joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2884063a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x340
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2d0], rcx
mov dword [rbp + 0x2d8], edx
mov qword [rbp + 0x2e0], r8
mov dword [rbp + 0x2e8], r9d
mov dword [rbp + 0x2b8], 0
mov dword [rbp + 0x2bc], 0
jmp 0x28840642f
mov eax, dword [rbp + 0x2bc]
mov edx, eax
mov eax, dword [rbp + 0x2bc]
cdqe
mov byte [rbp + rax + 0x1a0], dl
mov eax, dword [rbp + 0x2bc]
cdq
idiv dword [rbp + 0x2e8]
mov eax, edx
movsxd rdx, eax
mov rax, qword [rbp + 0x2e0]
add rax, rdx
movzx eax, byte [rax]
mov edx, eax
mov eax, dword [rbp + 0x2bc]
cdqe
mov byte [rbp + rax + 0xa0], dl
add dword [rbp + 0x2bc], 1
cmp dword [rbp + 0x2bc], 0xff
jle 0x2884063e1
mov dword [rbp + 0x2bc], 0
jmp 0x2884064bb
mov eax, dword [rbp + 0x2bc]
cdqe
movzx eax, byte [rbp + rax + 0x1a0]
movzx edx, al
mov eax, dword [rbp + 0x2b8]
add edx, eax
mov eax, dword [rbp + 0x2bc]
cdqe
movzx eax, byte [rbp + rax + 0xa0]
movzx eax, al
add eax, edx
cdq
shr edx, 0x18
add eax, edx
movzx eax, al
sub eax, edx
mov dword [rbp + 0x2b8], eax
lea rdx, [rbp + 0x1a0]
mov eax, dword [rbp + 0x2b8]
cdqe
add rdx, rax
lea rcx, [rbp + 0x1a0]
mov eax, dword [rbp + 0x2bc]
cdqe
add rax, rcx
mov rcx, rax
call fcn.288407480
add dword [rbp + 0x2bc], 1
cmp dword [rbp + 0x2bc], 0xff
jle 0x288406447
mov dword [rbp + 0x2b4], 0
mov dword [rbp + 0x2b0], 0
mov dword [rbp + 0x2ac], 0
mov dword [rbp + 0x2b4], 0
jmp 0x2884065ba
mov eax, dword [rbp + 0x2b0]
add eax, 1
and eax, 0xff
mov dword [rbp + 0x2b0], eax
mov eax, dword [rbp + 0x2b0]
movzx eax, byte [rbp + rax + 0x1a0]
movzx edx, al
mov eax, dword [rbp + 0x2ac]
add eax, edx
and eax, 0xff
mov dword [rbp + 0x2ac], eax
lea rdx, [rbp + 0x1a0]
mov eax, dword [rbp + 0x2ac]
add rdx, rax
lea rcx, [rbp + 0x1a0]
mov eax, dword [rbp + 0x2b0]
add rax, rcx
mov rcx, rax
call fcn.288407480
mov eax, dword [rbp + 0x2b0]
movzx edx, byte [rbp + rax + 0x1a0]
mov eax, dword [rbp + 0x2ac]
movzx eax, byte [rbp + rax + 0x1a0]
add eax, edx
movzx eax, al
cdqe
movzx eax, byte [rbp + rax + 0x1a0]
mov byte [rbp + 0x2ab], al
mov rax, qword [rbp + 0x2d0]
movzx eax, byte [rax]
xor al, byte [rbp + 0x2ab]
mov byte [rbp + 0x2aa], al
mov rax, qword [rbp + 0x2d0]
movzx edx, byte [rbp + 0x2aa]
mov byte [rax], dl
add qword [rbp + 0x2d0], 1
add dword [rbp + 0x2b4], 1
mov eax, dword [rbp + 0x2b4]
cmp eax, dword [rbp + 0x2d8]
jl 0x2884064f4
nop
nop
add rsp, 0x340
pop rbp
ret
Function at 0x2fc4d4e50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d5f30
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5852
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d58ea
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d58ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d58c2
cmp qword [rbp - 0x10], 0
je 0x2fc4d58c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5888
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d58eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d59f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5a18
mov eax, 0
jmp 0x2fc4d5a66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5a41
mov eax, 0
jmp 0x2fc4d5a66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5a61
mov eax, 0
jmp 0x2fc4d5a66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5a6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d5aea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5ae1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5ae1
mov rax, qword [rbp - 8]
jmp 0x2fc4d5aff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5ab4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001f30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f7c
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4cdc70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4ced50
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4ce672
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4ce70a
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4ce6ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ce6e2
cmp qword [rbp - 0x10], 0
je 0x2fc4ce6e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ce6a8
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ce70b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4ce810
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ce838
mov eax, 0
jmp 0x2fc4ce886
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ce861
mov eax, 0
jmp 0x2fc4ce886
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ce881
mov eax, 0
jmp 0x2fc4ce886
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ce88c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4ce90a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4ce901
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4ce901
mov rax, qword [rbp - 8]
jmp 0x2fc4ce91f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4ce8d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d6d80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d7e60
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d7782
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d781a
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d77fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d77f2
cmp qword [rbp - 0x10], 0
je 0x2fc4d77f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d77b8
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d781b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7920
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7948
mov eax, 0
jmp 0x2fc4d7996
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7971
mov eax, 0
jmp 0x2fc4d7996
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7991
mov eax, 0
jmp 0x2fc4d7996
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d799c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d7a1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7a11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7a11
mov rax, qword [rbp - 8]
jmp 0x2fc4d7a2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d79e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400ff910
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x1400ff942
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1400ff9ea
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x1400ff986
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x1400ff9d5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400ff9a2
mov dword [rsp + 0x1c], 1
jmp 0x1400ff9aa
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x1400ff9d3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x1400ff97c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x1400ff938
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret
Function at 0x140011294
Capabilities:
Terminate process

