joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d6e90
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
lea rax, str.SCROLLX
test edx, edx
lea r11, str.SCROLLY
lea r9, [0x18017d041]
cmove r11, rax
mov rax, qword [rcx + 0xd8]
mov r10d, dword [rax + r8*4 - 4]
lea rax, [0x18017d051]
movzx r8d, byte [r11]
cmove r9, rax
not r10d
mov ebx, r10d
test r8b, r8b
je 0x1800d6f14
lea rdx, [0x18017c700]
cmp r8b, 0x23
jne 0x1800d6ef8
cmp byte [r9], r8b
jne 0x1800d6ef8
cmp byte [r9 + 1], r8b
cmove ebx, r10d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [r9]
xor rcx, rax
shr ebx, 8
inc r9
xor ebx, dword [rdx + rcx*4]
test r8b, r8b
jne 0x1800d6ee5
mov rax, qword [0x1801e3228]
not ebx
cmp dword [rax + 0x3ed4], ebx
jne 0x1800d6f34
mov r8, r11
mov edx, 0xb
mov ecx, ebx
call fcn.1800d3960
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1800d6f40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov r11, qword [0x1801e3228]
lea rax, str.SCROLLX
test ecx, ecx
movaps xmmword [rsp + 0x50], xmm7
lea r10, str.SCROLLY
movsxd rbp, ecx
cmove r10, rax
mov rdi, qword [r11 + 0x3ea0]
movzx r8d, byte [r10]
movsxd rdx, dword [rdi + 0xd0]
mov rax, qword [rdi + 0xd8]
mov r9d, dword [rax + rdx*4 - 4]
lea rdx, [r10 + 1]
not r9d
mov ebx, r9d
test r8b, r8b
je 0x1800d6fdf
lea rsi, [0x18017c700]
nop dword [rax + rax]
cmp r8b, 0x23
jne 0x1800d6fc3
cmp byte [rdx], r8b
jne 0x1800d6fc3
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x1800d6fb0
not ebx
cmp dword [r11 + 0x3ed4], ebx
jne 0x1800d6ff9
mov r8, r10
mov edx, 0xb
mov ecx, ebx
call fcn.1800d3960
movss xmm5, dword [rdi + 0x18]
mov rax, rbp
movss xmm3, dword [rdi + 0x1c]
xor rax, 1
movaps xmm4, xmm5
movaps xmm2, xmm3
addss xmm4, dword [rdi + 0x20]
addss xmm2, dword [rdi + 0x24]
movss xmm7, dword [rdi + rax*4 + 0x8c]
movups xmm1, xmmword [rdi + 0x1d8]
test ebp, ebp
jne 0x1800d7070
cmp byte [rdi + 0x95], bpl
movaps xmm0, xmm2
subss xmm0, dword [rdi + 0x54]
movss dword [rsp + 0x40], xmm1
mov edx, 0x1c0
shufps xmm1, xmm1, 0xaa
mov eax, 0x140
movss dword [rsp + 0x48], xmm1
cmovne edx, eax
movss dword [rsp + 0x4c], xmm2
subss xmm0, xmm7
maxss xmm3, xmm0
movss dword [rsp + 0x44], xmm3
jmp 0x1800d70c8
mov eax, dword [rdi + 0xc]
movaps xmm0, xmm4
subss xmm0, dword [rdi + 0x54]
and eax, 0x401
movss dword [rsp + 0x48], xmm4
cmp eax, 1
mov edx, 0x120
mov ecx, 0x100
cmovne edx, ecx
cmp byte [rdi + 0x94], 0
subss xmm0, xmm7
maxss xmm5, xmm0
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
shufps xmm1, xmm1, 0xff
movss dword [rsp + 0x4c], xmm1
movss dword [rsp + 0x44], xmm0
movss dword [rsp + 0x40], xmm5
jne 0x1800d70c8
bts edx, 7
movss xmm0, dword [rdi + rbp*4 + 0x48]
lea r9, [rsp + 0x78]
cvttss2si rax, dword [rdi + rbp*4 + 0x64]
mov dword [rsp + 0x30], edx
mov r8d, ebp
mov edx, ebx
addss xmm0, xmm0
mov qword [rsp + 0x78], rax
addss xmm0, dword [rdi + rbp*4 + 0x30]
cvttss2si rcx, xmm0
movss xmm0, dword [rdi + rbp*4 + 0x1e0]
subss xmm0, dword [rdi + rbp*4 + 0x1d8]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
cvttss2si rax, xmm0
mov qword [rsp + 0x20], rax
call fcn.1800d7150
movaps xmm7, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x78]
mov rsi, qword [r11 + 0x28]
movss dword [rdi + rbp*4 + 0x64], xmm0
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800fc450
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
call fcn.1800fc2d0
mov rcx, rax
add rsp, 0x28
jmp 0x1800fc450
push rbx
sub rsp, 0x40
mov rbx, rcx
mov byte [rcx + 0xe0], 1
mov ecx, 8
call fcn.1800ffa74
test rax, rax
je 0x1800fc472
mov qword [rax], rbx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800fba50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800fc4c9
cmp dword [rbx + 0xf0], 0
jne 0x1800fc4c2
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0xe8], xmm1
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1800fcfb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1801e7a00]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800fd014
mov eax, 0xa
jmp 0x1800fd0a7
test esi, esi
je 0x1800fd036
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800fd059
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800fd059
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800fd052
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800fd059
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fd110
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1801ad240]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800fd25c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800fd253
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x1800fd20a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1800fd20a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1800fd20a
mov rdx, qword [rdi]
test rdx, rdx
jne 0x1800fd1cb
mov dword [rdi + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1801d3178]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x1800fd232
lea rbx, [rdi + 0xc]
jmp 0x1800fd1ff
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x1800fd1ff
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rdi + 8], eax
mov rcx, qword [0x1801d3178]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1800fd232
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800fd171
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800fd24e
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x1800fd24e
mov rcx, qword [0x1801d3178]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180100210
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1800fd360
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.1800fd110
test eax, eax
jne 0x1800fd3a7
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x1800fd41e
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x1800fd406
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800fd3fa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1800fd830
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x1800fd3c0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800fd970
Capabilities:
Encode data using xor

Disassembly:
mov edx, 1
jmp 0x1800fd970
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
xor edi, edi
call fcn.1800fd0c0
cmp qword [0x1801d3178], rdi
je 0x1800fda0b
test rsi, rsi
jne 0x1800fd9da
cmp dword [0x1801e7a0c], edi
