joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ac660
Capabilities:
Get number of processors

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb8
mov qword [rbp - 0x39], 0xfffffffffffffffe
movaps xmmword [rax - 0x58], xmm6
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12, r9
mov r15, rdx
mov rax, rcx
mov qword [rbp - 0x41], rcx
xor ecx, ecx
mov dword [rbp - 5], ecx
mov qword [rbp - 0x71], rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x69], xmm0
mov qword [r9], rcx
lea r9, [rbp - 0x71]
mov rcx, rax
call fcn.1400ac57c
mov ebx, eax
test eax, eax
js 0x1400ac843
xor esi, esi
mov rdi, qword [rbp - 0x71]
cmp dword [r15 + 0x18], esi
jbe 0x1400ac7ab
and qword [rbp - 0x59], 0
and qword [rbp - 0x51], 0
and qword [rbp - 0x49], 0
lea rcx, [rsi + rsi*2]
mov rax, qword [r15 + 0x20]
lea r13, [rax + rcx*8]
xor r14d, r14d
test rdi, rdi
je 0x1400ac757
xor ecx, ecx
add rcx, rcx
mov rax, qword [rbp - 0x69]
movups xmm6, xmmword [rax + rcx*8]
mov byte [rbp - 0x79], 0
movdqu xmmword [rbp - 0x29], xmm6
lea r9, [rbp - 0x79]
lea r8, [rbp - 0x29]
mov rdx, r13
mov rcx, qword [rbp - 0x41]
call fcn.1400ab7f0
mov ebx, eax
test eax, eax
js 0x1400ac759
cmp byte [rbp - 0x79], 0
je 0x1400ac74c
movdqa xmmword [rbp - 0x19], xmm6
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x59]
call fcn.1400aa8fc
mov ebx, eax
test eax, eax
js 0x1400ac759
inc r14d
mov ecx, r14d
cmp rcx, rdi
jne 0x1400ac700
xor ebx, ebx
test ebx, ebx
js 0x1400ac812
movups xmm1, xmmword [rbp - 0x69]
movups xmm0, xmmword [rbp - 0x51]
movdqu xmmword [rbp - 0x69], xmm0
mov rdi, qword [rbp - 0x59]
mov qword [rbp - 0x71], rdi
movq r8, xmm1
test r8, r8
je 0x1400ac79f
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x71]
inc esi
cmp esi, dword [r15 + 0x18]
jb 0x1400ac6db
movups xmm1, xmmword [r12 + 8]
movups xmm0, xmmword [rbp - 0x69]
movdqu xmmword [r12 + 8], xmm0
mov qword [r12], rdi
movq r8, xmm1
test r8, r8
je 0x1400ac7e6
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
mov eax, dword [rbp - 5]
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140109af0
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, ebx
shr eax, 0x1f
xor al, 1
je 0x1400ac81c
int3
cmp qword [rbp - 0x51], 0
je 0x1400ac843
mov rax, qword gs:[0x60]
mov r8, qword [rbp - 0x51]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
cmp qword [rbp - 0x69], 0
je 0x1400ac86a
mov rcx, qword gs:[0x60]
mov r8, qword [rbp - 0x69]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
mov eax, ebx
jmp 0x1400ac7e9
Function at 0x1400af2e8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
mov qword [rbp - 0x50], r9
mov qword [rbp - 0x40], r8
mov r14, rdx
mov dword [rbp - 0x18], edi
mov rsi, rcx
test rdx, rdx
jne 0x1400af323
int3
xor r12d, r12d
mov qword [rbp - 0x48], r12
call fcn.1400af534
movabs r10, 0x1000000000
cmp rax, r10
jbe 0x1400af33f
int3
mov rcx, rsi
call fcn.1400af534
mov rcx, r10
sub rcx, rax
cmp r14, rcx
jbe 0x1400af360
mov rcx, rsi
call fcn.1400af534
mov r14, r10
sub r14, rax
mov r15, qword [rsi + 8]
xor ebx, ebx
mov rax, qword [rsi]
mov r13, r15
sub r13, rax
mov dword [rbp - 0x14], ebx
sar r13, 3
test r14, r14
jne 0x1400af37c
int3
sub r15, rax
mov rcx, rsi
sar r15, 3
call fcn.1400af534
add rax, r14
mov rcx, rax
shr rcx, 0x18
test rax, 0xffffff
lea rdx, [rcx + 1]
cmovbe rdx, rcx
mov rcx, rsi
call fcn.1400ae550
test eax, eax
