joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x38]
mov qword [r8], 0
lea rdx, [0x140062a30]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x140065769
lea rdi, [rsp + 0x38]
mov rcx, qword [rdi]
lea r8, [0x14020eaac]
mov edx, 0x86
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov qword [rdi], 0
lea rdx, [0x140062a30]
mov ecx, 6
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x14006576c
lea rdi, [rsp + 0x38]
mov rcx, qword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov qword [rdi], 0
lea rdx, [0x140062a30]
mov ecx, 6
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x14006576f
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [0x14020c9ba]
lea rbx, [rsp + 0x60]
mov qword [rbx], rcx
mov qword [rbx + 8], 1
mov eax, eax
lea rdx, [rsp + 0x28]
mov qword [rdx], r14
mov qword [rdx + 8], rax
mov rcx, rdi
call fcn.1400a5a70
movzx eax, byte [rsp + 0x4f]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov qword [rdx], rdi
cmovs rcx, qword [rsp + 0x40]
mov qword [rdx + 8], rcx
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov r8, rbx
mov r9d, 1
call fcn.1400ad7f0
cmp byte [rsp + 0x4f], 0
jns 0x14006574f
mov rcx, qword [rsp + 0x38]
call fcn.14014c3ec
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
int3
int3
Function at 0x140065a60
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x180
movaps xmmword [rsp + 0x170], xmm6
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x168], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0x108], 0
movabs rax, 0x4000000070
mov qword [rsp + 0xa0], rax
lea rax, str.runas
mov qword [rsp + 0xb0], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], r15
movaps xmm6, xmmword [0x14020b860]
movaps xmmword [rsp + 0x80], xmm6
lea r14, [rsp + 0x110]
mov rcx, r8
mov rdx, r14
call fcn.140095ac0
cmp byte [r14 + 0x17], 0
js 0x140065cb1
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x110]
call fcn.1400ff6e0
cmp byte [rsp + 0x97], 0
jns 0x140065b71
mov rax, qword [rsp + 0x80]
jmp 0x140065b79
lea rax, [rsp + 0x80]
mov qword [rsp + 0xb8], rax
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], r15
movaps xmmword [r14], xmm6
mov rcx, rbx
mov rdx, r14
call fcn.140096cf0
cmp byte [r14 + 0x17], 0
jns 0x140065ba5
mov r14, qword [rsp + 0x60]
lea rbx, [rsp + 0xa0]
mov qword [rbx + 0x20], r14
mov dword [rbx + 0x30], 5
lea r14, [rsp + 0x110]
mov qword [r14 + 0x50], r15
movaps xmmword [r14 + 0x40], xmm6
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.RunElevatedProcess
lea r8, str.....operadesktopwindowsos_operationsos_operations_impl.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x176
call fcn.140100410
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14010c8f0
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140065c2a
mov rdx, qword [rsp + 0x108]
lea rbx, [rsp + 0x30]
mov rcx, rbx
jmp 0x140065c34
lea rbx, [rsp + 0x20]
mov rcx, rbx
xor edx, edx
call fcn.1401128f0
mov rax, qword [rdi]
mov rax, qword [rax + 0xc0]
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call qword [case.0x1401b58f0.0]
lea rcx, [rsp + 0x110]
call fcn.14010c950
cmp byte [rsp + 0x77], 0
jns 0x140065c70
mov rcx, qword [rsp + 0x60]
call fcn.14014c3ec
cmp byte [rsp + 0x97], 0
jns 0x140065c87
mov rcx, qword [rsp + 0x80]
call fcn.14014c3ec
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x180
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
lea rcx, [rsp + 0x80]
call fcn.140092e40
jmp 0x140065b50
Function at 0x140065d40
Capabilities:
Check mutex on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov ebp, r9d
mov rbx, r8
mov rsi, rdx
mov r12, qword [rsp + 0x140]
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov ecx, SafeArrayCopy
call fcn.14014c3b0
mov rdi, rax
mov qword [rsp + 0x58], r12
lea rax, fcn.140066c90
mov qword [rdi], rax
mov byte [rdi + 0x10], 0
movaps xmm6, xmmword [0x14020b860]
movaps xmmword [rsp + 0x40], xmm6
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x40], SafeArrayCopy
mov qword [rsp + 0x48], 0
movzx eax, bpl
mov dword [rsp + 0x50], eax
cmp byte [rbx + 0x17], 0