Disassembly:
jmp 0x140014710
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001132a
Capabilities:
List user accounts

Disassembly:
jmp 0x140013060
push rbp
push rdi
sub rsp, 0x418
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x3c8], rax
lea rcx, [0x140025107]
call fcn.14001146a
mov dword [rbp + 0x234], 0x101
lea rdx, str.Usuarios_en_el_sistema:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011267
lea rdx, [0x140011249]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rbp + 0x10]
mov r8d, 2
mov edx, 3
xor ecx, ecx
call fcn.14001143d
test eax, eax
jne 0x140013112
lea rcx, [rbp + 0x10]
call fcn.140011226
jmp 0x1400130ca
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001bd80]
call fcn.1400113f2
mov eax, edi
mov rcx, qword [rbp + 0x3c8]
xor rcx, rbp
call fcn.14001123f
lea rsp, [rbp + 0x3d8]
pop rdi
pop rbp
ret

Function at 0x140011334
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015a60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015a80
xor al, al
jmp 0x140015b01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015a93
xor al, al
jmp 0x140015b01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015abd
xor al, al
jmp 0x140015b01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015ad1
xor al, al
jmp 0x140015b01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015ae3
xor al, al
jmp 0x140015b01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015aff
xor al, al
jmp 0x140015b01
mov al, 1
add rsp, 0x38
ret
Function at 0x14001143d
Capabilities:
List user accounts

Disassembly:
jmp 0x140013221
jmp qword [sym.imp.NETAPI32.dll_NetUserEnum]
Function at 0x2fc4d1700
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d27e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d2102
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d219a
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d217e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d2172
cmp qword [rbp - 0x10], 0
je 0x2fc4d2172
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d2138
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d219b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d22a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d22c8
mov eax, 0
jmp 0x2fc4d2316
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d22f1
mov eax, 0
jmp 0x2fc4d2316
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d2311
mov eax, 0
jmp 0x2fc4d2316
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d231c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d239a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d2391
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d2391
mov rax, qword [rbp - 8]
jmp 0x2fc4d23af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d2364
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x006ddad0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x006ddae0]
mov dword [rax], 1
mov rax, qword [0x006ddaf0]
mov dword [rax], 1
mov rax, qword [0x006ddac0]
mov dword [rax], 1
mov rax, qword [0x006dd9c0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x006ddab0]
mov dword [0x0072600c], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x006dda90]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x006dd970]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x403760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
movdqa xmm0, xmmword [rdx]
aeskeygenassist xmm0, xmm0, 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x48cc60
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x20], r8
mov rax, rdx
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
call dbg.iter<u8>
mov rcx, rax
call dbg.into_iter<core::slice::iter::Iter<u8>>
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x40]
call sym.__core::slice::iter::Iter_T__as_core::iter::traits::iterator::Iterator_::next::h5ff95e2625d161c9
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov eax, 1
xor ecx, ecx
cmp rdx, 0
cmove rax, rcx
cmp rax, 0
jne 0x48ccfc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
add rsp, 0x98
ret
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov al, byte [rax]
mov byte [rsp + 0x97], al
movzx eax, al
xor rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
movabs rcx, 0x100000001b3
mov qword [rsp + 0x88], rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov qword [rsp + 0x38], rax
jmp 0x48ccb4