joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d6350
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d6d52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d6dea
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d6dce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6dc2
cmp qword [rbp - 0x10], 0
je 0x2fc4d6dc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6d88
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d6deb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6ef0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6f18
mov eax, 0
jmp 0x2fc4d6f66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6f41
mov eax, 0
jmp 0x2fc4d6f66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6f61
mov eax, 0
jmp 0x2fc4d6f66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x180001042
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x408
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.18000286f
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x2710
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x202
lea rdx, [rbp - 0x438]
call qword [sym.imp.ws2_32.dll_WSAStartup]
add rsp, 0x20
test rax, rax
jne 0x180001076
lea rax, [0x180004010]
mov qword [rbp - 0x440], rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x440]
lea rdx, [0x18000406c]
call fcn.1800017e2
add rsp, 0x20
test rax, rax
jne 0x180001108
lea rax, [0x180004010]
cmp qword [rbp - 0x440], rax
jne 0x1800010fa
lea rax, [0x18000403e]
mov qword [rbp - 0x440], rax
jmp 0x180001108
lea rax, [0x180004010]
mov qword [rbp - 0x440], rax
sub rsp, 0x20
mov rcx, 0x2bf20
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
jmp 0x1800010ba
Function at 0x180002010
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rbp - 0x40], 0xa
cmp qword [rbp + 0x28], 0
je 0x18000205d
mov edx, 0xffffffff
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
add rsp, 0x20
mov rsi, qword [rbp + 0x18]
jmp 0x1800020f8
sub rsp, 0x30
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
mov qword [rsp + 0x20], 0
call fcn.1800024b1
add rsp, 0x30
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp eax, 1
jne 0x180002103
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, rsi
mov r8, qword [rbp + 0x20]
mov r9, 0
call qword [sym.imp.ws2_32.dll_send]
add rsp, 0x20
test eax, eax
jle 0x180002103
sub qword [rbp + 0x20], rax
add rsi, rax
dec qword [rbp - 0x40]
je 0x180002103
cmp qword [rbp + 0x20], 0
jne 0x180002066
cmp qword [rbp + 0x28], 0
je 0x18000211c
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_SetEvent]
add rsp, 0x20
mov rax, qword [rbp + 0x20]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret

Function at 0x180002131
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x28
sub rsp, 0x30
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x60]
mov r9, qword [rbp + 0x28]
mov qword [rsp + 0x20], 0
call fcn.1800024b1
add rsp, 0x30
lea r12, [rbp - 0x48]
cmp qword [rbp + 0x28], 0
jne 0x18000218f
xor r12, r12
sub rsp, 0x30
mov rcx, 0
lea rdx, [rbp - 0x60]
mov r8, 0
mov r9, 0
mov qword [rsp + 0x20], r12
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp rax, 1
jne 0x1800021e2
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
mov r9, 0
call qword [sym.imp.ws2_32.dll_recv]
add rsp, 0x20
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x180002247
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x448
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.18000286f
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x68]
mov rdx, 0x30
call fcn.18000286f
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov dword [rbp - 0x64], eax
mov dword [rbp - 0x60], 1
mov dword [rbp - 0x5c], 6
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x68]
lea r9, [rbp - 0x70]
call qword [sym.imp.ws2_32.dll_getaddrinfo]
add rsp, 0x20
cmp rax, 0
jne 0x180002316
mov rsi, qword [rbp - 0x70]
jmp 0x180002310
cmp qword [rbp + 0x18], 2
jne 0x18000230c
cmp dword [rsi + 4], 2
jne 0x18000230c
mov rdx, qword [rsi + 0x20]
xor rax, rax
mov eax, dword [rdx + 4]
mov qword [rbp - 0x480], rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ws2_32.dll_freeaddrinfo]
add rsp, 0x20
jmp 0x180002316
mov rsi, qword [rsi + 0x28]
cmp rsi, 0
jne 0x1800022da
mov rax, qword [rbp - 0x480]
add rsp, 0x448
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret

Function at 0x180002331
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rax
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x410
sub rsp, 0x20
lea rcx, [rbp - 0x440]
mov rdx, 0x400
call fcn.18000286f
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x448]
mov rdx, 8
call fcn.18000286f
add rsp, 0x20
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x28]
xor rbx, rbx
jmp 0x1800023ba
mov al, byte [rbx + rdi]
xor byte [rsi], al
inc rsi
inc rbx
dec rcx
cmp rbx, qword [rbp + 0x18]
jne 0x1800023ba
xor rbx, rbx
cmp ecx, 0
jg 0x1800023a3
cmp qword [rbp - 0x448], 1
je 0x18000249c
movabs rax, 0xfffefdfc
mov rcx, 0x40
mov dword [rbp + rcx*4 - 0x444], eax
sub rax, 0x4040404
dec rcx
jne 0x1800023de
xor rax, rax
mov rdi, qword [rbp + 0x10]
xor rbx, rbx
mov rsi, qword [rbp + 0x18]
jmp 0x180002407
inc bl
dec rsi
je 0x1800023f7
mov dl, byte [rcx + rbp - 0x440]
add al, byte [rbx + rdi]
add al, dl
mov dh, byte [rax + rbp - 0x440]
mov byte [rcx + rbp - 0x440], dh
mov byte [rax + rbp - 0x440], dl
inc cl
jne 0x180002400
mov rdi, qword [rbp + 0x28]
mov rsi, qword [rbp + 0x20]
test rdi, rdi
je 0x18000248c
xor rax, rax
xor rdx, rdx
xor rcx, rcx
xor rbx, rbx
inc bl
mov dl, byte [rbx + rbp - 0x440]
add al, dl
mov cl, byte [rax + rbp - 0x440]
mov byte [rbx + rbp - 0x440], cl
mov byte [rax + rbp - 0x440], dl
add cl, dl
mov cl, byte [rcx + rbp - 0x440]
xor byte [rsi], cl
inc rsi
dec rdi
jne 0x180002445
xor rax, rax
lea rdi, [rbp - 0x440]
mov rcx, 0x40
cld
rep stosd dword [rdi], eax
mov qword [rbp - 0x448], 1
jmp 0x180002392
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rax
pop rbp
ret
Function at 0x180002569
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x58
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.18000286f
add rsp, 0x20
sub rsp, 0x20
mov rcx, 2
mov rdx, 1
mov r8, 6
call qword [sym.imp.ws2_32.dll_socket]
add rsp, 0x20
mov qword [rbp - 0x40], rax
sub rsp, 0x20
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp + 0x10]
mov r8, 8
call fcn.1800028aa
add rsp, 0x20
mov qword [rbp - 0x80], 1
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
mov rdx, 6
mov r8, 1
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], 8
call qword [sym.imp.ws2_32.dll_setsockopt]
add rsp, 0x30
sub rsp, 0x20
call fcn.1800027c4
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x18]
call fcn.180002525
add rsp, 0x20
cmp rax, 0
je 0x18000264b
mov rax, qword [rbp + 0x18]
jmp 0x180002674
sub rsp, 0x20
mov rcx, qword [rbp + 0x18]
mov rdx, 2
call fcn.180002247
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.ws2_32.dll_inet_ntoa]
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.ws2_32.dll_inet_addr]
add rsp, 0x20
test rax, rax
je 0x18000279f
mov dword [rbp - 0x74], eax
mov rax, qword [rbp + 0x20]
cmp rax, 0x10000
jbe 0x1800026ad
sub rsp, 0x20
mov rcx, rax
call fcn.180002936
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.ws2_32.dll_htons]
add rsp, 0x20
mov word [rbp - 0x76], ax
mov word [rbp - 0x78], 2
mov qword [rbp - 0x80], 1
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
movabs rdx, 0x8004667e
lea r8, [rbp - 0x80]
call qword [sym.imp.ws2_32.dll_ioctlsocket]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x78]
mov r8, 0x10
call qword [sym.imp.ws2_32.dll_connect]
add rsp, 0x20
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, qword [rbp + 0x28]
mov qword [rsp + 0x20], 0
call fcn.1800024b1
add rsp, 0x30
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp rax, 1
jne 0x18000279f
mov qword [rbp - 0x80], 0
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
movabs rdx, 0x8004667e
lea r8, [rbp - 0x80]
call qword [sym.imp.ws2_32.dll_ioctlsocket]
add rsp, 0x20
mov qword [rbp - 0x88], 1
sub rsp, 0x20
call fcn.1800027c4
add rsp, 0x20
mov rax, qword [rbp - 0x88]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x2fc4d7b20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d8522
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4d85ba
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4d859e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8592
cmp qword [rbp - 0x10], 0
je 0x2fc4d8592
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8558
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d85bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d86c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d86e8
mov eax, 0
jmp 0x2fc4d8736
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8711
mov eax, 0
jmp 0x2fc4d8736
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8731
mov eax, 0
jmp 0x2fc4d8736
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d873c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d87ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d87b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d87b1
mov rax, qword [rbp - 8]
jmp 0x2fc4d87cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d8784
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001000
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x58
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001067
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
add rsp, 0x58
ret
Function at 0x2fc4d56b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d60b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d614a
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d612e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6122
cmp qword [rbp - 0x10], 0
je 0x2fc4d6122
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d60e8
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d614b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6250
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6278
mov eax, 0
jmp 0x2fc4d62c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d62a1
mov eax, 0
jmp 0x2fc4d62c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d62c1
mov eax, 0
jmp 0x2fc4d62c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1406c6ef8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406c707f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406c6f29
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c6f0f
add dl, dl
jne 0x1406c6f36
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c6f96
xor eax, eax
add dl, dl
jne 0x1406c6f45
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c704d
add dl, dl
jne 0x1406c6f56
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c6f63
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c6f70
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c6f7d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406c6f8a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406c6f1e
mov eax, 1
add dl, dl
jne 0x1406c6fa6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c6fb3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c6f9b
sub eax, ebx
mov ebx, 1
jne 0x1406c6fec
mov ecx, 1
add dl, dl
jne 0x1406c6fce
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c6fdb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c6fc3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c6f1e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406c7008
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c7015
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c6ffd
cmp eax, 0x7d00
jae 0x1406c703b
cmp eax, 0x500
jb 0x1406c7036
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c6f1e
cmp eax, 0x7f
ja 0x1406c703e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c6f1e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406c7072
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406c6f1e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4e1750
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4e2152
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc506108]
test eax, eax
je 0x2fc4e21ea
lea rax, [0x2fc5060e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc506110]
mov qword [rbp - 8], rax
jmp 0x2fc4e21ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4e21c2
cmp qword [rbp - 0x10], 0
je 0x2fc4e21c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4e2188
lea rax, [0x2fc5060e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4e21eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4e22f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4e2318
mov eax, 0
jmp 0x2fc4e2366
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4e2341
mov eax, 0
jmp 0x2fc4e2366
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4e2361
mov eax, 0
jmp 0x2fc4e2366
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4e236c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4e23ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4e23e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4e23e1
mov rax, qword [rbp - 8]
jmp 0x2fc4e23ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4e23b4
mov eax, 0
add rsp, 0x20
pop rbp
ret