joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x18001e010]
xor rax, rsp
mov qword [rsp + 0x10], rax
xor esi, esi
mov rbp, rcx
mov eax, esi
nop word [rax + rax]
mov r8, qword [rbp + rax*8 + 0x20]
movzx edx, byte [r8]
movzx ecx, byte [r8 + 2]
mov byte [rsp + rax*4], dl
movzx edx, byte [r8 + 1]
mov byte [rsp + rax*4 + 2], cl
movzx ecx, byte [r8 + 3]
mov byte [rsp + rax*4 + 1], dl
mov byte [rsp + rax*4 + 3], cl
inc rax
cmp rax, 4
jl 0x180001e20
movzx edi, byte [rsp + rsi]
movzx ebx, byte [rsp + rsi + 4]
movzx eax, dil
add al, al
movzx r9d, byte [rsp + rsi + 0xc]
movzx r10d, byte [rsp + rsi + 8]
movzx r11d, al
movzx eax, bl
add al, al
movzx edx, al
movzx eax, r11b
xor al, 0x1b
movzx eax, al
cmp dil, 0x80
cmovae r11d, eax
movzx eax, dl
xor al, 0x1b
movzx eax, al
cmp bl, 0x80
cmovae edx, eax
mov rax, qword [rbp + 0x20]
movzx ecx, dl
xor cl, r11b
xor cl, r9b
xor cl, r10b
xor cl, bl
mov byte [rsi + rax], cl
movzx eax, r10b
add al, al
movzx r8d, al
movzx eax, r8b
xor al, 0x1b
movzx eax, al
cmp r10b, 0x80
cmovae r8d, eax
mov rax, qword [rbp + 0x28]
movzx ecx, r8b
xor cl, dl
xor cl, r9b
xor cl, dil
xor cl, r10b
mov byte [rsi + rax], cl
movzx eax, r9b
add al, al
movzx edx, al
movzx eax, dl
xor al, 0x1b
movzx eax, al
cmp r9b, 0x80
cmovae edx, eax
mov rax, qword [rbp + 0x30]
movzx ecx, dl
xor dl, r11b
xor dl, r10b
xor cl, r8b
movzx r10d, byte [rsp + rsi + 9]
xor cl, dil
xor dl, dil
xor cl, r9b
movzx edi, byte [rsp + rsi + 1]
xor dl, bl
movzx r9d, byte [rsp + rsi + 0xd]
xor cl, bl
movzx ebx, byte [rsp + rsi + 5]
mov byte [rsi + rax], cl
mov rax, qword [rbp + 0x38]
mov byte [rsi + rax], dl
movzx eax, dil
add al, al
movzx r11d, al
movzx eax, bl
add al, al
movzx edx, al
movzx eax, r11b
xor al, 0x1b
movzx eax, al
cmp dil, 0x80
cmovae r11d, eax
movzx eax, dl
xor al, 0x1b
movzx eax, al
cmp bl, 0x80
cmovae edx, eax
mov rax, qword [rbp + 0x20]
movzx ecx, dl
xor cl, r11b
xor cl, r9b
xor cl, r10b
xor cl, bl
mov byte [rsi + rax + 1], cl
movzx eax, r10b
add al, al
movzx r8d, al
movzx eax, r8b
xor al, 0x1b
movzx eax, al
cmp r10b, 0x80
cmovae r8d, eax
mov rax, qword [rbp + 0x28]
movzx ecx, r8b
xor cl, dl
xor cl, r9b
xor cl, dil
xor cl, r10b
mov byte [rax + rsi + 1], cl
movzx eax, r9b
add al, al
movzx edx, al
movzx eax, dl
xor al, 0x1b
movzx eax, al
cmp r9b, 0x80
cmovae edx, eax
mov rax, qword [rbp + 0x30]
movzx ecx, dl
xor dl, r11b
xor cl, r8b
xor dl, r10b
xor cl, dil
xor dl, dil
xor cl, r9b
xor dl, bl
xor cl, bl
mov byte [rax + rsi + 1], cl
mov rax, qword [rbp + 0x38]
mov byte [rax + rsi + 1], dl
add rsi, 2
cmp rsi, 4
jl 0x180001e50
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.180010b50
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18003f03b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop r13w
mov r15w, word [rsp + 1]
cmc
jmp 0x18003f0ab
lea rsp, [rsp + 6]
jmp 0x18003f095
lea r10, [rsp]
lea rsi, [rdx + r15]
bsf r13d, r15d
jmp 0x18003f0fe
jo 0x18003f069
lea rsp, [rsp + 6]
jmp 0x18003f095
add dl, 0xd6
rdtsc
jmp 0x18003f0e8
jge 0x18003f0b4
add dl, 0xd6
rdtsc
jmp 0x18003f0b9

Function at 0x18003f60a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add r13b, sil
mov r15b, bpl
mov r11d, dword [rsp]
rdtsc
rdtsc
jmp 0x18003f50d
bsr r15d, r14d
jmp 0x18003f4f1
mov al, r13b
dec r14b
jp 0x18003f577
push dx
add rsp, 0
mov r14w, word [rsp]
mov dil, r13b
mov bx, r8w
call fcn.18003f593