js 0x1400af4d1
mov r12, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, r12
sar rax, 3
cmp r15, rax
jae 0x1400af425
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x1400af3f5
and qword [rax], rbx
and qword [rax + 8], rbx
and qword [rax + 0x10], rbx
cmp qword [r12 + r15*8], rbx
je 0x1400af3fc
int3
mov qword [r12 + r15*8], rax
test rax, rax
je 0x1400af4ef
mov r12, qword [rsi]
inc r15
mov rax, qword [rsi + 8]
sub rax, r12
sar rax, 3
cmp r15, rax
jb 0x1400af3c6
mov edi, dword [rbp - 0x18]
mov ebx, dword [rbp - 0x14]
mov r12, qword [rbp - 0x48]
mov eax, ebx
test eax, eax
js 0x1400af4d1
lea rax, [r13 - 1]
neg r13
sbb rcx, rcx
and rcx, rax
test r14, r14
je 0x1400af4c3
mov r15, rcx
lea rbx, [rcx + 1]
shl r15, 3
mov r11, qword [rbp - 0x50]
cmp byte [r11], 0
je 0x1400af4c3
mov rax, qword [rsi]
mov r10, qword [r15 + rax]
mov rcx, r10
call fcn.1400adcdc
mov r9, rax
mov eax, 0x1000000
cmp rax, r9
je 0x1400af49d
and qword [rbp - 0x58], 0
lea r8, [rbp - 0x58]
mov r9, r11
mov rdx, r14
mov rcx, r10
call fcn.1400adb34
test eax, eax
js 0x1400af4d1
add r12, qword [rbp - 0x58]
sub r14, qword [rbp - 0x58]
mov r11, qword [rbp - 0x50]
test r14, r14
je 0x1400af4b7
cmp byte [r11], 0
jne 0x1400af4b7
mov rdx, rbx
mov rcx, rsi
call fcn.1400ae550
test eax, eax
js 0x1400af4d1
add r15, 8
inc rbx
test r14, r14
jne 0x1400af450
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x1400af4cf
mov qword [rax], r12
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140109af0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, str.onecore_basexml_stream_bufferedstream.cpp
mov dword [rbp - 0x28], 0x169
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
lea rax, str.CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_struct__LBLOB__12_12____12_24_::Allocate
mov r8d, 0xc0000017
mov qword [rbp - 0x30], rax
lea rax, str._this__Index_.Allocate__
mov qword [rbp - 0x20], rax
call fcn.1400c81b4
mov eax, 0xc0000017
jmp 0x1400af4d1
Function at 0x1400af570
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r8
mov r14, rdx
mov dword [rbp - 0x18], edi
mov rsi, rcx
test rdx, rdx
jne 0x1400af5ab
int3
xor r12d, r12d
mov qword [rbp - 0x50], r12
call fcn.1400af818
movabs r11, 0x1000000000000
cmp rax, r11
jbe 0x1400af5c7
int3
mov rcx, rsi
call fcn.1400af818
mov rcx, r11
sub rcx, rax
cmp r14, rcx
jbe 0x1400af5e8
mov rcx, rsi
call fcn.1400af818
mov r14, r11
sub r14, rax
mov r15, qword [rsi + 8]
xor ebx, ebx
mov rax, qword [rsi]
mov r13, r15
sub r13, rax
mov dword [rbp - 0x14], ebx
sar r13, 3
test r14, r14
jne 0x1400af604
int3
sub r15, rax
mov rcx, rsi
sar r15, 3
call fcn.1400af818
add rax, r14
movabs rdx, 0xfffffffff
mov rcx, rax
shr rcx, 0x24
test rdx, rax
lea rdx, [rcx + 1]
cmovbe rdx, rcx
mov rcx, rsi
call fcn.1400ae3c4
test eax, eax
js 0x1400af767
mov r12, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, r12
sar rax, 3
cmp r15, rax
jae 0x1400af6b4
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x1400af684
and qword [rax], rbx
and qword [rax + 8], rbx
and qword [rax + 0x10], rbx
cmp qword [r12 + r15*8], rbx
je 0x1400af68b
int3
mov qword [r12 + r15*8], rax
test rax, rax
je 0x1400af785
mov r12, qword [rsi]
inc r15
mov rax, qword [rsi + 8]
sub rax, r12
sar rax, 3
cmp r15, rax
jb 0x1400af655
mov edi, dword [rbp - 0x18]
mov ebx, dword [rbp - 0x14]
mov r12, qword [rbp - 0x50]
mov eax, ebx
