joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005520
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400111a4]
mov rbx, rcx
test esi, esi
jle 0x140005650
mov rax, qword [0x1400111a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000556b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400055f5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140005550
mov rcx, rbx
call fcn.140005f70
mov rdi, rax
test rax, rax
je 0x140005672
mov rax, qword [0x1400111a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400060b0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400111a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140005657
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400055ee
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140005600
add dword [0x1400111a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400111a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400055ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400054b0
nop dword [rax]
xor esi, esi
jmp 0x140005578
mov rax, qword [0x1400111a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400054b0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400054b0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140005be0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140011200]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400111e0]
test rbx, rbx
je 0x140005c3c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140005c33
test rsi, rsi
je 0x140005c33
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140005c18
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140005f70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000df70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140005f90
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140005f98
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140005f90
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140005fed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140005fe4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140005f90
add rax, 0x28
cmp rax, r9
jne 0x140005fd0
xor eax, eax
ret

Function at 0x140005ff0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000df70]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000600f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140006018
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000600f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400060b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000df70]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400060cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400060d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140006380
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x140011280], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x140011288], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400063d0
lea rdx, [0x140006290]
mov ecx, eax
mov dword [0x140011278], eax
call fcn.14000bd40
test eax, eax
jne 0x1400063d8
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400063c7
call sub.msvcrt.dll_abort
nop
nop
Function at 0x1400063e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14000df00]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x140006418
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140006480
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x140006490
mov esi, dword [0x140011278]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x140006500
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x140006548
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x140006407
mov rcx, rbx
call fcn.1400062e0
mov qword [rsi + r12*8 + 8], rax
jmp 0x140006407
call fcn.1400062e0
mov qword [rbx + 0x10], rax
jmp 0x140006407
mov r10d, dword [rsi]
test r10d, r10d
je 0x1400065aa
mov r9d, dword [0x14000c710]
test r9d, r9d
je 0x1400065d8
lock add dword [0x140011280], 1
jne 0x14000660c
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x1400065b7
mov eax, dword [rsi]
test eax, eax
je 0x140006421
lock sub dword [0x140011280], 1
js 0x140006421
mov rcx, qword [0x140011288]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x140006421
lea rcx, [r12 + 0x21]
mov edx, 8
lea rdi, [r12 + 0x20]
call sub.msvcrt.dll_calloc
mov rsi, rax
test rax, rax
je 0x140006633
mov qword [rax], rdi
mov ecx, dword [0x140011278]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14000645b
call r13
jmp 0x14000645b
lea rdi, [rbp + rbp]
lea rax, [r12 + 0x20]
mov rcx, rsi
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sub.msvcrt.dll_realloc
mov rsi, rax
test rax, rax
je 0x140006633
mov qword [rax], rdi
sub rdi, rbp
lea rcx, [rax + rbp*8 + 8]
xor edx, edx
lea r8, [rdi*8]
call sub.msvcrt.dll_memset
jmp 0x140006523
call fcn.140006380
mov dword [0x14000c710], 1
mov edx, dword [rsi]
test edx, edx
jne 0x1400064ac
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x140006421
mov rax, qword [0x140011270]
lea r12, [rax + 1]
mov qword [0x140011270], r12
mov qword [rbx + 0x10], r12
jmp 0x1400064c7
lock add dword [0x14000c714], 1
je 0x140006591
mov r8d, dword [0x14000c710]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdi, [0x14000c710]
test r8d, r8d
jne 0x1400065a0
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x140006600
jmp 0x1400065a0
mov rcx, qword [0x140011288]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400064ba
lock sub dword [0x140011280], 1
jmp 0x1400064ba
call sub.msvcrt.dll_abort
nop
nop dword [rax]
cmp qword [rcx], rdx
jae 0x140006650
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x14000665a
mov qword [rcx + 8], r8
test r9, r9
je 0x140006664
cmp qword [rcx], rdx
je 0x140006668
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x2fc4cfc60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d0d40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d0662
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d06fa
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d06de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d06d2
cmp qword [rbp - 0x10], 0
je 0x2fc4d06d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0698
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d06fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d0800
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0828
mov eax, 0
jmp 0x2fc4d0876
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0851
mov eax, 0
jmp 0x2fc4d0876
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0871
mov eax, 0
jmp 0x2fc4d0876
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d087c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d08fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d08f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d08f1
mov rax, qword [rbp - 8]
jmp 0x2fc4d090f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d08c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400013b0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000140f
