joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc545b10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc546bf0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc546512
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc569108]
test eax, eax
je 0x2fc5465aa
lea rax, [0x2fc5690e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc569110]
mov qword [rbp - 8], rax
jmp 0x2fc54658e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc546582
cmp qword [rbp - 0x10], 0
je 0x2fc546582
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc546548
lea rax, [0x2fc5690e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5465ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5466b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5466d8
mov eax, 0
jmp 0x2fc546726
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc546701
mov eax, 0
jmp 0x2fc546726
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc546721
mov eax, 0
jmp 0x2fc546726
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc54672c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5467aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5467a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5467a1
mov rax, qword [rbp - 8]
jmp 0x2fc5467bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc546774
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x50], 0
jmp 0x140002d97
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
cmp dword [rsp + 0x50], eax
jae 0x140002e0b
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140002b10
cmp eax, dword [rsp + 0x78]
jne 0x140002e09
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x58]
lea rcx, str.successfully_found___s____d_n
call fcn.140006c48
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x140002e0d
jmp 0x140002d8d
xor eax, eax
add rsp, 0x68
ret
Function at 0x140003030
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov dword [rsp + 0xd0], 0
lea rcx, [rsp + 0x68]
call fcn.140003390
nop
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.huorong
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], 0x64000
mov edx, 0x64000
lea rcx, [rsp + 0x38]
call fcn.1400033d0
nop
mov dword [rsp + 0x88], 0
lea rcx, [rsp + 0x38]
call fcn.140003530
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x38]
call fcn.1400035b0
lea r9, [rsp + 0x88]
mov rcx, qword [rsp + 0xe0]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400031c6
cmp dword [rsp + 0x88], 0
jbe 0x1400031c6
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.140003500
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x88]
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.1400034d0
mov rcx, qword [rsp + 0xe8]
mov r8, rcx
lea rdx, [rsp + 0x98]
mov rcx, rax
call fcn.1400035c0
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x38]
call fcn.1400034d0
mov rcx, qword [rsp + 0xf0]
mov r9, qword [rcx]
mov r8, qword [rax]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x68]
call fcn.1400041d0
jmp 0x1400030db
cmp dword [rsp + 0x88], 0
jne 0x14000322f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0
je 0x14000322f
cmp dword [rsp + 0x8c], 0x12
je 0x14000322f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, str.Failed_to_read_file_content.
lea rcx, [rsp + 0xb8]
call fcn.140002a70
lea rdx, [0x1400270c0]
lea rcx, [rsp + 0xb8]
call fcn.140007018
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x110]
call fcn.140003430
mov eax, dword [rsp + 0xd0]
or eax, 1
mov dword [rsp + 0xd0], eax
lea rcx, [rsp + 0x38]
call fcn.1400034a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400034a0
mov rax, qword [rsp + 0x110]
add rsp, 0x108
ret

Function at 0x140009be0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140009a50
Function at 0x14001a2ac
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140029060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140007f60
xor ebx, ebx
cmp qword [0x14002a168], rbx
mov rdi, rax
jne 0x14001a3bf
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14001a496
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001a496
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14002a168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14002a170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14002a178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14002a188], rax
test rax, rax
je 0x14001a3b6
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14002a180], rax
jmp 0x14001a3c6
mov rax, qword [0x14002a180]
jmp 0x14001a3cd
mov rax, qword [0x14002a180]
mov r11, qword [0x14002a188]
cmp rax, rdi
je 0x14001a434
cmp r11, rdi
je 0x14001a434
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14002a188]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14001a434
test rax, rax
je 0x14001a434
call rsi
test rax, rax
je 0x14001a42e
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001a42e
test byte [rsp + 0x40], 1
jne 0x14001a434
bts ebp, 0x15
jmp 0x14001a474
mov rcx, qword [0x14002a170]
cmp rcx, rdi
je 0x14001a474
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001a474
call rax
mov rbx, rax
test rax, rax
je 0x14001a474
mov rcx, qword [0x14002a178]
cmp rcx, rdi
je 0x14001a474
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001a474
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14002a168]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001a496
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14001a498
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000ce30
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001a7e7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140029060]
jne 0x14000ce4a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000ce46
repz ret
ror rcx, 0x10
jmp 0x14001a740
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002a230]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14002a328]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001a7c5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002a230]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001a7e7
mov rax, qword [rsp + 0x88]
mov qword [0x14002a328], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002a2c8], rax
mov rax, qword [0x14002a328]
mov qword [0x14002a1a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002a2b0], rax
mov dword [0x14002a190], 0xc0000409
mov dword [0x14002a194], 1
mov rax, qword [0x140029060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140029068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002a228], eax
mov ecx, 1
call fcn.1400182f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140023888]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002a228], 0
jne 0x14001a86e
mov ecx, 1
call fcn.1400182f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x2fc4d10b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d2190
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d1ab2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d1b4a
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d1b2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d1b22
cmp qword [rbp - 0x10], 0
je 0x2fc4d1b22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d1ae8
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d1b4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d1c50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1c78
mov eax, 0
jmp 0x2fc4d1cc6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1ca1
mov eax, 0
jmp 0x2fc4d1cc6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d1cc1
mov eax, 0
jmp 0x2fc4d1cc6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d1ccc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d1d4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d1d41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d1d41
mov rax, qword [rbp - 8]
jmp 0x2fc4d1d5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d1d14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800025c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.180001a30
mov rdx, qword [0x180004060]
mov rsi, rax
test rdx, rdx
jne 0x18000269a
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002677
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002677
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe7fe91b0
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180002672
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x180002650
cmp r8d, 0xdedf3ffb
je 0x18000267c
test r9d, r9d
jne 0x180002630
mov rcx, qword [rcx]
jmp 0x180002600
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov edx, dword [rcx + rdx*4]
add rdx, r10
mov qword [0x180004060], rdx
mov rcx, rsi
call rdx
mov rdx, qword [0x180004068]
mov rsi, rax
test rdx, rdx
jne 0x18000276a
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002747
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002747
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6795f96e
lea rax, [rdi + r9*4]
mov eax, dword [rax + r10]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x180002742
nop
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x180002720
cmp r8d, 0xdea88b44
je 0x18000274c
test r9d, r9d
jne 0x180002700
mov rcx, qword [rcx]
jmp 0x1800026d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov edx, dword [rcx + rdx*4]
add rdx, r10
mov qword [0x180004068], rdx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rdx
Function at 0x2fc4d51f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d62d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5bf2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d5c8a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5c6e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5c62
cmp qword [rbp - 0x10], 0
je 0x2fc4d5c62
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5c28
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5c8b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5d90
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5db8
mov eax, 0
jmp 0x2fc4d5e06
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5de1
mov eax, 0
jmp 0x2fc4d5e06
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5e01
mov eax, 0
jmp 0x2fc4d5e06
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5e0c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d5e8a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5e81
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5e81
mov rax, qword [rbp - 8]
jmp 0x2fc4d5e9f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5e54
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52d920
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc52ea00
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc52e322
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc550108]
test eax, eax
je 0x2fc52e3ba
lea rax, [0x2fc5500e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc550110]
mov qword [rbp - 8], rax
jmp 0x2fc52e39e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc52e392
cmp qword [rbp - 0x10], 0
je 0x2fc52e392
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc52e358
lea rax, [0x2fc5500e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc52e3bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc52e4c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc52e4e8
mov eax, 0
jmp 0x2fc52e536
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc52e511
mov eax, 0
jmp 0x2fc52e536
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc52e531
mov eax, 0
jmp 0x2fc52e536
mov eax, 1
add rsp, 0x20
pop rbp
ret