joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180060780
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x180140f20]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor edi, edi
lea rax, str.SystemCurrentControlSetEnumIDE
mov qword [rbp - 0x21], rax
lea rbx, [rbp - 0x21]
lea rax, str.SystemCurrentControlSetEnumSCSI
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x19], rax
mov r15d, edi
lea rax, str.qemu
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x11], rax
mov r13d, edi
lea rax, str.virtio
mov qword [rbp - 9], rax
lea rax, str.vmware
mov qword [rbp - 1], rax
lea rax, str.vbox
mov qword [rbp + 7], rax
lea rax, [0x1800fd430]
mov qword [rbp + 0xf], rax
lea rax, [0x1800fd448]
mov qword [rbp + 0x17], rax
lea rax, str.Virtual
mov qword [rbp + 0x1f], rax
nop dword [rax]
mov rdx, qword [rbx]
lea rax, [rbp - 0x41]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x49], edi
mov rcx, 0xffffffff80000002
mov dword [rbp - 0x39], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006097f
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1800608b5
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18006097f
mov eax, dword [rbp - 0x39]
lea r12d, [rax*2 + 2]
mov ecx, r12d
call fcn.1800abad8
mov r14, rax
test rax, rax
jne 0x1800608df
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18006097f
cmp dword [rbp - 0x49], 0
mov esi, edi
jbe 0x180060966
nop word [rax + rax]
mov rcx, qword [rbp - 0x41]
lea r9, [rbp - 0x29]
mov qword [rsp + 0x38], rdi
mov r8, r14
mov qword [rsp + 0x30], rdi
mov edx, esi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x29], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180060953
mov ebx, edi
lea rdi, [rbp - 0x11]
nop word [rax + rax]
mov rdx, qword [rdi]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18006095c
inc ebx
add rdi, 8
cmp ebx, 7
jb 0x180060930
test r15d, r15d
jne 0x180060962
xor edi, edi
inc esi
cmp esi, dword [rbp - 0x49]
jb 0x1800608f0
jmp 0x180060962
mov r15d, 1
mov rbx, qword [rbp - 0x31]
mov rcx, r14
call fcn.1800ab6a4
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jne 0x180060994
xor edi, edi
add rbx, 8
inc r13d
mov qword [rbp - 0x31], rbx
cmp r13d, 2
jb 0x180060830
mov eax, r15d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800871a0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800609d0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x180140f20]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x20], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [r11 - 0x40], 0
lea r8, [r11 - 0x58]
lea rcx, [r11 - 0x50]
call fcn.180060b00
nop
mov ecx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
sub ecx, ebx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180009638
nop
xor dil, dil
cmp qword [rsp + 0x58], 0
je 0x180060a6b
mov r9d, 7
lea rdx, str.Desktop
lea rcx, [rsp + 0x48]
call fcn.18000a7b8
movzx edi, dil
mov ecx, 1
cmp rax, 0xffffffffffffffff
cmovne edi, ecx
lea rcx, [rsp + 0x48]
call fcn.180009618
nop
test rbx, rbx
je 0x180060add
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, 0x1000
jb 0x180060ac3
test bl, 0x1f
je 0x180060a96
call fcn.1800aa758
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x180060aa5
call fcn.1800aa758
int3
sub rbx, rax
cmp rbx, 8
jae 0x180060ab4
call fcn.1800aa758
int3
cmp rbx, 0x27
jbe 0x180060ac0
call fcn.1800aa758
int3
mov rbx, rax
mov rcx, rbx
call fcn.180059b58
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 0
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800871a0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x180060de0
Capabilities:
Enumerate services

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push r13
push r14
push r15
sub rsp, 0x68
mov r13, rcx
mov r14, r9
mov ecx, 0xe000
mov r15, r8
call fcn.1800abad8
xor edx, edx
mov rbx, rax
test r14, r14
je 0x180060e0f
mov dword [r14], edx
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
test rbx, rbx
je 0x180060f36
mov qword [rsp + 0x48], rdx
xor eax, eax
mov r9d, 3
mov dword [rsp + 0x98], edx
mov rdi, rbx
mov dword [rsp + 0xa8], edx
mov ecx, 0xe000
rep stosb byte [rdi], al
lea rax, [rsp + 0xa8]
mov rcx, r13
mov qword [rsp + 0x40], rax
lea r8d, [r9 + 8]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xe000
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x180060e9e
mov qword [r15], rbx
mov eax, 1
jmp 0x180060f38
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x180060f20
mov ebp, dword [rsp + 0x98]
mov rcx, rbx
add ebp, 0xe000
mov edx, ebp
mov r12d, ebp
call fcn.1800aabf0
mov rsi, rax
test rax, rax
je 0x180060f2e
mov rbx, rax
mov rdi, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x48], rax
mov ecx, r12d
mov qword [rsp + 0x40], rax
rep stosb byte [rdi], al
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
lea r9d, [rdx + 3]
mov dword [rsp + 0x28], ebp
lea r8d, [rdx + 0xb]
mov rcx, r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x180060f2e
mov qword [r15], rbx
mov eax, 1
jmp 0x180060f38
mov edx, eax
lea rcx, str.ERROR:__u_n
call fcn.180060b80
mov rcx, rbx
call fcn.1800ab6a4
xor eax, eax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x90]
add rsp, 0x68
pop r15
pop r14
pop r13
pop rbx
ret