test eax, eax
js 0x1400af767
lea rax, [r13 - 1]
neg r13
sbb rcx, rcx
and rcx, rax
test r14, r14
je 0x1400af759
mov r13, qword [rbp - 0x48]
lea rbx, [rcx + 1]
mov r15, rcx
shl r15, 3
cmp byte [r13], 0
je 0x1400af759
mov rax, qword [rsi]
mov r11, qword [r15 + rax]
mov rcx, r11
call fcn.1400af534
mov r10, rax
movabs rax, 0x1000000000
cmp rax, r10
je 0x1400af732
and qword [rbp - 0x58], 0
lea r8, [rbp - 0x58]
mov r9, r13
mov rdx, r14
mov rcx, r11
call fcn.1400af2e8
test eax, eax
js 0x1400af767
add r12, qword [rbp - 0x58]
sub r14, qword [rbp - 0x58]
test r14, r14
je 0x1400af74d
cmp byte [r13], 0
jne 0x1400af74d
mov rdx, rbx
mov rcx, rsi
call fcn.1400ae3c4
test eax, eax
js 0x1400af767
add r15, 8
inc rbx
test r14, r14
jne 0x1400af6e7
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x1400af765
mov qword [rax], r12
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140109af0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, str.onecore_basexml_stream_bufferedstream.cpp
mov dword [rbp - 0x28], 0x169
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
lea rax, str.CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_struct__LBLOB__12_12____12_24____12_36_::Allocate
mov r8d, 0xc0000017
mov qword [rbp - 0x30], rax
lea rax, str._this__Index_.Allocate__
mov qword [rbp - 0x20], rax
call fcn.1400c81b4
mov eax, 0xc0000017
jmp 0x1400af767
Function at 0x1400af854
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
mov qword [rbp - 0x40], r9
mov dword [rbp - 0x18], edi
mov r12, r9
mov r14, rdx
mov rsi, rcx
test rdx, rdx
jne 0x1400af891
int3
and qword [rbp - 0x48], rdi
call fcn.1400afa9c
test rax, rax
je 0x1400af8a0
int3
mov rcx, rsi
call fcn.1400afa9c
neg rax
cmp r14, rax
jbe 0x1400af8be
mov rcx, rsi
call fcn.1400afa9c
mov r14, rax
neg r14
mov r15, qword [rsi + 8]
xor ebx, ebx
mov rax, qword [rsi]
mov r13, r15
sub r13, rax
mov dword [rbp - 0x14], ebx
sar r13, 3
test r14, r14
jne 0x1400af8da
int3
sub r15, rax
mov rcx, rsi
sar r15, 3
call fcn.1400afa9c
add rax, r14
movabs rdx, 0xffffffffffff
mov rcx, rax
shr rcx, 0x30
test rdx, rax
lea rdx, [rcx + 1]
cmovbe rdx, rcx
mov rcx, rsi
call fcn.1400ae238
test eax, eax
js 0x1400afa32
mov r12, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, r12
sar rax, 3
cmp r15, rax
jae 0x1400af98a
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x1400af95a
and qword [rax], rbx
and qword [rax + 8], rbx
and qword [rax + 0x10], rbx
cmp qword [r12 + r15*8], rbx
je 0x1400af961
int3
mov qword [r12 + r15*8], rax
test rax, rax
je 0x1400afa57
mov r12, qword [rsi]
inc r15
mov rax, qword [rsi + 8]
sub rax, r12
sar rax, 3
cmp r15, rax
jb 0x1400af92b
mov edi, dword [rbp - 0x18]
mov ebx, dword [rbp - 0x14]
mov r12, qword [rbp - 0x40]
mov eax, ebx
test eax, eax
js 0x1400afa32
lea rax, [r13 - 1]
neg r13
sbb rcx, rcx
and rcx, rax
test r14, r14
je 0x1400afa30
mov r15, rcx
lea rbx, [rcx + 1]
shl r15, 3
cmp byte [r12], 0
je 0x1400afa30
mov rax, qword [rsi]
mov r11, qword [r15 + rax]
mov rcx, r11
call fcn.1400af818
movabs rdx, 0x1000000000000
cmp rdx, rax
je 0x1400afa09
and qword [rbp - 0x50], 0
lea r8, [rbp - 0x50]
mov r9, r12
mov rdx, r14
mov rcx, r11
call fcn.1400af570
test eax, eax
js 0x1400afa32
mov rax, qword [rbp - 0x48]
add rax, qword [rbp - 0x50]
sub r14, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
test r14, r14
je 0x1400afa24
cmp byte [r12], 0