jns 0x140065dd9
mov rbx, qword [rbx]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 8], rax
test rax, rax
je 0x140065eb7
mov r14, rax
lea rbx, [rsp + 0x68]
movaps xmmword [rbx - 8], xmm6
movaps xmmword [rbx + 8], xmm6
movaps xmmword [rbx + 0x18], xmm6
movaps xmmword [rbx + 0x28], xmm6
movaps xmmword [rbx + 0x38], xmm6
movaps xmmword [rbx + 0x48], xmm6
mov qword [rbx + 0x58], r15
mov byte [rbx - 8], 0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov qword [rbx + 0x50], 0
test r12, r12
je 0x140065e89
lea rdx, str.NamedMutexImpl
lea r8, str.....operadesktopwindowsos_operationsos_operations_impl.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0xd9
call fcn.140100410
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
call fcn.14010c8f0
mov byte [rsp + 0x60], 1
mov edx, 0xffffffff
movabs rax, 0x7fffffffffffffff
cmp r12, rax
je 0x140065e96
lea rcx, [rsp + 0x58]
call fcn.14010ceb0
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
sete byte [rdi + 0x10]
cmp byte [rsp + 0x60], 0
je 0x140065eb7
mov rcx, rbx
call fcn.14010c950
mov qword [rsi], rdi
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140066480
Capabilities:
Query or enumerate registry value

Disassembly:
add rcx, 0x18
cmp byte [rdx + 0x17], 0
jns 0x14006648d
mov rdx, qword [rdx]
jmp 0x1400aff00
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x140066750
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r14, [rsp + 0x64]
mov dword [r14], 0x104
lea rbx, [rcx + 0x30]
mov edx, 0x104
mov rcx, rbx
call fcn.1400ae400
mov edx, dword [rdi + 0x78]
mov rcx, qword [rdi + 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
mov r8, rax
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [rdi + 0x78]
test eax, eax
je 0x1400667f1
add rdi, 0x60
mov rcx, rdi
call fcn.1401b5950
mov qword [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, [rdi + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [r14], xmm0
lea r8, [0x14020ecb6]
mov rcx, r14
call fcn.14003b350
movzx edx, byte [r14 + 0x17]
test dl, dl
jns 0x140066832
mov rdx, qword [rsp + 0x48]
jmp 0x140066835
and edx, 0x7f
mov rcx, r14
xor r8d, r8d
call fcn.1400fdf70
movzx r8d, byte [rdi + 0x47]
test r8b, r8b
jns 0x140066854
mov r8, qword [rdi + 0x38]
mov rbx, qword [rdi + 0x30]
jmp 0x140066858
and r8d, 0x7f
mov rcx, r14
mov rdx, rbx
call fcn.1400934a0
cmp byte [rsp + 0x57], 0
jns 0x14006686f
mov r14, qword [rsp + 0x40]
mov ecx, 0x50
call fcn.14014c3b0
mov rbx, rax
mov ebp, dword [rdi + 0x28]
lea r15, [rsp + 0x68]
mov rcx, r15
mov rdx, r14
call fcn.140189970
mov rdi, qword [rdi + 8]
lea rax, fcn.1400663c0
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], ebp
lea r14, [rbx + 0x18]
mov rcx, r14
call fcn.1400afd30
lea rcx, [rbx + 0x30]
mov al, byte [r15 + 0x17]
test al, al
js 0x140066918
mov rdx, qword [rsp + 0x78]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rcx], xmm0
test al, al
jns 0x1400668d6
mov r15, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9d, ebp
call fcn.1400afe30
mov dword [rbx + 0x48], eax
cmp byte [rsp + 0x7f], 0
jns 0x1400668fb
mov rcx, qword [rsp + 0x68]
call fcn.14014c3ec
mov qword [rsi], rbx
cmp byte [rsp + 0x57], 0
jns 0x1400667ce
mov rcx, qword [rsp + 0x40]
call fcn.14014c3ec
jmp 0x1400667ce
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
call fcn.140092e40
mov al, byte [rsp + 0x7f]
jmp 0x1400668cd
Function at 0x140079800
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, [0x140209328]
mov qword [rcx], rax
cmp byte [rcx + 0x38], 0
je 0x1400798e7
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
mov edx, VarR8FromUI1
call fcn.140100470
test eax, eax
jg 0x140079969
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.1400aa6d0
test al, al
jne 0x140079866
mov rcx, rdi
call fcn.1401b2d50
cmp byte [rsi + 0x3a], 0
je 0x140079915
lea rcx, [rsi + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rdi], xmm0
mov rdx, rdi
call fcn.1400ff6f0
mov r14, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rbx, [rsp + 0x28]
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x1400798b4
mov rcx, qword [rsp + 0x40]
