joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a6c4c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400eb340]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400a6ca3
cmp word [rdx], r13w
jne 0x1400a6ca3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400a6ca8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400a6dcd
mov r11d, reloc.WS2_32.dll_listen
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400a6dee
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400a6ce1
mov rdx, r9
mov word [rbx], cx
jmp 0x1400a6d08
cmp r9, r8
jae 0x1400a6d18
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400a6cc2
jmp 0x1400a6dcd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a6dc2
cmp dword [rsp + 0x80], esi
je 0x1400a6dc2
lea r8, [0x1400eb340]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400a6d9a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400a6d6a
mov word [rbx], r13w
jmp 0x1400a6dca
mov ecx, reloc.WS2_32.dll_listen
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400a6d77
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400a6dca
cmp word [rsp + 0x70], r13w
jne 0x1400a6da7
cmp rbx, r14
je 0x1400a6d64
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400a52e0
cmp word [rsp + 0x70], r13w
je 0x1400a6dcd
mov ecx, reloc.WS2_32.dll_listen
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400eb340]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400a6dc7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400a6dcd
Function at 0x1400abc54
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400abc6a
mov al, 1
jmp 0x1400abcca
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400abc7b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400abcc8
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400ac710
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400abcc8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400abcc8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400abcc8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400abcca
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400ac820
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400a52e0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400a52e0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400ac970
cmp rax, 0xffffffffffffffff
je 0x1400ac970
xor edi, edi
test rbp, rbp
jle 0x1400ac91b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400a95c4
mov rbx, rax
test rax, rax
jne 0x1400ac8a8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400ac911
mov edx, 0x8000
mov ecx, r14d
call fcn.1400a6884
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400a8004
cmp eax, 0xffffffff
je 0x1400ac8f1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400ac8b8
mov edx, r15d
mov ecx, r14d
call fcn.1400a6884
jmp 0x1400ac911
cmp byte [rsi + 0x38], dil
je 0x1400ac908
cmp dword [rsi + 0x34], 5
jne 0x1400ac908
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x1400ac911
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400a963c
jmp 0x1400ac984
jns 0x1400ac984
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400a52e0
cmp rax, 0xffffffffffffffff
jne 0x1400ac93c
cmp byte [rsi + 0x30], dil
je 0x1400ac984
mov edi, dword [rsi + 0x2c]
jmp 0x1400ac984
mov ecx, r14d
call fcn.1400ac710
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400ac984
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x1400ac984
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400ac97d
mov eax, dword [rsi + 0x2c]
jmp 0x1400ac982
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400a52e0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400b0200
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400b0230
xor eax, eax
jmp 0x1400b02f3
mov rbp, rbx
cmp word [rax], si
je 0x1400b0255
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400b023c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400b0238
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400ad1bc
movsxd r14, eax
test eax, eax
jne 0x1400b0293
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400b0229
mov rcx, r14
call fcn.1400aa220
mov rdi, rax
test rax, rax
jne 0x1400b02ac
xor ecx, ecx
call fcn.1400a963c
jmp 0x1400b0288
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400ad1bc
test eax, eax
jne 0x1400b02dd
mov rcx, rdi
call fcn.1400a963c
jmp 0x1400b02e7
xor ecx, ecx
call fcn.1400a963c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400b0310
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400b0397
mov rsi, rbx
cmp word [rax], bp
je 0x1400b0356
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400b0340
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400b033c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400aa220
mov rdi, rax
test rax, rax
je 0x1400b0384
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400b68b0
mov rbp, rdi
xor ecx, ecx
call fcn.1400a963c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b1650
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400b1670
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14009a494
or eax, 0xffffffff
jmp 0x1400b1672
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400b3520
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400e9700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400b356a
call fcn.14009a500
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.14009a520
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.1400977d0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008f080
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400b3575
lea eax, [rbx + 1]
jmp 0x1400b3557
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400b3555
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400b3557

Function at 0x1400b64e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b6508
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b6508
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001001
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140008940]
mov rcx, qword [0x1400088e0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x140008950]
cmp word [rcx], 0x5a4d
mov dword [rax], 1
mov rax, qword [0x140008960]
mov dword [rax], 1
jne 0x140001083
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001083
mov ecx, dword [rax + 0x18]
cmp cx, 0x10b
je 0x14000105e
cmp cx, 0x20b
je 0x14000106d
jmp 0x140001083
cmp dword [rax + 0x74], 0xe
jbe 0x140001083
cmp dword [rax + 0xe8], 0
jmp 0x14000107d
cmp dword [rax + 0x84], 0xe
jbe 0x140001083
cmp dword [rax + 0xf8], 0
setne dl
movzx edx, dl
mov rax, qword [0x140008930]
mov dword [0x14000b00c], edx
mov ecx, 2
cmp dword [rax], 0
jne 0x14000109f
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140008a10]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400089f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140008890]
cmp dword [rax], 1
jne 0x1400010e1
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001775
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov r9d, 0
mov r8d, 0
lea rax, [sym.KeyboardProc]
mov rdx, rax
mov ecx, 0xd
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExA]
call rax
mov qword [0x14000b030], rax
jmp 0x1400017da
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
lea rax, [rbp - 0x30]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
jg 0x1400017ba
mov rax, qword [0x14000b030]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call rax
mov eax, 0
add rsp, 0x50
pop rbp
ret

Function at 0x140001a94
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000b0b8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000b0b4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140001ae2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140001ada
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001bc9
inc ebx
add rax, 0x28
jmp 0x140001aba
mov rcx, r12
call sym.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
jne 0x140001b01
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
movsxd rbx, ebx
mov rax, qword [0x14000b0b8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call sym._GetPEImageBase
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000b0b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140001b63
mov rax, qword [0x14000b0b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001bc3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001bc3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000b0b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001bc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
inc dword [0x14000b0b4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001ff0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14000b120]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000b100]
test rbx, rbx
je 0x14000203c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140002036
test eax, eax
jne 0x140002036
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x14000200e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400021f0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002213
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140002213
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002214
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000224e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140002245
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140002250
inc r8d
add rax, 0x28
jmp 0x14000222c
xor eax, eax
ret

Function at 0x1400022c1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400088e0]
mov r8, rcx
mov rcx, r9
call sym._ValidateImageBase
test eax, eax
je 0x1400022ed
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp sym._FindPESection
xor eax, eax
add rsp, 0x28
ret
Function at 0x2fc4c6f40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c7942
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ec108]
test eax, eax
je 0x2fc4c79da
lea rax, [0x2fc4ec0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ec110]
mov qword [rbp - 8], rax
jmp 0x2fc4c79be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c79b2
cmp qword [rbp - 0x10], 0
je 0x2fc4c79b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c7978
lea rax, [0x2fc4ec0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c79db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c7ae0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c7b08
