joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f8b0fe0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x40], xmm7
movups xmmword [rsp + 0x50], xmm8
movups xmmword [rsp + 0x60], xmm9
movups xmmword [rsp + 0x70], xmm10
movups xmmword [rsp + 0x80], xmm11
movss xmm11, dword [rsp + 0xe0]
mov ebp, dword [rsp + 0xe8]
mov ebx, edx
movups xmm6, xmm2
movups xmm10, xmm3
cmp edx, 2
jbe 0x6f8b1039
xorps xmm0, xmm0
comiss xmm0, xmm2
jb 0x6f8b1070
movups xmm6, xmmword [rsp + 0x30]
movups xmm7, xmmword [rsp + 0x40]
movups xmm8, xmmword [rsp + 0x50]
movups xmm9, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x80]
movups xmm10, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x6f8b0d00
mov qword [rsp + 0x28], rcx
xorps xmm7, xmm7
cvtss2sd xmm6, xmm6
cvtss2sd xmm11, xmm11
call fcn.6f8bb3c0
mov rcx, qword [rsp + 0x28]
mov esi, dword [rax]
call fcn.6f8bb3d0
cmp bpl, 1
mov edi, dword [rax]
sbb ecx, ecx
cvtsi2sd xmm9, rsi
xor r12d, r12d
and ecx, 7
cvtsi2sd xmm8, rdi
add ecx, 2
call sub.OPENGL32.dll_glBegin
movupd xmm0, xmm9
movupd xmm1, xmm8
inc r12d
addsd xmm0, xmm6
addsd xmm1, xmm7
call sub.OPENGL32.dll_glVertex2d
cvtss2sd xmm0, xmm10
movupd xmm3, xmm11
movupd xmm2, xmm0
mulsd xmm3, xmm6
movupd xmm1, xmm6
mulsd xmm2, xmm7
mulsd xmm0, xmm1
mulsd xmm7, xmm11
subsd xmm3, xmm2
addsd xmm7, xmm0
movupd xmm6, xmm3
cmp ebx, r12d
ja 0x6f8b10b2
movups xmm6, xmmword [rsp + 0x30]
movups xmm7, xmmword [rsp + 0x40]
movups xmm8, xmmword [rsp + 0x50]
movups xmm9, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x80]
movups xmm10, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6f8814b0
Function at 0x6f8b1140
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x40], xmm7
movups xmmword [rsp + 0x50], xmm8
movups xmmword [rsp + 0x60], xmm9
movups xmmword [rsp + 0x70], xmm10
movups xmmword [rsp + 0x80], xmm11
movss xmm11, dword [rsp + 0xe0]
mov ebp, dword [rsp + 0xe8]
mov ebx, edx
movups xmm6, xmm2
movups xmm10, xmm3
cmp edx, 2
jbe 0x6f8b1199
xorps xmm0, xmm0
comiss xmm0, xmm2
jb 0x6f8b11d0
movups xmm6, xmmword [rsp + 0x30]
movups xmm7, xmmword [rsp + 0x40]
movups xmm8, xmmword [rsp + 0x50]
movups xmm9, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x80]
movups xmm10, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x6f8b0d00
mov qword [rsp + 0x28], rcx
xorps xmm7, xmm7
cvtss2sd xmm6, xmm6
cvtss2sd xmm11, xmm11
call fcn.6f8bb440