sbb byte [rdx + rcx*4 + 0xc], al
and al, 0x41
bswap ecx
mov r9b, byte [rsp]
bswap r9d
btr r14d, r15d
jb 0x18003f507
bsr r15d, r14d
jmp 0x18003f4f1
mov bx, r8w
lea rsp, [rsp + 2]
jmp 0x18003f646
add rsp, 0
mov r14w, word [rsp]
mov dil, r13b
jmp 0x18003f541
push dx
jmp 0x18003f557
jmp 0x18003f52e
push r15w
jle 0x18003f659
stc
mov rdi, 0xffffffffdce3d499
clc
jmp 0x18003f73f
lea rdi, [r8 + r8]
mov r9b, byte [rsp]
mov edx, ebp
add al, 0x91
bswap r14d
jmp 0x18003f60f
xor al, 0x8d
mov r14, qword [rsp]
lea r14, [rbx + r14]
xchg r11d, ebx
lea r9, [rsi + rsi]
jmp 0x18003f625
stc
mov rdi, 0xffffffffdce3d499
jmp 0x18003f667
clc
add r14d, eax
lea rsp, [rsp + 2]
jmp 0x18003f6b0
mov word [rsp], r14w
mov r12w, si
bsr dx, r15w
jge 0x18003f708
cmc
jmp 0x18003f6d9
inc al
xchg r11b, r15b
push rax
setp r11b
mov r15, 0xffffffffa8bf6a1b
jmp 0x18003f68d
call fcn.18003f721
xor dword [rcx + reloc.glmc.dll_glmClientCheckLicenseUsb], edx
nop
adc al, byte [rax + 0x13a612e7]
mov ah, byte [0x148c4be2f]
add byte [rcx - 0x76], al
call 0x1a440822f
ror al, 0
mov bpl, r8b
mov r15, qword [rsp]
dec di
jg 0x18003f6c3
jle 0x18003f7d7
outsb dx, byte [rsi]
jns 0x18003f749
mov ebx, 0xd2bf4166
sal dword [rdx - reloc.glmc.dll_glmClientCheckLicenseUsb], 1
setge r15b
jmp 0x18003f7fb
cmc
jmp 0x18003f6d9
add r14d, eax
lea rsp, [rsp + 2]
jmp 0x18003f6b0
invalid
setge r15b
mov rbp, rsi
jmp 0x18003f7fe
mov r15w, 0xd1d2
mov dl, 0xd5
bswap rbp
jmp 0x18003f7c1
mov edi, dword [rsp]
mov di, 0xf99e
mov ebx, dword [rsp]
btc r14d, r12d
jmp 0x18003f822
mov rbp, rsi
mov r9w, 0x38fd
lea rsp, [rsp + 8]
sub al, 0xd8
jmp 0x18003f7e3
lea r12, [r8*8]
jmp 0x18003f868
jo 0x18003f859
mov r15b, 0x2f
mov r11, qword [rsp]
jmp 0x18003f80c
xchg dil, r12b
call fcn.180040158
add ecx, dword [rcx - 1]
invalid
mov r15b, 0x2f
mov r11, qword [rsp]
lea r12, [r8*8]
add sil, al
jno 0x18003f82d
xchg dil, r12b
inc r14
mov r9, 0x4eb348d7
jmp 0x18003fc89
and r9, 0xffffffffc399be86
jmp 0x18003fcef
mov al, byte [rsp]
jmp 0x18003fccb
add r15d, ecx
rcr al, 7
call fcn.18003fcb5
call fcn.18003fd02
or cl, byte [rbx + 0x4f8d7e1b]
movabs al, byte [0xa939b6f534c5a22c]
enter 0xffffffffffff8b3b, 0xffffffffffffff98
sti
dec r8
sbb r15, rax
jl 0x18003fc92
mov al, byte [rsp]
add r15d, ecx
rcr al, 7
jmp 0x18003fcd1
Function at 0x18003fd50
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, byte [rsp]
xchg r12b, bl
not r15w
bswap ebx
mov dl, byte [rsp]
lea rbp, [rbp + riz + 0x3d]
jmp 0x18003fd6d
xchg qword [rsp + 8], rbp
jmp 0x18003fd2e
xchg qword [rsp + 8], rbp
bswap rdi
mov ax, 0xf655
rdtsc
jmp 0x18003fe6c
xchg r11d, eax
rdtsc
mov ebx, 0xb5e4eadd
mov dil, byte [rsp]
neg r15d
jmp 0x18003fd57
mov rbx, qword [rsp]
call fcn.18003fdf0

Function at 0x1801577cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
mov r8w, di
cpuid
jmp 0x180157936
setbe dl
mov r15d, r8d
mov r14w, r15w
mov r11, r9
jmp 0x1801578e2
pop r10
mov bp, word [rsp + 0x3a]
mov r8b, byte [rsp + 0x50]
xchg r12d, ebx
mov r8b, byte [rsp + 0x58]
jmp 0x18015782b
xchg byte [rsp + 0x48], dl
xchg rbx, r10
mov r12w, 0x4744
mov r15w, dx
lea rbp, [r11 + riz - 0x5cca36b5]
pop word [rsp + 0x3f]
jmp 0x180157841
mov r11, qword [rsp + 4]
pushfq
mov edi, r12d
xchg word [rsp + 8], cx
rdtsc
jmp 0x1801578c4
xchg r14, r11
mov dx, r8w
xchg r8b, bpl
xchg r11w, r8w
lea r12, [rbp + riz - 0x3e1b]
setb r11b
jmp 0x18015787c
mov cl, r8b
xchg bpl, sil