jne 0x1400afa24
mov rdx, rbx
mov rcx, rsi
call fcn.1400ae238
test eax, eax
js 0x1400afa32
add r15, 8
inc rbx
test r14, r14
jne 0x1400af9b9
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140109af0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, str.onecore_basexml_stream_bufferedstream.cpp
mov dword [rbp - 0x28], 0x169
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
lea rax, str.CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_struct__LBLOB__12_12____12_24____12_36____16_48_::Allocate
mov r8d, 0xc0000017
mov qword [rbp - 0x30], rax
lea rax, str._this__Index_.Allocate__
mov qword [rbp - 0x20], rax
call fcn.1400c81b4
mov eax, 0xc0000017
jmp 0x1400afa32
Function at 0x1400afad8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400afb3a
cmp rcx, rbx
je 0x1400afb3a
mov rdi, qword [rcx]
lea rax, [rcx - 8]
xor r8d, r8d
cmp rcx, rbx
cmovne r8, rax
test r8, r8
je 0x1400afb32
and qword [r8 + 0x18], 0
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, rdi
cmp rdi, rbx
jne 0x1400afafc
mov qword [rbx], rbx
mov qword [rbx + 8], rbx
mov qword [rbx + 0x10], rbx
and qword [rbx + 0x18], 0
and qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400afc30
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx]
or rbx, 0xffffffffffffffff
mov r8, rcx
cmp rdx, rcx
je 0x1400afc9a
test rdx, rdx
je 0x1400afc6e
cmp qword [rdx + 0x10], rcx
jne 0x1400afc6e
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rdx + 8]
mov rax, qword [rdx]
mov qword [rcx], rax
and qword [rdx + 0x10], 0
add qword [r8 + 0x18], rbx
lea r8, [rdx - 8]
test r8, r8
je 0x1400afc9a
mov rbx, qword [r8]
xor edx, edx
and qword [r8 + 0x18], 0
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400b35ac
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r14, rcx
mov edi, 0x130
xor edx, edx
mov r8d, edi
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400b363e
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.14010b670
lea rdi, [rbx + 0x30]
mov qword [rbx + 0x28], 0x23
mov esi, 7
mov qword [rbx + 8], rdi
mov qword [rbx + 0x18], rsi
mov rcx, rdi
call fcn.140014710
add rdi, 0x20
sub rsi, 1
jne 0x1400b3615
and qword [rbx + 0x128], rsi
and qword [rbx + 0x118], rsi
and qword [rbx + 0x120], rsi
jmp 0x1400b3640
xor ebx, ebx
cmp qword [r14], 0
je 0x1400b3647
int3
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x1400b4a00
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, qword [rsp + 0x68]
mov rbx, rdx
mov dword [rdx], 0xc00000e5
mov rsi, r8
xor edx, edx
mov rbp, rcx
mov r14, r9
and qword [rdi], 0
mov rax, qword gs:[0x60]
lea r8d, [rdx + 0x50]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x1400b4a82
and qword [rax + 0x10], 0
mov ecx, 0x20
and qword [rax], 0
xorps xmm0, xmm0
and qword [rax + 8], 0
and qword [rax + 0x38], 0
and qword [rax + 0x40], 0
mov word [rax + 0x48], cx
movdqu xmmword [rax + 0x28], xmm0
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
test rax, rax
jne 0x1400b4a8e
mov ecx, 0xc0000017
jmp 0x1400b4ab7
movups xmm0, xmmword [r14]
mov rcx, qword [rsp + 0x60]
movdqu xmmword [rax + 0x28], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rax + 0x38], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [rax + 0x48], xmm1
mov rcx, rax
xor eax, eax
mov qword [rdi], rcx
xor ecx, ecx
mov dword [rbx], ecx
test rax, rax
je 0x1400b4ae1
and qword [rax + 0x10], 0
