joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc54e380
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc54f460
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc54ed82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc571108]
test eax, eax
je 0x2fc54ee1a
lea rax, [0x2fc5710e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc571110]
mov qword [rbp - 8], rax
jmp 0x2fc54edfe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc54edf2
cmp qword [rbp - 0x10], 0
je 0x2fc54edf2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc54edb8
lea rax, [0x2fc5710e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc54ee1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc54ef20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc54ef48
mov eax, 0
jmp 0x2fc54ef96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc54ef71
mov eax, 0
jmp 0x2fc54ef96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc54ef91
mov eax, 0
jmp 0x2fc54ef96
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc54ef9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc54f01a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc54f011
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc54f011
mov rax, qword [rbp - 8]
jmp 0x2fc54f02f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc54efe4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x141712058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1417121df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141712089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14171206f
add dl, dl
jne 0x141712096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417120f6
xor eax, eax
add dl, dl
jne 0x1417120a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417121ad
add dl, dl
jne 0x1417120b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417120c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417120d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417120dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1417120ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14171207e
mov eax, 1
add dl, dl
jne 0x141712106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141712113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1417120fb
sub eax, ebx
mov ebx, 1
jne 0x14171214c
mov ecx, 1
add dl, dl
jne 0x14171212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14171213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141712123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141712168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141712175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14171215d
cmp eax, 0x7d00
jae 0x14171219b
cmp eax, 0x500
jb 0x141712196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171207e
cmp eax, 0x7f
ja 0x14171219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1417121d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14171207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001550
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
movabs rax, 0x9d865626b07a6dd2
mov qword [rsp + 0x558], rax
movabs rax, 0x8c8d2426c463c5
mov qword [rsp + 0x560], rax
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x6e
mov dword [rsp + 0x33c], 0x2fc12c1d
mov dword [rsp + 0x340], 0x141333f
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x64
mov dword [rsp + 0x344], 0x9b3e987
movabs rax, 0xe32d2f0dab37d2ec
mov qword [rsp + 0x568], rax
mov dword [rsp + 0x348], 0xe9f3d40a
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x6c
mov byte [rsp + 0x15d], 0x74
mov byte [rsp + 0x15e], SysAllocStringByteLen
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x65
mov dword [rsp + 0x34c], 0x715f3e10
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0
mov dword [rsp + 0x350], 0x7a3e6d19
mov byte [rsp + 0x15f], 0x1c
movabs rax, 0xdefeed7031c9b9a1
mov qword [rsp + 0x570], rax
mov byte [rsp + 0x160], 0xf
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x1a8]
call qword [rax + 0x4494d0]
mov qword [rsp + 0x478], rax
mov byte [rsp + 0x161], 0x58
movabs rax, 0xae3d418a59ab545c
mov qword [rsp + 0x578], rax
mov dword [rsp + 0x354], 0xaaf8b8c5
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x43
mov dword [rsp + 0x358], 0xd6c390d0
movabs rax, 0x32c93b1faaaa6dfc
stosb byte [rdi], al
stosb byte [rdi], al
invalid
cmp ecx, ecx
invalid

Function at 0x1800016c0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 0x580], rax
movabs rax, 0x9219bc21bcb3064f
mov qword [rsp + 0x588], rax
mov dword [rsp + 0x35c], 0xf399db87
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x72
invalid
test byte [rax + riz*2], ah
add eax, dword [rax]
add byte [rcx + 0x78], bh
invalid