xchg r8w, cx
xchg r12b, r14b
xchg r10, rax
jmp 0x180157911
inc r14w
mov r11, 0x6438b2d8
cpuid
rdtsc
neg rsi
bsf cx, ax
jmp 0x1801578ae
sbb ecx, 0x55fc3106
mov bp, ax
mov byte [rsp + 0x1d], al
mov r14w, r15w
pop rdx
pop qword [rsp + 0x4f]
jmp 0x180157892
lea r8, [rdi + riz + 0x9d2]
mov rdx, 0x66cc7dc7
jmp 0x180157959
mov qword [rsp + 6], rdx
pop word [rsp + 0x29]
push word [rsp + 1]
lea rax, [r14 + r13]
lea r10, [r11 + riz - 0x4e]
mov dword [rsp + 0x2c], esp
jmp 0x1801578fb
xchg word [rsp + 2], r12w
mov r8, 0xffffffff8b35aed8
mov byte [rsp + 0xd], dil
mov r12b, byte [rsp + 0x49]
mov byte [rsp + 0xe], dl
xchg r11, rdx
jmp 0x18015785d
mov r15b, 0x1f
rdtsc
push word [rsp + 6]
mov r11b, byte [rsp + 0x55]
lea r15, [rsp - 0x8c96]
pop si
jmp 0x180157996

Function at 0x180157b58
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [rsp], edi
add rsp, 1
mov word [rsp], r10w
bsr rcx, rax
jmp 0x180157b67
not bpl
bswap r11
rdtsc
lea rsp, [rsp + 3]
jmp 0x180157b42
xchg word [rsp + 2], r8w
mov r12, 0x47c19ca
setg r10b
lea r12, [0x669c989]
jmp 0x180157c24
mov ecx, r14d
cmc
sete al
lea r12, [rsp + 0x94]
mov r14w, 0xb830
bts r11, rax
jmp 0x180157b92
mov byte [rsp], al
rdtsc
mov r8b, r11b
sub rsp, 0x18
mov eax, ebp
xchg dx, r11w
jmp 0x180157ba8
bswap edi
xchg r8b, r11b
mov r11b, 0xf6
lea rdx, [rsi*4]
cmc
mov ecx, dword [rsp + 2]
jmp 0x180157be6

Function at 0x180157f59
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl si, cl
xchg rbp, rax
mov r10w, 0xf684
shr r11b, cl
jmp 0x180157f78
Function at 0x180158643
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea r14, [rdi*4]
cpuid
cpuid
add rsp, 3
jmp 0x1801586a3
mov r11w, bp
push rsi
mov r8w, word [rsp + 0x14]
xchg qword [rsp + 0xf], r15
jmp 0x1801586bb
setg r8b
rol r14d, 0xc
pop word [rsp]
mov byte [rsp + 9], dl
xchg r8d, r15d
jmp 0x180158673
lea rcx, [r9 + riz]
rdtsc
mov ecx, 0x8e7f9ef4
mov r14w, 0x3f6f
mov byte [rsp + 9], cl
rdtsc
jmp 0x180158689
pop qword [rsp + 3]
mov r11, rax
push qword [rsp]
mov r12w, 0x5982
bswap ebx
jmp 0x180158ae7
pop qword [rsp + 5]
lea rbx, [r8 + riz]
call fcn.180158709
bswap r8
seto r14b
ror r8, cl
bswap r14d
xchg r14, r8
jmp 0x1801590ff
call 0x180158b42
and r14b, r8b
mov r14, qword [rsp + 0xd8]
lea rsp, [rsp + 0xe0]
popfq
lea rsp, [rsp + 8]
jmp 0x180158b64
mov r8, qword [rsp + 0xd0]
lea r14, [rax + r15]
mov r14, 0xfffffffff02bd897
stc
stc
mov r14, qword [rsp]
jmp 0x180158baa

Function at 0x180159a69
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov dword [rsp + 0x19], r12d
mov qword [rsp + 0x15], rdi
push word [rsp + 0x1c]
jmp 0x180159aad
mov byte [rsp + 0x25], r11b
pop qword [rsp + 0x3b]
mov byte [rsp + 0x13], r10b
jmp 0x180159a53
mov dword [rsp + 0x27], edi
mov byte [rsp + 0x15], r14b
pop word [rsp + 0x3c]
jmp 0x180159afe
pop word [rsp + 0x15]
mov dword [rsp + 9], r8d
mov qword [rsp + 0x34], rcx
jmp 0x180159a97
mov word [rsp + 0x36], bp
lea rsp, [rsp + 0x1a]
lea rsp, [rsp + 0x14]
push qword [rsp + 0x15]
lea rsp, [rsp + 1]
lea rsp, [rsp + 0x28]
jmp 0x180159ad3
Function at 0x1400074c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rsi, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.14001528c
mov r15, rax
test rax, rax
je 0x1400075d3
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, r12
call fcn.14000fdd4
test eax, eax
js 0x1400075d3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140019434