mov r8, rax
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ba908
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 0x10], rax
and dword [rbp - 0x18], 0
mov rsi, r8
mov eax, dword [rcx]
mov rdi, rcx
mov r15d, 1
test eax, eax
jne 0x1400ba951
lock cmpxchg dword [rcx], r15d
jne 0x1400ba951
lea eax, [r15 + 1]
xchg dword [rcx], eax
mov eax, dword [rcx]
jmp 0x1400ba967
call qword [0x1401775d0]
nop dword [rax + rax]
test eax, eax
js 0x1400ba9c9
mov eax, dword [rdi]
cmp eax, 2
jne 0x1400ba955
xor eax, eax
test eax, eax
js 0x1400baad8
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400ba9ce
and qword [rax + 8], 0
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
lea rax, [0x14012c7b8]
mov qword [rbx], rax
lea rax, [0x14012c7b8]
mov qword [rbx], rax
mov dword [rbx + 8], 0
jmp 0x1400ba9d0
mov dword [rbp - 0x14], eax
jmp 0x1400ba96e
xor ebx, ebx
test rbx, rbx
jne 0x1400baa11
lea rax, str.onecoreinternal_baseinc_rtl_object_library.h
mov dword [rbp - 0x48], 0x1c9
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x58]
lea rax, str.Windows::Rtl::CRtlObjectTypeDescription_class_MicrodomWriterImplementation::CMicrodomWriter_::CreateInstance
mov r8d, 0xc0000017
mov qword [rbp - 0x50], rax
lea rax, str.NewInstance.Allocate__
mov qword [rbp - 0x40], rax
call fcn.1400c81b4
jmp 0x1400baaac
mov qword [rbx + 0x10], rbx
xor edx, edx
mov qword [rbx + 0x18], rdi
mov rax, qword gs:[0x60]
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400baa5c
and qword [rax + 8], 0
lea rax, [0x14012c750]
mov qword [rdi], rax
lea rax, [0x14012d5b8]
mov qword [rdi + 0x10], rax
jmp 0x1400baa5e
xor edi, edi
test rdi, rdi
jne 0x1400baab3
lea rax, str.onecoreinternal_baseinc_rtl_object_library.h
mov dword [rbp - 0x28], 0x1da
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
lea rax, str.Windows::Rtl::CRtlObjectTypeDescription_class_MicrodomWriterImplementation::CMicrodomWriter_::CreateInstance
mov r8d, 0xc0000017
mov qword [rbp - 0x30], rax
lea rax, str.NewTearoff.Allocate__
mov qword [rbp - 0x20], rax
call fcn.1400c81b4
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14010a1e6.0]
mov eax, 0xc0000017
jmp 0x1400baad8
mov qword [rdi + 8], rbx
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 8]
call qword [case.0x14010a1e6.0]
add rdi, 0x10
cmp qword [rsi], 0
je 0x1400baad2
int3
mov eax, dword [rbp - 0x18]
mov qword [rsi], rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140109af0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x1400c2adc
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
xor esi, esi
cmp qword [rcx + 0x18], rsi
jbe 0x1400c2b9c
xor r14d, r14d
mov rbx, qword [rdi + 8]
add rbx, r14
mov rax, qword [rbx]
test rax, rax
je 0x1400c2b7b
cmp rax, rbx
je 0x1400c2b7b
mov rbp, qword [rax]
xor r8d, r8d
cmp rax, rbx
cmovne r8, rax
test r8, r8
je 0x1400c2b73
lea rax, [r8 + 0x30]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
and qword [rax + 0x18], 0
and qword [r8 + 0x48], 0
and qword [r8 + 0x40], 0
and qword [r8 + 0x10], 0
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rax, rbp
cmp rbp, rbx
jne 0x1400c2b23
mov qword [rbx], rbx
mov qword [rbx + 8], rbx
mov qword [rbx + 0x10], rbx
and qword [rbx + 0x18], 0
inc rsi
add r14, 0x20
cmp rsi, qword [rdi + 0x18]
jb 0x1400c2b0f
mov rcx, qword [rdi + 8]
lea rax, [rdi + 0x30]
cmp rcx, rax
je 0x1400c2bf4
test rcx, rcx
