joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4cd870
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4ce950
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4ce272
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f0108]
test eax, eax
je 0x2fc4ce30a
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f0110]
mov qword [rbp - 8], rax
jmp 0x2fc4ce2ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ce2e2
cmp qword [rbp - 0x10], 0
je 0x2fc4ce2e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ce2a8
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ce30b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4ce410
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ce438
mov eax, 0
jmp 0x2fc4ce486
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ce461
mov eax, 0
jmp 0x2fc4ce486
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ce481
mov eax, 0
jmp 0x2fc4ce486
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ce48c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4ce50a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4ce501
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4ce501
mov rax, qword [rbp - 8]
jmp 0x2fc4ce51f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4ce4d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400b640b
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401fb6b0
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403fa3f6]
call fcn.1400b92ff
xor eax, eax
cmp eax, 1
je 0x1401fb703
movsx eax, byte [rbp + 0xf8]
cmp eax, 0x41
jl 0x1401fb703
movsx eax, byte [rbp + 0xf8]
cmp eax, 0x5a
jg 0x1401fb703
movsx eax, byte [rbp + 0xf8]
or eax, 0x20
mov dword [rbp + 0xc0], eax
jmp 0x1401fb710
movsx eax, byte [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xf0]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x1400b6a19
Capabilities:
Create thread

Disassembly:
jmp 0x1401f5c20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1403ded40]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1403fa39a]
call fcn.1400b92ff
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400b6eb5
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1400b7905
nop
lea rax, [0x1400b8148]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1400b8265
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1401f5cfa
lea rcx, [rbp + 8]
call fcn.1400b7590
jmp 0x1401f5d13
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b6b22
nop
lea rcx, [rbp + 8]
call fcn.1400b74c3
lea rcx, [rbp - 0x30]
lea rdx, [0x140281de0]
call fcn.1400b8a6c
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b7879
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x1400b6d89
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140206e80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x1403ded40]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1403fa3fb]
call fcn.1400b92ff
xor edx, edx
mov ecx, 2
call fcn.1400b77fc
mov qword [rbp + 0x268], rax
mov dword [rbp + 0x10], 0x238
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400b7eaf
test eax, eax
je 0x140206f3b
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140206f27
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
mov dword [0x1403e71b8], eax
mov eax, dword [rbp + 0x18]
jmp 0x140206f4a
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400b8bd4
test eax, eax
jne 0x140206ef7
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14027ae60]
call fcn.1400b8a6c
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400b7879
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x1400b7c43
Capabilities:
Terminate process

Disassembly:
jmp 0x14021f410
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400b8071
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400ec900
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403fa07c]
call fcn.1400b92ff
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400b8233
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400ec890
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403fa07c]
call fcn.1400b92ff
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400b824c
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400ee890
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1403fa07c]
call fcn.1400b92ff
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x14022fe80]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1400ee9d5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1400ee929
mov dword [rbp + 0x160], 1
jmp 0x1400ee933
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1400ee9d0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400ee9aa
cmp qword [rbp + 0x198], 2
jb 0x1400ee9aa
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ee9aa
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ee9aa
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400ee8f4
jmp 0x1400eea6f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400eea6f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1400eea46
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400eea46
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400eea46
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400ee9d5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400b8387
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402225f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140222610
xor al, al
jmp 0x140222691
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140222623
xor al, al
jmp 0x140222691
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14022264d
xor al, al
jmp 0x140222691
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140222661
xor al, al
jmp 0x140222691
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140222673
xor al, al
jmp 0x140222691
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14022268f
xor al, al
jmp 0x140222691
mov al, 1
add rsp, 0x38
ret
Function at 0x1400b8d9b
Capabilities:
Create thread