call r14
test eax, eax
je 0x1400798db
mov rcx, rdi
mov rdx, rbx
call fcn.1400ff6f0
mov rcx, rdi
mov rdx, rbx
call fcn.140097e60
mov rcx, rbx
call fcn.1400ff6e0
jmp 0x1400798a5
lea rcx, [rsp + 0x40]
call fcn.1400ff6e0
jmp 0x140079915
cmp qword [rsi + 0x40], 0
je 0x140079915
lea rdi, [rsi + 0x40]
mov rcx, qword [0x140240428]
test rcx, rcx
jne 0x14007990d
call fcn.1400606e0
mov rcx, rax
mov qword [0x140240428], rax
mov rdx, rdi
call fcn.140061650
mov rdi, qword [rsi + 0x40]
mov qword [rsi + 0x40], 0
test rdi, rdi
je 0x140079936
mov rcx, rdi
call fcn.1400624b0
mov rcx, rdi
call fcn.14014c3ec
lea rcx, [rsi + 0x20]
call fcn.1400ff6e0
add rsi, 8
mov rcx, rsi
call fcn.1400ff6e0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14014ced0
nop
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x25
mov r9d, 0xffffffff
call fcn.14009b8d0
lea rcx, [rsp + 0x50]
lea rdx, str.Actual_removal_of
mov r8d, shutdown
call fcn.140189a90
lea rdx, [rsi + 0x20]
mov rcx, rax
call fcn.14009c2f0
mov rcx, rdi
call fcn.14009bdc0
jmp 0x14007984e
Function at 0x14007b670
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rdi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14007b82c
movabs rax, 0x1fffffffffffffff
mov r8, qword [rdi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14007b6eb
cmp r14, rax
ja 0x14007b831
lea rcx, [r14*8]
call fcn.14014c3b0
jmp 0x14007b6ed
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x14007b800
lea rax, [rax + r14*8]
mov rcx, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rsi, qword [rdi]
mov rdx, qword [rdi + 8]
cmp rdx, rsi
je 0x14007b7a8
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rsi
jne 0x14007b71f
mov rsi, qword [rdi]
mov r14, qword [rdi + 8]
mov qword [rdi], rbx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rax
cmp r14, rsi
je 0x14007b7b3
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14007b7d4
mov rdi, qword [r14]
mov qword [r14], 0
test rdi, rdi
je 0x14007b79a
mov rcx, qword [rdi + 0x20]
mov qword [rdi + 0x20], 0
test rcx, rcx
je 0x14007b784
call fcn.14014c434
cmp byte [rdi + 0x17], 0
jns 0x14007b792
mov rcx, qword [rdi]
call fcn.14014c3ec
mov rcx, rdi
call fcn.14014c3ec
lea rax, [r14 - 8]
cmp r14, rsi
mov r14, rax
jne 0x14007b75a
jmp 0x14007b7b3
mov qword [rdi], rbx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rax
test rsi, rsi
je 0x14007b7c9
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014c3ec
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.14018a2b0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
call fcn.1401663e0
call fcn.140189a80
int3
Function at 0x14007b840
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14007b9dc
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14007b8bb
cmp r14, rax
ja 0x14007b9e1
lea rcx, [r14*8]
call fcn.14014c3b0
jmp 0x14007b8bd
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x14007b9b0
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rdi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x14007b958
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rdi
jne 0x14007b8eb
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x14007b963
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14007b984
mov rsi, qword [r14]
mov qword [r14], 0
test rsi, rsi
je 0x14007b94a
mov rcx, rsi
call fcn.14007b4d0
mov rcx, rsi
call fcn.14014c3ec
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x14007b926
jmp 0x14007b963
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
je 0x14007b979
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014c3ec
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.14018a2b0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
call fcn.1401663e0
call fcn.140189a80
int3
Function at 0x14007ba60
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [0x140209368]
mov qword [rcx], rax
cmp byte [rcx + 0x40], 0
je 0x14007bb00
lea rcx, [rsi + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rdi], xmm0
mov rdx, rdi
call fcn.1400ff6f0
mov r14, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rbx, [rsp + 0x28]