je 0x1400c2bf4
lea r14, [rcx - 8]
mov rsi, qword [r14]
mov rbx, rsi
shl rbx, 5
add rbx, rcx
test rsi, rsi
je 0x1400c2bd6
sub rbx, 0x20
mov rcx, rbx
call fcn.14003a850
sub rsi, 1
jne 0x1400c2bc4
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
and qword [rdi + 0x18], 0
and qword [rdi + 8], 0
mov ebx, 7
add rdi, 0x110
sub rdi, 0x20
mov rcx, rdi
call fcn.14003a850
sub rbx, 1
jne 0x1400c2c0a
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400c315c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
cmp qword [rcx + 8], rdx
jbe 0x1400c318f
xor ecx, ecx
mov rax, qword [rbx + 0x10]
lea rcx, [rcx + 0x90]
inc rdx
and qword [rcx + rax - 0x68], 0
and qword [rcx + rax - 0x80], 0
cmp rdx, qword [rbx + 8]
jb 0x1400c316f
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
and qword [rbx + 0x10], 0
test rcx, rcx
je 0x1400c31c6
mov edx, 1
call fcn.1400c315c
and qword [rbx + 0x18], 0
mov r8, rbx
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400c8ea4
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0x60]
mov rdi, qword [rcx]
xor r14d, r14d
add rdi, rbx
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov qword [rsp + 0x28], 0x200
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], r14
cmp rbx, rdi
jae 0x1400c90ac
lea r13d, [r14 + 0x3d]
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_onecore_baselstringucsdecoders.cpp
lea rax, [rbp + 0x160]
mov rcx, rbx
sub rax, rdx
and rax, 0xfffffffffffffffe
cmp rax, 8
jl 0x1400c9033
movzx r11d, byte [rbx]
mov r10b, r14b
inc rbx
mov r9b, r14b
cmp rbx, rdi
je 0x1400c8f57
mov r10b, byte [rbx]
movzx r8d, r14w
mov eax, 2
jmp 0x1400c8f5f
mov r8d, r13d
mov eax, 1
add rcx, rax
mov word [rdx + 4], r8w
cmp rcx, rdi
je 0x1400c8f6f
mov r9b, byte [rcx]
lea rbx, [rcx + 1]
movzx r8d, r10b
cmove rbx, rcx
mov eax, r14d
cmove ax, r13w
mov rcx, r11
mov word [rdx + 6], ax
and ecx, 3
shl rcx, 4
mov rax, r11
shr rax, 2
movzx eax, byte [rax + r15]
mov word [rdx], ax
mov eax, r8d
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r15]
mov word [rdx + 2], ax
cmp word [rdx + 4], r14w
jne 0x1400c8fd9
and r8d, 0xf
movzx eax, r9b
shl r8d, 2
shr rax, 6
mov ecx, r8d
or rcx, rax
movzx eax, byte [rcx + r15]
mov word [rdx + 4], ax
cmp word [rdx + 6], r14w
jne 0x1400c8ff0
movzx eax, r9b
and eax, 0x3f
movzx eax, byte [rax + r15]
mov word [rdx + 6], ax
add rdx, 8
lea rax, [rbp + 0x160]
cmp rdx, rax
jne 0x1400c902a
mov r9, rsi
mov qword [rsp + 0x20], 0x200
lea r8, [fcn.1400cb460]
lea rdx, [rsp + 0x20]
call fcn.1400cc068
test eax, eax
js 0x1400c90b0
lea rdx, [rsp + 0x60]
cmp rbx, rdi
jb 0x1400c8f1c
lea rax, [rsp + 0x60]
cmp rdx, rax
je 0x1400c90ac
lea rax, [rsp + 0x60]
sub rdx, rax
mov qword [rsp + 0x20], rdx
cmp rdx, qword [rsp + 0x28]
jbe 0x1400c9094
lea rax, str.onecore_baselstringlblob.cpp
mov dword [rsp + 0x48], 0x4f5
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
lea rax, str.RtlpGenericBase64Encode
mov r8d, 0xc000042b
mov qword [rsp + 0x40], rax
lea rax, str.TempBlob.Length___TempBlob.MaximumLength
mov qword [rsp + 0x50], rax
call fcn.1400c81b4
mov eax, 0xc000042b
jmp 0x1400c90b0
mov r9, rsi
lea r8, [fcn.1400cb460]
lea rdx, [rsp + 0x20]
call fcn.1400cc068
test eax, eax
js 0x1400c90b0
mov eax, dword [rsp + 0x58]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140109af0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret