joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3920
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1400c4040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
je 0x1400b395d
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400b3964
mov al, 1
jmp 0x1400b3af0
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 0xffffffff
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x60]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], 0xffffffff
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x50], eax
jne 0x1400b39c0
mov dword [rsp + 0x38], 1
jmp 0x1400b39c8
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
movzx eax, al
test eax, eax
je 0x1400b39e4
xor al, al
jmp 0x1400b3af0
mov qword [rsp + 0x70], 0x20
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xc0]
add rcx, 0x74
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400b3a57
cmp dword [rsp + 0x34], 1
je 0x1400b3a63
cmp dword [rsp + 0x34], 3
je 0x1400b3ade
jmp 0x1400b3aee
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1400b3ab5
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov edx, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x58], rax
je 0x1400b3ab5
xor al, al
jmp 0x1400b3af0
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400b3acf
mov dword [rsp + 0x3c], 1
jmp 0x1400b3ad7
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
jmp 0x1400b3af0
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400b3af0
xor al, al
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400bb630
add rsp, 0xb8
ret
Function at 0x1400bb474
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400bb4ae
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400bb4b3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400bb4fc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400be640]
cmp byte [rcx + rax], 0
je 0x1400bb4fc
dec r8
sub rdx, 1
jne 0x1400bb4e2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400bc3cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bc416
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400bc416
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400bc416
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400bc416
cmp dword [rcx + 0x84], 0xe
jbe 0x1400bc416
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400bc418
xor al, al
add rsp, 0x28
ret
Function at 0x1400012f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001319
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x140001380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400013df

Function at 0x1400013d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400013d0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x140001460
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400014bf
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400014b0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x140001540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000159a

Function at 0x1400015ba
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001590
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret

Function at 0x140001650
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400016aa
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400016a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
ret
Function at 0x1400031e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.140003260
shl edx, 4
test eax, eax
jne 0x14000324e
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14000320f
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
ret
Function at 0x14000482d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x1400049a1
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x1404726e0]
sub rsi, rdi
call fcn.1400049b0
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x1404726d0]
test rcx, 1
je 0x1400048ea
movdqu xmm7, xmmword [rdi]
call fcn.140003a00
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x140004956
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x1404726d0]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.140003b60
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x1404726f0]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x1400048f9
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
Function at 0x140018300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140018420
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140018360
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140018360
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140018360
Function at 0x140034170
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x1400341b6
mov r15, r12
test r15, r15
je 0x1400342f0
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140034218
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r15, rbx
sub r15, rax
mov r14, r12
sub r14, rbx
je 0x140034204
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1402e0660
mov r12, qword [rsi + 8]
add r15, r14
mov qword [rsi + 0x10], r15
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140034192
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14003431c
lea rcx, [r13*8]
call fcn.1402dd130
mov rcx, r13
and rcx, 0xfffffffffffffffc
mov rdx, r12
sub rdx, rbx
mov r8, r12
lea rcx, [rax + rcx*2]
mov r15, rcx
sub r8, rbx
je 0x14003428c
sar rdx, 3
lea r15, [r8 + rcx]
shl rdx, 3
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1400342f0
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140034274
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x1400342d6
add r12, 0xfffffffffffffff8
jne 0x14003429f
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.14032ac00
test r14, r14
je 0x140034192
mov rcx, r14
call fcn.1402dd16c
mov r15, qword [rsi + 0x10]
jmp 0x140034192
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
call fcn.14031db10
int3
Function at 0x140034330
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x140034372
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1400344a6
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r14, rax
jae 0x1400343ca
sub rax, r14
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1400343bc
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1402e0660
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14003434f
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x1400344d2
lea rcx, [r12*8]
call fcn.1402dd130
lea r15, [r12*2 + 6]
and r15, 0xfffffffffffffff8
add r15, rax
mov rdx, r14
sub rdx, rbx
mov r8, r14
mov rcx, r15
sub r8, rbx
je 0x140034442
sar rdx, 3
lea rcx, [r8 + r15]
shl rdx, 3
xor r8d, r8d
mov r9, r15
add r9, r8
je 0x1400344a6
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14003442a
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
cmp r14, rbx
je 0x14003448c
add r14, 0xfffffffffffffff8
jne 0x140034455
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.14032ac00
test rbx, rbx
je 0x14003434f
mov rcx, rbx
call fcn.1402dd16c
mov r15, qword [rsi + 8]
jmp 0x14003434f
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
call fcn.14031db10
int3
Function at 0x140037420
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, fcn.1400375f0
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
xor edi, edi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
test rax, rax
je 0x140037483
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp r14, 0xffffffffffffffff
je 0x1400375bf
call fcn.14026d530
mov rdi, r14
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rdi + 1]
cmp rax, 2
jae 0x1400374bf
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400374a4
call fcn.14026d530
mov rcx, rdi
call fcn.140252540
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x140037503
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp r14, 0xffffffffffffffff
je 0x1400375c6
call fcn.14026d530
mov rbx, r14
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rbx + 1]
cmp rax, 2
jae 0x14003752f
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14003748d
call fcn.14026d530
mov rcx, rbx
call fcn.140252540
jmp 0x14003748d
lea r8, [rsp + 0x28]
mov qword [r8], rdi
mov qword [r8 + 8], rbx
mov rcx, rdi
mov edx, 7
mov r9d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14003750d
lea r14, [rsi + 8]
call fcn.14026d530
cmp qword [r14], rdi
je 0x140037585
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r14]
inc rax
cmp rax, 2
jae 0x1400375cd
mov qword [r14], rdi
call fcn.14026d530
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14026d530
cmp qword [rsi + 0x10], rbx
je 0x1400375b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 0x10]
inc rax
cmp rax, 2
jae 0x1400375dc
mov qword [rsi + 0x10], rbx
call fcn.14026d530
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
xor ebx, ebx
jmp 0x14003750d
xor edi, edi
jmp 0x14003747b
xor ebx, ebx
jmp 0x1400374fb
call fcn.14026d530
mov rcx, qword [r14]
call fcn.140252540
jmp 0x140037575
call fcn.14026d530
mov rcx, qword [rsi + 0x10]
call fcn.140252540
jmp 0x1400375a5
Function at 0x140048530
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x280
mov ebx, r9d
mov rsi, r8
mov edi, edx
mov r14, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14048befc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140048659
mov r15, rax
lea r9, [rsp + 0x68]
mov qword [r9], 0
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [case.0x14012d181.0]
test eax, eax
jns 0x1400486f4
test bl, bl
je 0x1400486f4
xor edi, edi
lea r9, [rsp + 0x68]
mov rcx, r14
mov edx, 0x8800
xor r8d, r8d
mov rax, r15
call qword [case.0x14012d181.0]
test eax, eax
js 0x1400486fe
mov rdx, qword [rsp + 0x68]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14031d9e0
movzx eax, byte [rdi + 0x17]
test al, al
js 0x1400485f0
and eax, 0x7f
jmp 0x1400485fa
mov rax, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
test rax, rax
js 0x14004872f
test rdi, rdi
jne 0x14004861b
test rax, rax
jne 0x14004875b
lea rdi, [rsp + 0x70]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14026e040
mov rcx, rsi
mov rdx, rdi
call fcn.14026e210
mov rcx, rdi
call fcn.14026e190
cmp byte [rsp + 0x57], 0
jns 0x140048651
mov rcx, qword [rsp + 0x40]
call fcn.1402dd16c
mov dil, 1
jmp 0x1400486fe
lea r14, [rsp + 0x70]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1402e0d10
mov word [r14], 0
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400486b3
cmp eax, 0x80070057
je 0x1400486b3
test bl, bl
je 0x1400486b3
or edi, 0xa000
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setns dil
js 0x14004870e
lea rbx, [rsp + 0x30]
mov qword [rbx], r14
mov rcx, r14
call fcn.140303804
mov qword [rbx + 8], rax
lea r14, [rsp + 0x40]
mov rcx, r14
mov rdx, rbx
call fcn.14026e040
mov rcx, rsi
mov rdx, r14
call fcn.14026e210
mov rcx, r14
call fcn.14026e190
jmp 0x14004870e
test eax, eax
jns 0x1400485d1
xor edi, edi
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004870e
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1402ddd70
mov eax, edi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.14032ac00
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.14032ac00
int3