Function at 0x180061120
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x180140f20]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rsi, r8
mov qword [rsp + 0x30], 0
mov rbx, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x800
mov rdi, r9
call fcn.1800a8ae0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x104
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800611ec
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800611e1
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800611e1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1800611ee
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800871a0
add rsp, 0x850
pop rdi
pop rsi
pop rbx
ret
Function at 0x180061260
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x2c0
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1800612ad
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x180061302
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18006129b
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x18006134a
movzx eax, byte [rdi]
movzx ecx, byte [rdi + 4]
mov byte [rsp + 0x40], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x41], al
mov rax, rbx
movzx edx, word [rsp + 0x40]
cmp dword [rax + 0x194], 6
jne 0x18006133b
cmp dx, word [rax + 0x198]
jne 0x18006133b
cmp cl, byte [rax + 0x19a]
je 0x180061345
mov rax, qword [rax]
test rax, rax
jne 0x180061321
jmp 0x18006134a
mov esi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180061370
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x180140f20]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18006142d
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180061424
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
jne 0x1800613ef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x18006142f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x180061424
nop
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
je 0x1800613e3
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180061400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800871a0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x180061450
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
mov dword [rsp + 0x38], ebp
or edx, 0xffffffff
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea r9, [0x1800fd7f0]
mov qword [rsp + 0x20], rdi
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x1800e57f8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1800614d7
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rcx, str.ROOTCIMV2
mov qword [rsp + 0x60], rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x180061535
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rbp
mov rdx, rax
mov qword [rsp + 0x30], rbp
mov r10, qword [rcx]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
call qword [r10 + 0x18]
mov rcx, rbx
test eax, eax
jns 0x18006152f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x18006156e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi]
xor r9d, r9d
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x180061581
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x180061586
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x180089e38
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180089e4b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18008a4b0
lea rdx, [0x180130338]
lea rcx, [rsp + 0x20]
call fcn.1800a8e80
int3

Function at 0x1800960f4
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180148a70]
xor edx, edx
jmp fcn.180089e38

Function at 0x180096ae4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180148a70]
jmp fcn.180089e38
Function at 0x2fc500c30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc501d10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc501632
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc524108]
test eax, eax
je 0x2fc5016ca
lea rax, [0x2fc5240e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc524110]
mov qword [rbp - 8], rax
jmp 0x2fc5016ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc5016a2
cmp qword [rbp - 0x10], 0
je 0x2fc5016a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc501668
lea rax, [0x2fc5240e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5016cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5017d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5017f8
mov eax, 0
jmp 0x2fc501846
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc501821
mov eax, 0
jmp 0x2fc501846
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc501841
mov eax, 0
jmp 0x2fc501846
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc50184c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5018ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5018c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5018c1
mov rax, qword [rbp - 8]
jmp 0x2fc5018df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc501894
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc585ed0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc586fb0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc5868d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc5a9108]
test eax, eax
je 0x2fc58696a
lea rax, [0x2fc5a90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc5a9110]
mov qword [rbp - 8], rax
jmp 0x2fc58694e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc586942
cmp qword [rbp - 0x10], 0
je 0x2fc586942
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc586908
lea rax, [0x2fc5a90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc58696b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc586a70
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc586a98
mov eax, 0
jmp 0x2fc586ae6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc586ac1
mov eax, 0
jmp 0x2fc586ae6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc586ae1
mov eax, 0
jmp 0x2fc586ae6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc586aec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc586b6a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc586b61
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc586b61
mov rax, qword [rbp - 8]
jmp 0x2fc586b7f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc586b34
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400130a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x28
ret

Function at 0x140029970
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14002a440
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14002f7c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14002f7e2
mov rcx, qword [rsp + 0x40]
call fcn.14002f890
jmp 0x14002f7f9
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14002f7f9
mov rcx, qword [rsp + 0x40]
call fcn.14002f940
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14002f890
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14002f8b1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14002f935
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14002f900
mov dword [rsp + 4], 0x9908b0df
jmp 0x14002f908
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f8a4
add rsp, 0x18
ret