joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180036b40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180036d60
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180036c47
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180036ba4
mov rax, qword [0x18004a008]
cmp qword [rsp + 0x20], rax
ja 0x180036ba4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180036b66
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180036bd3
jmp 0x180036c47
cmp dword [rsp + 0x50], 0x10000
jne 0x180036c2a
cmp qword [rsp + 0x48], 0x10000
jb 0x180036c2a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180036c18
mov rax, qword [rsp + 0x28]
jmp 0x180036c49
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180036c42
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180036d60
mov qword [rsp + 0x20], rax
jmp 0x180036b66
xor eax, eax
add rsp, 0x68
ret

Function at 0x180036c50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180036da0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180036d53
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180036cab
mov rax, qword [0x18004a008]
cmp qword [rsp + 0x20], rax
ja 0x180036cab
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180036c6d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180036cda
jmp 0x180036d53
cmp dword [rsp + 0x50], 0x10000
jne 0x180036d31
cmp qword [rsp + 0x48], 0x10000
jb 0x180036d31
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180036d1f
mov rax, qword [rsp + 0x28]
jmp 0x180036d55
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180036d4e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180036da0
mov qword [rsp + 0x20], rax
jmp 0x180036c6d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180036df0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180037380
mov qword [rsp + 0x28], 0
cmp qword [0x18004a6f8], 0
jne 0x180036e38
cmp qword [0x18004a6f0], 0
je 0x180036e38
mov rax, qword [0x18004a6f0]
mov qword [0x18004a6f8], rax
cmp qword [0x18004a6f8], 0
je 0x180036ede
mov rax, qword [0x18004a6f8]
cmp qword [rax + 0x10], 0
je 0x180036ede
mov rax, qword [0x18004a6f8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180036ede
mov rax, qword [0x18004a6f8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180036ede
mov rax, qword [0x18004a6f8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180036ea4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180036eab
xor eax, eax
jmp 0x180037059
mov rax, qword [0x18004a6f8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180037059
mov rax, qword [0x18004a6f0]
mov qword [0x18004a6f8], rax
jmp 0x180036f00
mov rax, qword [0x18004a6f8]
mov rax, qword [rax + 8]
mov qword [0x18004a6f8], rax
cmp qword [0x18004a6f8], 0
je 0x180036f4d
cmp qword [0x18004a6f8], 0
je 0x180036f4b
mov rax, qword [0x18004a6f8]
cmp qword [rax + 0x10], 0
je 0x180036f4b
mov rax, qword [0x18004a6f8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180036f4b
mov rax, qword [0x18004a6f8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180036f4b
jmp 0x180036e7c
jmp 0x180036eee
mov rcx, qword [rsp + 0x60]
call fcn.180038fb0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180037060
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180037057
mov rax, qword [rsp + 0x48]
mov qword [0x18004a6f8], rax
mov rax, qword [0x18004a6f8]
mov dword [rax], 0x52727464
mov rax, qword [0x18004a6f8]
mov qword [rax + 0x10], 0
mov rax, qword [0x18004a6f8]
mov rcx, qword [0x18004a6f0]
mov qword [rax + 8], rcx
mov rax, qword [0x18004a6f8]
mov qword [0x18004a6f0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18004a6f8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180037008
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180037042
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180036ffe
mov rax, qword [0x18004a6f8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180036e7c
xor eax, eax
add rsp, 0x58
ret
Function at 0x2fc52e6a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc52f780
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc52f0a2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc551108]
test eax, eax
je 0x2fc52f13a
lea rax, [0x2fc5510e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc551110]
mov qword [rbp - 8], rax
jmp 0x2fc52f11e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc52f112
cmp qword [rbp - 0x10], 0
je 0x2fc52f112
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc52f0d8
lea rax, [0x2fc5510e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc52f13b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc52f240
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc52f268
mov eax, 0
jmp 0x2fc52f2b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc52f291
mov eax, 0
jmp 0x2fc52f2b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc52f2b1
mov eax, 0
jmp 0x2fc52f2b6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52f2bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc52f33a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc52f331
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc52f331
mov rax, qword [rbp - 8]
jmp 0x2fc52f34f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc52f304
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001a20
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x140001710]
mov rcx, qword [rcx + 0x38]
mov r8, rcx
call qword [sym.imp.COMCTL32.dll_RemoveWindowSubclass]
mov r8, qword [rbx + 0x38]
lea rdx, [0x1400018b0]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.COMCTL32.dll_RemoveWindowSubclass]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.USER32.dll_DestroyWindow]
movzx edx, byte [rbx + 0x38]
movabs rcx, 0x100000001b3
mov r9, qword [0x140011bc8]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rbx + 0x39]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x3a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x3b]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x3c]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x3d]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x3e]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x3f]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
and rdx, qword [0x140011bf0]
shl rdx, 4
add rdx, qword [0x140011bd8]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x140001b21
mov rax, qword [rbx + 0x38]
mov r8, qword [rdx]
cmp rax, qword [rcx + 0x10]
je 0x140001b23
nop word [rax + rax]
cmp rcx, r8
je 0x140001b21
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140001b10
jmp 0x140001b23
xor ecx, ecx
test rcx, rcx
je 0x140001b7c
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x140001b49
cmp rax, rcx
jne 0x140001b3f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x140001b54
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x140001b54
cmp rax, rcx
jne 0x140001b54
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [0x140011bd0]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
add rsp, 0x20
pop rbx
jmp fcn.140009a80
add rsp, 0x20
pop rbx
ret

Function at 0x140001dc0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov ebx, dword [rdi + 0x2c]
xor ecx, ecx
sub ebx, dword [rdi + 0x24]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [rsp + 0x28], 0
mov r9d, ebx
mov rcx, rax
mov dword [rsp + 0x20], ebx
mov edx, 0x8c
mov r8d, 1
call qword [sym.imp.USER32.dll_LoadImageW]
mov edx, dword [rdi + 0x20]
mov r9d, ebx
mov r8d, dword [rdi + 0x24]
sub edx, ebx
mov rcx, qword [rdi]
mov dword [rsp + 0x28], 1
mov qword [rdi + 8], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9, qword [rdi + 8]
mov edx, 0x172
mov rcx, qword [rdi]
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi]
mov edx, 5
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x140002850
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x400
xor edx, edx
mov esi, eax
mov ecx, 0x1300
xor eax, eax
mov r8d, esi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbp
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
mov ecx, 0x40
add rdx, rbx
lea rdx, [rdx*2 + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140002906
mov rbx, qword [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalSize]
mov qword [rsp + 0x28], rbx
lea r8, str._s_failed_with_error__d:__s
shr rax, 1
mov r9, rbp
mov rdx, rax
mov dword [rsp + 0x20], esi
mov rcx, rdi
call fcn.140002790
mov rdx, rdi
jmp 0x14000290d
lea rdx, str.Unknown_error.
