]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x18027c1d9
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x18027c1d9
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x18027c1e1