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x14007bacf
mov rcx, qword [rsp + 0x40]
call r14
test eax, eax
je 0x14007baf6
mov rcx, rdi
mov rdx, rbx
call fcn.1400ff6f0
mov rcx, rdi
mov rdx, rbx
call fcn.140097e60
mov rcx, rbx
call fcn.1400ff6e0
jmp 0x14007bac0
lea rcx, [rsp + 0x40]
call fcn.1400ff6e0
lea rcx, [rsi + 0x28]
call fcn.1400ff6e0
lea rcx, [rsi + 0x10]
call fcn.1400ff6e0
mov rcx, qword [rsi + 8]
mov rax, qword [0x1402329e0]
and rax, rcx
cmp rax, qword [0x1402329c8]
jne 0x14007bb2e
call fcn.140102500
mov qword [rsi + 8], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014ced0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007e840
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14007e9dd
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14007e8bb
cmp r14, rax
ja 0x14007e9e2
lea rcx, [r14*8]
call fcn.14014c3b0
jmp 0x14007e8bd
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x14007e9b1
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rdi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x14007e959
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rdi
jne 0x14007e8eb
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x14007e964
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14007e985
mov rcx, qword [r14]
mov qword [r14], 0
test rcx, rcx
je 0x14007e94b
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x1401b58f0.0]
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x14007e926
jmp 0x14007e964
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
je 0x14007e97a
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014c3ec
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.14018a2b0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
call fcn.1401663e0
call fcn.140189a80
int3
Function at 0x140081f20
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x140082068
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14008206d
cmp r14, rax
ja 0x140082074
lea rcx, [r14*8]
call fcn.14014c3b0
shl rbx, 3
add rbx, rax
je 0x140082079
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rdi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
jne 0x140081fd8
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
jmp 0x140082047
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rdi
jne 0x140081fd8
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x140082047
add r14, 0xfffffffffffffff8
test r14, r14
je 0x1400820a5
mov rsi, qword [r14]
mov qword [r14], 0
test rsi, rsi
je 0x14008203b
mov rcx, rsi
call fcn.1400afeb0
mov rcx, rsi
call fcn.14014c3ec
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x140082013
test rdi, rdi
je 0x14008205d
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014c3ec
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401663e0
xor eax, eax
jmp 0x140081f9d
call fcn.140189a80
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.14018a2b0
int3
Function at 0x140086a10
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140086a57
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140086a62
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140086a4f
mov qword [rsi], rdi
call fcn.140100430
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x140086a3d

Function at 0x140086ab0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x140086ad6
call fcn.140100430
cmp qword [rsi], rbx
je 0x140086b05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140086b12
cmp r14, 2
jb 0x140086afd
mov qword [rsi], rbx
call fcn.140100430
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x140086aef

Function at 0x140086b30
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea r14, [rbx + 1]
cmp r14, 2
jb 0x140086b55
call fcn.140100430
cmp qword [rsi], rbx
je 0x140086b84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140086b91
cmp r14, 2
jb 0x140086b7c
mov qword [rsi], rbx
call fcn.140100430
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x140086b6e

Function at 0x140086c90
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x140086c9e
ret
xor edx, edx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]