mov eax, 0
jmp 0x2fc4c7b56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c7b31
mov eax, 0
jmp 0x2fc4c7b56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c7b51
mov eax, 0
jmp 0x2fc4c7b56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c7b5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c7bda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c7bd1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c7bd1
mov rax, qword [rbp - 8]
jmp 0x2fc4c7bef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c7ba4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180003c50
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x18
call fcn.18003f400
sub rsp, rax
mov rax, qword [0x180097088]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r11, rcx
mov r9d, edx
test edx, edx
jne 0x180003c8d
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.18003e960
add rsp, 0x18
ret
mov r8, qword [r8]
xor edx, edx
mov qword [rsp], r8
movzx eax, byte [rsp + 1]
movzx ecx, r8b
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
mov eax, ecx
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x180003d24
cmp qword [rax + 8], r8
je 0x180003d24
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x180003d13
test r10, r10
je 0x180003d2c
mov dword [r10], ecx
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.18003e960
add rsp, 0x18
ret
Function at 0x1800041d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x420
call fcn.18003f400
sub rsp, rax
mov rax, qword [0x180097088]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x3c0
call fcn.180042f00
xor eax, eax
xor edx, edx
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], rax
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], rax
lea r8, [0x180073ff0]
nop dword [rax]
movzx ecx, byte [rdx + r8]
inc rdx
movzx eax, cl
xor cl, 0x5c
xor al, 0x36
mov byte [rsp + rdx + 0x3df], cl
mov byte [rsp + rdx + 0x1f], al
cmp rdx, 0x10
jb 0x180004250
lea rdx, [0x180004800]
lea rcx, [0x1800a6bd0]
call fcn.18000cb10
mov rax, qword [0x1800a6bc0]
mov dword [rsp + 0x34], 0x2b0c
mov ecx, dword [rax + 0x60]
mov dword [rsp + 0x30], ecx
call fcn.18000cb70
mov dword [rsp + 0x38], eax
call fcn.18000c9b0
lea rdx, [0x180004800]
lea rcx, [0x1800a6bd0]
mov dword [rsp + 0x3c], eax
call fcn.18000cb10
mov rax, qword [0x1800a6bc0]
mov qword [rsp + 0x48], rbx
mov rcx, qword [rax + 0x38]
xor ebx, ebx
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
nop dword [rax + rax]
lea rdx, [0x180004800]
lea rcx, [0x1800a6bd0]
call fcn.18000cb10
mov rax, qword [0x1800a6bc0]
mov rcx, qword [rax + 0x28]
movsxd rax, dword [rcx]
cmp rbx, rax
jae 0x18000439a
lea rdx, [0x180004800]
lea rcx, [0x1800a6bd0]
call fcn.18000cb10
mov rax, qword [0x1800a6bc0]
xor edx, edx
mov r9, qword [rax + 0x28]
movsxd r8, dword [r9]
test r8, r8
jle 0x180004349
lea rax, [r9 + 8]
mov rcx, qword [rax]
cmp dword [rcx], ebx
je 0x180004353
inc rdx
add rax, 8
cmp rdx, r8
jl 0x180004336
mov eax, 0x65
jmp 0x1800043fe
mov rcx, qword [r9 + rdx*8 + 8]
inc rbx
add rdi, 0x1c
mov rax, qword [rcx + 0x148]
mov qword [rdi - 0x2c], rax
mov rax, qword [rcx + 0x150]
mov qword [rdi - 0x24], rax
mov eax, dword [rcx + 0x298]
mov dword [rdi - 0x1c], eax
mov eax, dword [rcx + 0x290]
mov dword [rdi - 0x18], eax
mov eax, dword [rcx + 0x294]
mov dword [rdi - 0x14], eax
cmp rbx, 0x20
jb 0x1800042e0
movabs rcx, 0xb3b3b3b3b3b3b3b3
lea rdx, [rsp + 0x20]
mov r8d, 0x3c0
mov qword [rsp + 0x3d0], rcx
mov qword [rsp + 0x3d8], rcx
lea rcx, [rsp + 0x3f0]
call fcn.180004530
movabs rcx, 0x2020202020202020
lea rdx, [rsp + 0x3e0]
mov qword [rsp + 0x3f0], rcx
mov qword [rsp + 0x3f8], rcx
mov r8d, 0x30
mov rcx, rsi
call fcn.180004530
xor eax, eax
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.18003e960
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180004430
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x50
call fcn.18003f400
sub rsp, rax
mov rax, qword [0x180097088]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.18004ce74
lea rdx, [0x180073ee0]
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [0x1800a78c8]
test eax, eax
jne 0x18000449c
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1800041d0
test eax, eax
jne 0x180004516
mov rax, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
mov rdx, rbx
mov ecx, 0x2b0c
call qword [rax + 8]
test eax, eax
je 0x1800044b6
mov ecx, eax
call fcn.180003860
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18003e960
add rsp, 0x50
pop rbx
ret
xor r8b, r8b
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rsp + rax + 0x3b]
movzx ecx, byte [rsp + rax + 0x3a]
add rax, 4
xor cl, byte [rsp + rax + 0x26]
xor dl, byte [rsp + rax + 0x27]
or dl, cl
movzx ecx, byte [rsp + rax + 0x35]
xor cl, byte [rsp + rax + 0x25]
or dl, cl
movzx ecx, byte [rsp + rax + 0x24]
xor cl, byte [rsp + rax + 0x34]
or dl, cl
or r8b, dl
cmp rax, 0x10
jb 0x1800044c0
test r8b, r8b
je 0x180004514
mov eax, 0x67
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18003e960
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18003e960
add rsp, 0x50
pop rbx
ret