joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140019000]
mov dword [rax], 1
mov rax, qword [0x140019010]
mov dword [rax], 1
mov rax, qword [0x140019020]
mov dword [rax], 1
mov rax, qword [0x140018ff0]
mov dword [rax], 1
mov rax, qword [0x140018ea0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002310
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [sym.__acrt_iob_func]
xor ebx, ebx
mov rbp, rcx
mov rsi, rdx
test rdx, rdx
jle 0x140002353
nop
mov r12, qword [rbp + rbx*8]
mov ecx, 1
add rbx, 1
call rdi
xor r8d, r8d
mov rcx, rax
mov rdx, r12
call sym.writeWindows__systemZio_205
cmp rsi, rbx
jg 0x140002330
mov ecx, 1
call rdi
mov r8d, 1
mov edx, 1
lea rcx, [0x14001815c]
mov r9, rax
call sym.fwrite
mov ecx, 1
call rdi
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.fflush

Function at 0x140002490
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x1400024b1
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sym.fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush

Function at 0x140002570
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.fflush
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140007600
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r13, rcx
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov rcx, r13
mov r8, rbx
mov edx, 1
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.fflush
Function at 0x14000dc30
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
push r12
push rbx
sub rsp, 0x150
movaps xmmword [rbp - 0x20], xmm6
cmp qword [0x14002d7d8], 0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 0x131], 1
je 0x14000dd22
mov rax, qword [0x14002d7c8]
lea rcx, [rbp - 0x120]
mov rdx, rbp
mov qword [rbp - 0x130], rax
lea rax, [rbp - 0x130]
mov qword [0x14002d7c8], rax
call sym._setjmp
cdqe
mov qword [rbp - 0x128], rax
test rax, rax
jne 0x14000dd48
xor r12d, r12d
cmp qword [rbp + 0x10], 0
je 0x14000dcf3
mov rcx, qword [rbp + 0x10]
call sym.strlen
mov edx, 7
lea rcx, [0x140017020]
cmp rax, rdx
movq xmm6, rax
mov rbx, rax
cmovge rdx, rax
movq xmm0, rdx
add rdx, 0x11
punpcklqdq xmm6, xmm0
call sym.rawNewObj__system_5697.constprop.0
mov rdx, qword [rbp + 0x10]
lea r8, [rbx + 1]
movups xmmword [rax], xmm6
lea rcx, [rax + 0x10]
mov r12, rax
call sym.memcpy
mov rcx, r12
call qword [0x14002d7d8]
mov rax, qword [0x14002d7c8]
cmp qword [rbp - 0x128], 0
mov byte [rbp - 0x131], 0
mov rax, qword [rax]
mov qword [0x14002d7c8], rax
jne 0x14000ddbf
movzx eax, byte [rbp - 0x131]
test al, al
jne 0x14000ddd8
movaps xmm6, xmmword [rbp - 0x20]
add rsp, 0x150
pop rbx
pop r12
pop rbp
ret
mov rax, qword [0x14002d7c8]
mov rax, qword [rax]
mov qword [rbp - 0x128], 0
mov qword [0x14002d7c8], rax
mov rax, qword [0x14002d7c0]
mov rbx, qword [rax + 0x28]
test rbx, rbx
je 0x14000dd85
add qword [rbx - 0x10], 8
mov rax, qword [0x14002d7c0]
test rax, rax
je 0x14000ddaa
mov rdx, qword [rax - 0x10]
lea r8, [rax - 0x10]
sub rdx, 8
mov qword [rax - 0x10], rdx
cmp rdx, 7
ja 0x14000ddaa
mov rdx, r8
lea rcx, [0x14002abf8]
call sym.addZCT__system_5314
cmp qword [rbp - 0x128], 0
mov qword [0x14002d7c0], rbx
je 0x14000dd22
mov rcx, qword [0x14002d7c0]
test rcx, rcx
je 0x14000de08
call sym.raiseExceptionAux__system_2868
jmp 0x14000dd22
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x18]
mov edx, 1
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.fflush
jmp 0x14000dd31
call sym.sysFatal__system_2900.constprop.0
nop
nop