Disassembly:
jmp 0x14020a5c0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x270
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x60
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x298]
mov rax, qword [0x1403ded40]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, [0x1403fa403]
call fcn.1400b92ff
call fcn.1400b8d0a
add rax, 0xdc
mov qword [rbp + 8], rax
movss xmm0, dword [0x140243d2c]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x140266a88]
movss xmm2, dword [0x140243cf0]
movss xmm1, dword [0x1402839ec]
lea rcx, [rbp + 0x144]
call fcn.1400b848b
mov ecx, 0x10
imul rcx, rcx, 0x15
mov rdx, qword [rbp + 8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [0x140243d2c]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x140283a00]
movss xmm2, dword [0x1402839ec]
movss xmm1, dword [0x1402839ec]
lea rcx, [rbp + 0x174]
call fcn.1400b848b
mov ecx, 0x10
imul rcx, rcx, 0x16
mov rdx, qword [rbp + 8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x28], 0
cmp dword [rbp + 0x260], 0
jl 0x14020a6eb
cmp dword [rbp + 0x260], 0x7c
jge 0x14020a6eb
lea r8, [rbp + 0x28]
mov edx, dword [rbp + 0x260]
lea rcx, [0x1403a87d0]
call fcn.14020b680
lea rcx, [rbp + 0x48]
call fcn.1400b92cd
nop
cmp qword [rbp + 0x28], 0
jne 0x14020a70e
lea rdx, str.Select_Key
lea rcx, [rbp + 0x48]
call fcn.1400b61ea
jmp 0x14020a71b
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x48]
call fcn.1400b61ea
cmp dword [rbp + 0x270], 1
jne 0x14020a734
lea rdx, str.Press_the_key
lea rcx, [rbp + 0x48]
call fcn.1400b61ea
movss xmm2, dword [0x140259a74]
movss xmm1, dword [0x140283b0c]
lea rcx, [rbp + 0x1c4]
call fcn.1400b8049
mov qword [rbp + 0x218], rax
lea r8, [0x140253a74]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x1e8]
call fcn.1400b8855
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x228], rax
mov rcx, qword [rbp + 0x228]
call fcn.1400b647e
mov qword [rbp + 0x230], rax
mov rdx, qword [rbp + 0x218]
mov rcx, qword [rbp + 0x230]
call fcn.1400b70c2
mov byte [rbp + 0x1a4], al
lea rcx, [rbp + 0x1e8]
call fcn.1400b6974
movzx eax, byte [rbp + 0x1a4]
test eax, eax
je 0x14020a7f5
cmp dword [rbp + 0x270], 0
jne 0x14020a7f5
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x268]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rbp + 0x48]
call fcn.1400b6974
lea rcx, [rbp - 0x30]
lea rdx, [0x14027b860]
call fcn.1400b8a6c
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.1400b7879
lea rsp, [rbp + 0x240]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b8f30
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400ee770
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1403fa07c]
call fcn.1400b92ff
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x14022fe80]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400ee7ef
mov dword [rbp + 0x120], 1
jmp 0x1400ee7f9
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400ee842
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400ee7ba
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x2fc52f320
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc530400
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc52fd22
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc552108]
test eax, eax
je 0x2fc52fdba
lea rax, [0x2fc5520e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc552110]
mov qword [rbp - 8], rax
jmp 0x2fc52fd9e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc52fd92
cmp qword [rbp - 0x10], 0
je 0x2fc52fd92
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc52fd58
lea rax, [0x2fc5520e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc52fdbb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc52fec0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc52fee8
mov eax, 0
jmp 0x2fc52ff36
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc52ff11
mov eax, 0
jmp 0x2fc52ff36
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc52ff31
mov eax, 0
jmp 0x2fc52ff36
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52ff3c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc52ffba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc52ffb1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc52ffb1
mov rax, qword [rbp - 8]
jmp 0x2fc52ffcf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc52ff84
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc518870
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc519950
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc519272
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc53b108]
test eax, eax
je 0x2fc51930a
lea rax, [0x2fc53b0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc53b110]
mov qword [rbp - 8], rax
jmp 0x2fc5192ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc5192e2
cmp qword [rbp - 0x10], 0
je 0x2fc5192e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc5192a8
lea rax, [0x2fc53b0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc51930b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc519410
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc519438
mov eax, 0
jmp 0x2fc519486
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc519461
mov eax, 0
jmp 0x2fc519486
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc519481
mov eax, 0
jmp 0x2fc519486
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc51948c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc51950a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc519501
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc519501
mov rax, qword [rbp - 8]
jmp 0x2fc51951f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5194d4
mov eax, 0
add rsp, 0x20
pop rbp
ret