mov rcx, qword [rsp + 0x28]
movsx esi, word [rax]
call fcn.6f8bb450
cmp bpl, 1
movsx edi, word [rax]
sbb ecx, ecx
cvtsi2sd xmm9, esi
xor r12d, r12d
and ecx, 7
cvtsi2sd xmm8, edi
add ecx, 2
call sub.OPENGL32.dll_glBegin
movupd xmm0, xmm9
movupd xmm1, xmm8
inc r12d
addsd xmm0, xmm6
addsd xmm1, xmm7
call sub.OPENGL32.dll_glVertex2d
cvtss2sd xmm0, xmm10
movupd xmm3, xmm11
movupd xmm2, xmm0
mulsd xmm3, xmm6
movupd xmm1, xmm6
mulsd xmm2, xmm7
mulsd xmm0, xmm1
mulsd xmm7, xmm11
subsd xmm3, xmm2
addsd xmm7, xmm0
movupd xmm6, xmm3
cmp ebx, r12d
ja 0x6f8b1214
movups xmm6, xmmword [rsp + 0x30]
movups xmm7, xmmword [rsp + 0x40]
movups xmm8, xmmword [rsp + 0x50]
movups xmm9, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x80]
movups xmm10, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6f8814b0
Function at 0x6f8b12a0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x40], xmm7
movups xmmword [rsp + 0x50], xmm8
movups xmmword [rsp + 0x60], xmm9
movups xmmword [rsp + 0x70], xmm10
movups xmmword [rsp + 0x80], xmm11
movss xmm11, dword [rsp + 0xe0]
mov ebp, dword [rsp + 0xe8]
mov ebx, edx
movups xmm6, xmm2
movups xmm10, xmm3
cmp edx, 2
jbe 0x6f8b12f9
xorps xmm0, xmm0
comiss xmm0, xmm2
jb 0x6f8b1330
movups xmm6, xmmword [rsp + 0x30]
movups xmm7, xmmword [rsp + 0x40]
movups xmm8, xmmword [rsp + 0x50]
movups xmm9, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x80]
movups xmm10, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x6f8b0d00
mov qword [rsp + 0x28], rcx
xorps xmm7, xmm7
cvtss2sd xmm6, xmm6
cvtss2sd xmm11, xmm11
call fcn.6f8bb4e0
mov rcx, qword [rsp + 0x28]
movzx esi, word [rax]
call fcn.6f8bb4f0
cmp bpl, 1
movzx edi, word [rax]
sbb ecx, ecx
cvtsi2sd xmm9, esi
xor r12d, r12d
and ecx, 7
cvtsi2sd xmm8, edi
add ecx, 2
call sub.OPENGL32.dll_glBegin
movupd xmm0, xmm9
movupd xmm1, xmm8
inc r12d
addsd xmm0, xmm6
addsd xmm1, xmm7
call sub.OPENGL32.dll_glVertex2d
cvtss2sd xmm0, xmm10
movupd xmm3, xmm11
movupd xmm2, xmm0
mulsd xmm3, xmm6
movupd xmm1, xmm6
mulsd xmm2, xmm7
mulsd xmm0, xmm1
mulsd xmm7, xmm11
subsd xmm3, xmm2
addsd xmm7, xmm0
movupd xmm6, xmm3
cmp ebx, r12d
ja 0x6f8b1374
movups xmm6, xmmword [rsp + 0x30]
movups xmm7, xmmword [rsp + 0x40]
movups xmm8, xmmword [rsp + 0x50]
movups xmm9, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x80]
movups xmm10, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6f8814b0