Function at 0x180001730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x883b04bf
push rsi
pop rbp
jo 0x180001782
mov dword [rsp + 0x598], eax
imul eax, eax, 6
Function at 0x180001b90
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov byte [rsp + 0x17b], 0xff
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x65
mov dword [rsp + 0x3a0], 0x9dd23539
mov dword [rsp + 0x3a4], 0xd8821ea1
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x61
mov dword [rsp + 0x3a8], 0x18e5b0ab
mov byte [rsp + 0x17c], 0xde
movabs rax, 0x76a816d79431b042
mov qword [rsp + 0x5f0], rax
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x64
mov dword [rsp + 0x3ac], 0x9bb0cc61
movabs rax, 0x94f83edb5854d465
mov qword [rsp + 0x5f8], rax
movabs rax, 0x3636c3df4d265168
mov qword [rsp + 0x600], rax
mov dword [rsp + 0x3b0], 0xd3dabc70
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x46
movabs rax, 0xfc0b204eab6bf4bb
mov qword [rsp + 0x608], rax
movabs rax, 0x4a740273c3104b37
mov qword [rsp + 0x610], rax
mov byte [rsp + 0x17d], 0x51
mov dword [rsp + 0x440], 0x965af086
mov eax, 1
imul rax, rax, 5
add eax, 0xe00484c6
add dword [rax], eax
add byte [rcx - 0x39], ch
test byte [rax + rdi*4], ah
add eax, dword [rax]
add byte [rbx], ch
xchg ebp, eax
faddp st(6)
test byte [rsi + rdi*2], ah
add dword [rax], eax
add byte [rcx - 0x630847b8], dl
out 0xd2, al
rcr byte [r8 + rcx*2 - 0x77], 0x84
and al, 0x18
invalid
add byte [rax], al
movabs rax, 0xfb34c272b2941628
mov qword [rsp + 0x620], rax

Function at 0x180001cd0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x6c
mov byte [rsp + 0x17f], 0x82
mov dword [rsp + 0x3bc], 0xd49acbd7
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x65
mov dword [rsp + 0x3c0], 0x20bb76f5
Function at 0x180003910
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x678]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x688]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x1800034c0]
mov r9, rbx
mov dword [rsp + 0x20], ecx
mov edx, 0x20000
mov dword [rsp + 0x40], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x6f0], rax
test rax, rax
jne 0x180003980
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180003982
movzx eax, ax
or eax, 0x80070000
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x2fc4d9fc0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4db0a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4da9c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4daa5a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4daa3e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4daa32
cmp qword [rbp - 0x10], 0
je 0x2fc4daa32
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da9f8
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4daa5b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dab60
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dab88
mov eax, 0
jmp 0x2fc4dabd6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dabb1
mov eax, 0
jmp 0x2fc4dabd6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dabd1
mov eax, 0
jmp 0x2fc4dabd6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dabdc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dac5a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dac51
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dac51
mov rax, qword [rbp - 8]
jmp 0x2fc4dac6f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dac24
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d3e10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4ef0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d4812
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f7108]
test eax, eax
je 0x2fc4d48aa
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f7110]
mov qword [rbp - 8], rax
jmp 0x2fc4d488e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4882
cmp qword [rbp - 0x10], 0
je 0x2fc4d4882
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d4848
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d48ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d49b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d49d8
mov eax, 0
jmp 0x2fc4d4a26
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4a01
mov eax, 0
jmp 0x2fc4d4a26
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4a21
mov eax, 0
jmp 0x2fc4d4a26
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d4a2c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d4aaa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4aa1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4aa1
mov rax, qword [rbp - 8]
jmp 0x2fc4d4abf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4a74
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52e850
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc52f930
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc52f252
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc551108]
test eax, eax
je 0x2fc52f2ea
lea rax, [0x2fc5510e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc551110]
mov qword [rbp - 8], rax
jmp 0x2fc52f2ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc52f2c2
cmp qword [rbp - 0x10], 0
je 0x2fc52f2c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc52f288
lea rax, [0x2fc5510e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc52f2eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc52f3f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc52f418
mov eax, 0
jmp 0x2fc52f466
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc52f441
mov eax, 0
jmp 0x2fc52f466
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc52f461
mov eax, 0
jmp 0x2fc52f466
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52f46c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc52f4ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc52f4e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc52f4e1
mov rax, qword [rbp - 8]
jmp 0x2fc52f4ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc52f4b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cf260
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d0340
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4cfc62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f2108]
test eax, eax
je 0x2fc4cfcfa
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f2110]
mov qword [rbp - 8], rax
jmp 0x2fc4cfcde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cfcd2
cmp qword [rbp - 0x10], 0
je 0x2fc4cfcd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cfc98
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cfcfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cfe00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cfe28
mov eax, 0
jmp 0x2fc4cfe76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cfe51
mov eax, 0
jmp 0x2fc4cfe76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cfe71
mov eax, 0
jmp 0x2fc4cfe76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cfe7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cfefa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cfef1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cfef1
mov rax, qword [rbp - 8]
jmp 0x2fc4cff0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cfec4
mov eax, 0
add rsp, 0x20
pop rbp
ret