Function at 0x14000f0d0
Capabilities:
Write file on windows

Disassembly:
mov edx, 1
lea rcx, [0x140018780]
jmp sym.echoBinSafe

Function at 0x14000f190
Capabilities:
Write file on windows

Disassembly:
mov edx, 1
lea rcx, [0x140018780]
jmp sym.echoBinSafe

Function at 0x14000f500
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop
Function at 0x140010132
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14002e248]
test eax, eax
je 0x1400101ca
lea rax, [0x14002e220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14002e250]
mov qword [rbp - 8], rax
jmp 0x1400101ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400101a2
cmp qword [rbp - 0x10], 0
je 0x1400101a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140010168
lea rax, [0x14002e220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400101cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400102d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400102f8
mov eax, 0
jmp 0x140010346
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140010321
mov eax, 0
jmp 0x140010346
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140010341
mov eax, 0
jmp 0x140010346
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14001034c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400103ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400103c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400103c1
mov rax, qword [rbp - 8]
jmp 0x1400103df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140010394
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1806a7058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1806a71df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1806a7089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806a706f
add dl, dl
jne 0x1806a7096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806a70f6
xor eax, eax
add dl, dl
jne 0x1806a70a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806a71ad
add dl, dl
jne 0x1806a70b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806a70c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806a70d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806a70dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806a70ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1806a707e
mov eax, 1
add dl, dl
jne 0x1806a7106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806a7113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806a70fb
sub eax, ebx
mov ebx, 1
jne 0x1806a714c
mov ecx, 1
add dl, dl
jne 0x1806a712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1806a713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806a7123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806a707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1806a7168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1806a7175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806a715d
cmp eax, 0x7d00
jae 0x1806a719b
cmp eax, 0x500
jb 0x1806a7196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806a707e
cmp eax, 0x7f
ja 0x1806a719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806a707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806a71d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1806a707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140017320
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112ee
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018670
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018690
xor al, al
jmp 0x140018711
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400186a3
xor al, al
jmp 0x140018711
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400186cd
xor al, al
jmp 0x140018711
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400186e1
xor al, al
jmp 0x140018711
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400186f3
xor al, al
jmp 0x140018711
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001870f
xor al, al
jmp 0x140018711
mov al, 1
add rsp, 0x38
ret
Function at 0x1406bd970
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406bdaf7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406bd9a1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bd987
add dl, dl
jne 0x1406bd9ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bda0e
xor eax, eax
add dl, dl
jne 0x1406bd9bd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bdac5
add dl, dl
jne 0x1406bd9ce
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bd9db
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bd9e8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bd9f5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406bda02
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406bd996
mov eax, 1
add dl, dl
jne 0x1406bda1e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bda2b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bda13
sub eax, ebx
mov ebx, 1
jne 0x1406bda64
mov ecx, 1
add dl, dl
jne 0x1406bda46
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406bda53
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bda3b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bd996
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406bda80
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406bda8d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bda75
cmp eax, 0x7d00
jae 0x1406bdab3
cmp eax, 0x500
jb 0x1406bdaae
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bd996
cmp eax, 0x7f
ja 0x1406bdab6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bd996
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406bdaea
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406bd996
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4cb300
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cbd02
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f0108]
test eax, eax
je 0x2fc4cbd9a
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f0110]
mov qword [rbp - 8], rax
jmp 0x2fc4cbd7e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cbd72
cmp qword [rbp - 0x10], 0
je 0x2fc4cbd72
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cbd38
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cbd9b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cbea0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cbec8
mov eax, 0
jmp 0x2fc4cbf16
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cbef1
mov eax, 0
jmp 0x2fc4cbf16
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cbf11
mov eax, 0
jmp 0x2fc4cbf16
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cbf1c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cbf9a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cbf91
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cbf91
mov rax, qword [rbp - 8]
jmp 0x2fc4cbfaf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cbf64
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dcbd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dd5d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc502108]
test eax, eax
je 0x2fc4dd66a
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc502110]
mov qword [rbp - 8], rax
jmp 0x2fc4dd64e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dd642
cmp qword [rbp - 0x10], 0
je 0x2fc4dd642
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dd608
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dd66b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dd770
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dd798
mov eax, 0
jmp 0x2fc4dd7e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dd7c1
mov eax, 0
jmp 0x2fc4dd7e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dd7e1
mov eax, 0
jmp 0x2fc4dd7e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dd7ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dd86a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dd861
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dd861
mov rax, qword [rbp - 8]
jmp 0x2fc4dd87f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dd834
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5400
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d5e02
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d5e9a
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5e7e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5e72
cmp qword [rbp - 0x10], 0
je 0x2fc4d5e72
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5e38
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5e9b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5fa0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5fc8
mov eax, 0
jmp 0x2fc4d6016
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5ff1
mov eax, 0
jmp 0x2fc4d6016
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6011
mov eax, 0
jmp 0x2fc4d6016
mov eax, 1
add rsp, 0x20
pop rbp
ret