xor r9d, r9d
lea r8, str.Error
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140002e50
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x140002a00]
mov rcx, qword [rcx + 0x68]
mov r8, rcx
call qword [sym.imp.COMCTL32.dll_RemoveWindowSubclass]
mov r8, qword [rbx + 0x68]
lea rdx, [0x140002a10]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.COMCTL32.dll_RemoveWindowSubclass]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.USER32.dll_DestroyWindow]
movzx edx, byte [rbx + 0x68]
movabs rcx, 0x100000001b3
mov r9, qword [0x140011c08]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rbx + 0x69]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x6a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x6b]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x6c]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x6d]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x6e]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x6f]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
and rdx, qword [0x140011c30]
shl rdx, 4
add rdx, qword [0x140011c18]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x140002f38
mov rax, qword [rbx + 0x68]
mov r8, qword [rdx]
cmp rax, qword [rcx + 0x10]
je 0x140002f3a
cmp rcx, r8
je 0x140002f38
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140002f27
jmp 0x140002f3a
xor ecx, ecx
test rcx, rcx
je 0x140002f93
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x140002f60
cmp rax, rcx
jne 0x140002f56
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x140002f6b
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x140002f6b
cmp rax, rcx
jne 0x140002f6b
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [0x140011c10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
add rsp, 0x20
pop rbx
jmp fcn.140009a80
add rsp, 0x20
pop rbx
ret
Function at 0x140003fc0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x140011c30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [0x140011c18]
mov rax, qword [rdx + 8]
cmp rax, qword [0x140011c08]
je 0x14000407a
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x14000407d
cmp rax, rdx
je 0x14000407a
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140004060
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret
Function at 0x14000a4c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a50e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a50e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a50e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a50e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a50e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a510
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d9960
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4daa40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4da362
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4da3fa
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4da3de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da3d2
cmp qword [rbp - 0x10], 0
je 0x2fc4da3d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da398
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da3fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da500
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da528
mov eax, 0
jmp 0x2fc4da576
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da551
mov eax, 0
jmp 0x2fc4da576
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da571
mov eax, 0
jmp 0x2fc4da576
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da57c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da5fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da5f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da5f1
mov rax, qword [rbp - 8]
jmp 0x2fc4da60f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da5c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x408340
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x006f10a8], 0
je 0x4083f8
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.00410bc0
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x006bc0e8]
call fcn.00410bc0
mov rcx, rsi
mov rdx, qword [0x006bc0e8]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.00410bc0
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40840b
xor ecx, ecx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x4096d0
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x450
mov rbp, rsp
mov byte [rbp + 0x27], cl
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
nop
xor esi, esi
movzx rax, byte [rbp + 0x27]
test al, al
je 0x409763
movzx rax, byte [rbp + 0x27]
movzx ax, al
add ax, 0x40
mov word [rbp + 0x448], ax
mov word [rbp + 0x44a], 0x3a
mov word [rbp + 0x44c], 0
mov ecx, 0x104
lea rdx, [rbp + 0x38]
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
cmp esi, 0x104
jbe 0x409757
lea rcx, [rbp + 0x30]
mov edx, esi
sub edx, 1
call fcn.00411970
mov rcx, qword [rbp + 0x30]
call fcn.004116f0
mov ecx, esi
mov rdx, rax
call sub.kernel32.dll_GetCurrentDirectoryW
lea rcx, [rbp + 0x448]
call sub.kernel32.dll_SetCurrentDirectoryW
mov ecx, 0x104
lea rdx, [rbp + 0x240]
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
cmp ebx, 0x104
ja 0x409796
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x240]
mov r8d, 0x104
call fcn.004117e0
jmp 0x4097ba
mov rcx, qword [rbp + 0x28]
mov edx, ebx
sub edx, 1
call fcn.00411970
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.004116f0
mov ecx, ebx
mov rdx, rax
call sub.kernel32.dll_GetCurrentDirectoryW
movzx rax, byte [rbp + 0x27]
test al, al
je 0x4097e7
cmp esi, 0x104
jbe 0x4097de
mov rcx, qword [rbp + 0x30]
call fcn.004116f0
mov rcx, rax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x4097e7
lea rcx, [rbp + 0x38]
call sub.kernel32.dll_SetCurrentDirectoryW
nop
lea rcx, [rbp + 0x30]
call fcn.00410350
lea rsp, [rbp + 0x450]
pop rbx
pop rsi
pop rbp
ret