mov rbx, rax
cmp rax, rsi
jb 0x1400075ce
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
nop dword [rax]
cmp rbx, 0x2000
lea rbp, [rbx - 0x2000]
cmovb rbp, r13
sub rbx, rbp
cmp rbx, rsi
jb 0x1400075c4
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call fcn.14000fdd4
test eax, eax
js 0x1400075c4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000fa9c
cmp rax, rbx
jne 0x1400075c4
sub rbx, rsi
add rbx, 1
je 0x1400075ab
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14000c8b0
test eax, eax
je 0x1400075bd
dec rdi
sub rbx, 1
jne 0x140007590
lea rbx, [rsi - 1]
add rbx, rbp
test rbp, rbp
jne 0x140007530
jmp 0x1400075c4
lea r13, [rbp - 1]
add r13, rbx
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140015278
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14000bcb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14002b190]
test rax, rax
je 0x14000bcfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bcfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bcfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bcfa
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bcfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bcfc
xor al, al
add rsp, 0x28
ret

Function at 0x14001a4bc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a2b8
Function at 0x2fc4d8bf0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d9cd0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d95f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4d968a
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4d966e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9662
cmp qword [rbp - 0x10], 0
je 0x2fc4d9662
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9628
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d968b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9790
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d97b8
mov eax, 0
jmp 0x2fc4d9806
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d97e1
mov eax, 0
jmp 0x2fc4d9806
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9801
mov eax, 0
jmp 0x2fc4d9806
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d980c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d988a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9881
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9881
mov rax, qword [rbp - 8]
jmp 0x2fc4d989f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9854
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cdcf0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cedd0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4ce6f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4ce78a
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4ce76e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ce762
cmp qword [rbp - 0x10], 0
je 0x2fc4ce762
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ce728
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ce78b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4ce890
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ce8b8
mov eax, 0
jmp 0x2fc4ce906
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ce8e1
mov eax, 0
jmp 0x2fc4ce906
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ce901
mov eax, 0
jmp 0x2fc4ce906
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ce90c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4ce98a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4ce981