mov r8d, edi
jbe 0x1800fda10
shl bl, 2
nop word [rax + rax]
mov eax, r8d
inc r8d
imul rdx, rax, 0x38
mov rax, qword [0x1801e7a00]
movzx ecx, byte [rdx + rax + 0x20]
xor cl, bl
and cl, 4
xor byte [rdx + rax + 0x20], cl
cmp r8d, dword [0x1801e7a0c]
jb 0x1800fd9b0
jmp 0x1800fda10
mov rcx, rsi
call fcn.1800fd280
cmp eax, 0xffffffff
je 0x1800fda04
shl bl, 2
mov eax, eax
imul rdx, rax, 0x38
mov rax, qword [0x1801e7a00]
xor bl, byte [rdx + rax + 0x20]
and bl, 4
xor byte [rdx + rax + 0x20], bl
jmp 0x1800fda10
mov edi, 4
jmp 0x1800fda10
mov edi, 2
call fcn.1800fd440
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800fda30
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x1800fda9f
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x1800fda88
mov qword [rsp + 0x38], rsi
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800fda7c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x1800fda50
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1801d3178]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fe450
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x1800fe48b
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x1801e79f8]
lea rbp, [rdi + 0x40000000]
cmp rcx, rbp
cmovbe rbp, rcx
sub rbp, 0xfff
test rbx, rbx
je 0x1800fe4cd
nop dword [rax]
cmp rbx, rsi
jb 0x1800fe4c5
cmp rbx, rbp
jae 0x1800fe4c5
cmp qword [rbx + 8], 0
jne 0x1800fe5cc
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800fe4b0
mov qword [rsp + 0x78], r14
mov r14d, 0x40
mov qword [rsp + 0x80], r15
mov r15, rdi
cmp rdi, rsi
jb 0x1800fe533
nop dword [rax + rax]
mov r8d, dword [rsp + 0x48]
mov rdx, rsi
mov rcx, r15
call fcn.1800fe340
mov r15, rax
test rax, rax
je 0x1800fe52e
mov r9d, r14d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800fe57e
cmp r15, rsi
jae 0x1800fe4f0
jmp 0x1800fe533
test rbx, rbx
jne 0x1800fe57e
cmp rdi, rbp
ja 0x1800fe5bf
nop dword [rax]
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, rdi
call fcn.1800fe2a0
mov rdi, rax
test rax, rax
je 0x1800fe5bf
mov r9d, r14d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800fe57e
cmp rdi, rbp
jbe 0x1800fe540
jmp 0x1800fe5bf
xor edx, edx
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], edx
nop word [rax + rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rbx + 8], rcx
add r14, 0x40
add rcx, 0x40
mov rdx, rax
cmp r14, 0xfc0
jbe 0x1800fe590
mov rax, qword [0x1801e79f8]
mov qword [rbx], rax
mov qword [0x1801e79f8], rbx
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800ff358
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800ff392
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800ff397
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800ff3e0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180120230]
cmp byte [rcx + rax], 0
je 0x1800ff3e0
dec r8
sub rdx, 1
jne 0x1800ff3c6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x2fc4d4c80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d5682
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d571a
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d56fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d56f2
cmp qword [rbp - 0x10], 0
je 0x2fc4d56f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d56b8
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d571b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5820
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5848
mov eax, 0
jmp 0x2fc4d5896
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5871
mov eax, 0
jmp 0x2fc4d5896
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5891
mov eax, 0
jmp 0x2fc4d5896
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d589c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d591a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5911
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5911
mov rax, qword [rbp - 8]
jmp 0x2fc4d592f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d58e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dd8f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4de2f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc502108]
test eax, eax
je 0x2fc4de38a
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc502110]
mov qword [rbp - 8], rax
jmp 0x2fc4de36e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4de362
cmp qword [rbp - 0x10], 0
je 0x2fc4de362
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4de328
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4de38b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4de490
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4de4b8
mov eax, 0
jmp 0x2fc4de506
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4de4e1
mov eax, 0
jmp 0x2fc4de506
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4de501
mov eax, 0
jmp 0x2fc4de506
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4de50c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4de58a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4de581
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4de581
mov rax, qword [rbp - 8]
jmp 0x2fc4de59f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4de554
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d72a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d7ca2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4d7d3a
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4d7d1e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7d12
cmp qword [rbp - 0x10], 0
je 0x2fc4d7d12
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7cd8
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d7d3b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7e40
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7e68
mov eax, 0
jmp 0x2fc4d7eb6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7e91
mov eax, 0
jmp 0x2fc4d7eb6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7eb1
mov eax, 0
jmp 0x2fc4d7eb6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d7ebc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d7f3a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7f31
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7f31
mov rax, qword [rbp - 8]
jmp 0x2fc4d7f4f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d7f04
mov eax, 0
add rsp, 0x20
pop rbp
ret