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140001423
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140003da0
add rsp, 0x68
ret
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x44], rax
xor edx, edx
xor eax, eax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
lea r9d, [rax + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140003da0
add rsp, 0x68
ret

Function at 0x140002a90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xafc10]
mov eax, 0xafd10
call fcn.14000cfe0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xafc00], rax
xor ebx, ebx
mov dword [rsp + 0x68], 0x10001
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
or edx, 0xffffffff
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x6c], 0x5dc0
mov dword [rsp + 0x70], 0x5dc0
mov dword [rsp + 0x74], 0x80001
mov word [rsp + 0x78], bx
call qword [sym.imp.WINMM.dll_waveOutOpen]
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0xafc80
call fcn.140004d90
mov eax, ebx
lea r10, [rbp - 0x80]
nop
mov r9d, eax
movsx edx, al
shr r9d, 3
lea r10, [r10 + 1]
and r9d, 1
mov ecx, eax
imul r9d, eax
inc eax
shr ecx, 0xb
movsx r8d, cl
imul r8d, edx
shr r9d, 3
xor r9b, r8b
mov byte [r10 - 1], r9b
cmp eax, 0xafc80
jb 0x140002b20
mov rcx, qword [rsp + 0x30]
lea rax, [rbp - 0x80]
mov r8d, 0x30
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x40], 0xafc80
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x30
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x30
call qword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WINMM.dll_waveOutClose]
mov rcx, qword [rbp + 0xafc00]
xor rcx, rsp
call fcn.140003da0
mov rbx, qword [rsp + 0xafd20]
add rsp, 0xafd10
pop rbp
ret
Function at 0x140002bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x50b90]
mov eax, 0x50c90
call fcn.14000cfe0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x50b80], rax
xor ebx, ebx
mov dword [rsp + 0x68], 0x10001
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
or edx, 0xffffffff
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x6c], 0x2b11
mov dword [rsp + 0x70], 0x2b11
mov dword [rsp + 0x74], 0x80001
mov word [rsp + 0x78], bx
call qword [sym.imp.WINMM.dll_waveOutOpen]
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x50bfe
call fcn.140004d90
mov eax, ebx
lea r10, [rbp - 0x80]
nop
mov r9d, eax
movsx edx, al
shr r9d, 3
lea r10, [r10 + 1]
and r9d, 1
mov ecx, eax
imul r9d, eax
inc eax
shr ecx, 9
movsx r8d, cl
imul r8d, edx
shr r9d, 3
xor r9b, r8b
mov byte [r10 - 1], r9b
cmp eax, 0x50bfe
jb 0x140002c80
mov rcx, qword [rsp + 0x30]
lea rax, [rbp - 0x80]
mov r8d, 0x30
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x40], 0x50bfe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x30
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x30
call qword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WINMM.dll_waveOutClose]
mov rcx, qword [rbp + 0x50b80]
xor rcx, rsp
call fcn.140003da0
mov rbx, qword [rsp + 0x50ca0]
add rsp, 0x50c90
pop rbp
ret
Function at 0x140002d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x50b90]
mov eax, 0x50c90
call fcn.14000cfe0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x50b80], rax
xor ebx, ebx
mov dword [rsp + 0x68], 0x10001
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
or edx, 0xffffffff
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x6c], 0x2b11
mov dword [rsp + 0x70], 0x2b11
mov dword [rsp + 0x74], 0x80001
mov word [rsp + 0x78], bx
call qword [sym.imp.WINMM.dll_waveOutOpen]
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x50bfe
call fcn.140004d90
mov eax, ebx
lea r10, [rbp - 0x80]
nop
mov r9d, eax
movsx edx, al
shr r9d, 3
lea r10, [r10 + 1]
and r9d, 0xe
mov ecx, eax
imul r9d, eax
inc eax
shr ecx, 8
movsx r8d, cl
imul r8d, edx
shr r9d, 3
xor r9b, r8b
mov byte [r10 - 1], r9b
cmp eax, 0x50bfe
jb 0x140002de0
mov rcx, qword [rsp + 0x30]
lea rax, [rbp - 0x80]
mov r8d, 0x30
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x40], 0x50bfe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x30
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x30
call qword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WINMM.dll_waveOutClose]
mov rcx, qword [rbp + 0x50b80]
xor rcx, rsp
call fcn.140003da0
mov rbx, qword [rsp + 0x50ca0]
add rsp, 0x50c90
pop rbp
ret
Function at 0x1400060a4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140005e78
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140005e78
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005e78
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005e78
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005e78
cmp dword [rcx + 0x84], 0xe
jbe 0x140005e78
cmp dword [rcx + 0xf8], esi
je 0x140005e78
mov ecx, r14d
call fcn.140005fc0
mov ecx, 2
call fcn.1400084ec
nop
cmp byte [0x1400e11b8], 0
jne 0x140005f42
mov r15d, 1
mov eax, r15d
xchg dword [0x1400e11ac], eax
test ebx, ebx
jne 0x140005eeb
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400e11b0]
cmp rcx, rax
je 0x140005ee2
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140004644]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400e11c8]
jmp 0x140005ef7
cmp ebx, r15d
jne 0x140005efd
lea rcx, [0x1400e11e0]
call fcn.1400065b4
nop
test ebx, ebx
jne 0x140005f14
lea rdx, [0x14000f3c0]
lea rcx, [0x14000f3a0]
call fcn.140005d38
lea rdx, [0x14000f3d0]
lea rcx, [0x14000f3c8]
call fcn.140005d38
movzx eax, byte [0x1400e11b8]
test esi, esi
cmove eax, r15d
mov byte [0x1400e11b8], al
jmp 0x140005f42
mov ecx, 2
call fcn.140008540
test esi, esi
jne 0x140005f59
mov ecx, r14d
call fcn.140005f74
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140005e08
Function at 0x2fc4d3440
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4520
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d3e42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d3eda
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d3ebe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d3eb2
cmp qword [rbp - 0x10], 0
je 0x2fc4d3eb2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d3e78
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d3edb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d3fe0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4008
mov eax, 0
jmp 0x2fc4d4056
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4031
mov eax, 0
jmp 0x2fc4d4056
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4051
mov eax, 0
jmp 0x2fc4d4056
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d405c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d40da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d40d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d40d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d40ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d40a4
mov eax, 0
add rsp, 0x20
pop rbp
ret