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4ce981
mov rax, qword [rbp - 8]
jmp 0x2fc4ce99f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4ce954
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140006a80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140158238]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006b55
cmp byte [rcx + 0x72], 0
je 0x140006b55
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140006b51
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006b16
sub eax, 1
je 0x140006b1a
cmp eax, 2
jne 0x140006b51
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b2f50
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006b48
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140006b51
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140006afe
xor al, al
jmp 0x140006afe
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b2f50
add rsp, 0x60
pop rbx
ret

Function at 0x140006e30
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x140158238]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea r8, [rsp + 0x20]
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140009290
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x100
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x140006f1a
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140006edc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ed7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ed7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2eb8
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], ax
mov rcx, rdi
call fcn.140001af0
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400b2f50
mov rbx, qword [rsp + 0x118]
add rsp, 0x100
pop rdi
ret
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140003e70
mov rbx, rax
mov r8, rdi
lea rdx, str.Error_while_deleting_registry_key
lea rcx, [rsp + 0x90]
call fcn.140005dc0
nop
lea r8, [0x1400c3824]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140005d50
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140005cc0
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006770
lea rdx, [0x1401392b0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140006f90
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x140158238]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
mov edx, 0x102
call fcn.140007e30
mov rbx, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140006fdb
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x140007027
mov rcx, rsi
call fcn.140001af0
nop
mov rcx, rdi
call fcn.140001af0
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400b2f50
mov rbx, qword [rsp + 0x150]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret
mov edx, ebp
lea rcx, [rsp + 0x50]
call fcn.140003e70
mov rbx, rax
mov r8, rsi
lea rdx, str.Error_while_deleting_registry_value
lea rcx, [rsp + 0x70]
call fcn.140005dc0
nop
lea r8, [0x1400c382c]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140005d50
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140005cf0
nop
lea r8, [0x1400c3824]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140005d50
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140005cc0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140006770
lea rdx, [0x1401392b0]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3