Function at 0x6f8b1a00
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
mov ecx, 0x11
movsx ebx, ax
call rsi
shr ebx, 0x1f
mov ecx, 0x12
shr eax, 0xe
and eax, 2
or ebx, eax
call rsi
mov ecx, 0x5b
shr eax, 0xd
and eax, 4
or ebx, eax
call rsi
mov ecx, 0x5c
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x90
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x91
shl eax, 4
and eax, 0x10
or ebx, eax
call rsi
mov ecx, 0x14
shl eax, 5
and eax, 0x20
or ebx, eax
call rsi
shl eax, 6
and eax, 0x40
or eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6f8b2080
Capabilities:
Query environment variable

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
mov r12, rcx
mov ebx, edx
call fcn.6f8bcec0
test al, al
jne 0x6f8b20d9
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
mov r8d, 0x119
lea rdx, str.src_OpenGL.cpp
movups xmm8, xmmword [rsp + 0x40]
lea rcx, str.rect.isValid__
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.6f896130
cmp bl, 1
sbb ecx, ecx
and ecx, 5
add ecx, 2
call sub.OPENGL32.dll_glBegin
mov rcx, r12
call fcn.6f8bce70
mov rcx, r12
mov esi, dword [rax]
call fcn.6f8bce80
mov rcx, r12
mov ebx, dword [rax]
cvtsi2sd xmm8, esi
call fcn.6f8bcf60
mov rcx, r12
cvtsi2sd xmm6, ebx
mov edi, dword [rax]
call fcn.6f8bcfb0
xorps xmm1, xmm1
add esi, edi
movups xmm0, xmm1
mov r12d, dword [rax]
call sub.OPENGL32.dll_glTexCoord2f
cvtsi2sd xmm7, esi
movupd xmm0, xmm8
movupd xmm1, xmm6
add ebx, r12d
call sub.OPENGL32.dll_glVertex2d
movss xmm0, dword [0x6fa259d0]
xorps xmm1, xmm1
call sub.OPENGL32.dll_glTexCoord2f
movupd xmm1, xmm6
movupd xmm0, xmm7
call sub.OPENGL32.dll_glVertex2d
cvtsi2sd xmm6, ebx
movss xmm1, dword [0x6fa259d0]
movups xmm0, xmm1
call sub.OPENGL32.dll_glTexCoord2f
movupd xmm0, xmm7
movupd xmm1, xmm6
call sub.OPENGL32.dll_glVertex2d
movss xmm1, dword [0x6fa259d0]
xorps xmm0, xmm0
call sub.OPENGL32.dll_glTexCoord2f
movupd xmm1, xmm6
movupd xmm0, xmm8
call sub.OPENGL32.dll_glVertex2d
nop
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.6f8814b0

Function at 0x6f8b25d0
Capabilities:
Query environment variable

Disassembly:
xorps xmm1, xmm1
mov rax, qword [rcx + 0x10]
movsd xmm0, qword [rax + 0xd8]
comisd xmm0, xmm1
ja 0x6f8a198a
jmp fcn.6f8b3530
ret
push r12
sub rsp, 0x20
mov r12, rcx
lea rcx, str.DPF_SCALE_FACTOR
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x6f8b25fc
call sub.msvcrt.dll_atof
maxsd xmm0, qword [0x6fa256f8]
jmp 0x6f8b2617
test r12, r12
je 0x6f8b260f
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x6f8a1970
movsd xmm0, qword [0x6fa256f8]
add rsp, 0x20
pop r12
ret

Function at 0x6f8b6820
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x6f8b6841
mov r8d, 0xf2
lea rdx, str..._.._dpf_distrho_extra_String.hpp
lea rcx, [0x6fa24c5a]
jmp fcn.6f896110
cmp byte [rcx + 0x10], 0
je 0x6f8b684f
mov rcx, r8
jmp sub.msvcrt.dll_free
ret

Function at 0x6f8b6850
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x6f8b6878
mov r9d, 0xf2
lea r8, str.src_.._.._distrho_extra_String.hpp
lea rdx, str.fBuffer___nullptr
lea rcx, [0x6fa27ab1]
jmp fcn.6f899310
cmp byte [rcx + 0x10], 0
je 0x6f8b6886
mov rcx, r8
jmp sub.msvcrt.dll_free
ret
Function at 0x6f8d6be0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x40], xmm7
mov r12, rdx
mov rbx, r8
mov rdi, rcx
mov edx, 1
mov rcx, r12
call fcn.6f8d8160
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov esi, 1
xorps xmm7, xmm7
call fcn.6f8d6370
mov ebp, 8
mov r14d, 1
xorps xmm6, xmm6
mov r13, rax
rdtsc
mov eax, eax
shl rdx, 0x20
or rdx, rax
xor eax, eax
mov r15, rdx
mov r8, qword [r12]
mov dword [rsp + 0x2c], eax
mov rdx, rbx
mov rcx, r12
call qword [r8]
mov eax, dword [rsp + 0x2c]
inc eax
cmp eax, esi
jne 0x6f8d6c47
rdtsc
shl rdx, 0x20
mov eax, eax
or rdx, rax
cvtsi2sd xmm1, rdx
jns 0x6f8d6c89
mov rcx, rdx
and edx, 1
shr rcx, 1
or rcx, rdx
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
cvtsi2sd xmm0, r15
test r15, r15
jns 0x6f8d6ca9
mov rcx, r15
and r15d, 1
shr rcx, 1
or rcx, r15
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
mov rax, qword [rdi + 0x10]
subsd xmm1, xmm0
test rax, rax
je 0x6f8d6cc5
mov r8d, 1
mov rcx, rbx
call rax
movupd xmm1, xmm0
comisd xmm7, xmm1
ja 0x6f8d6c19
comisd xmm6, xmm1
ja 0x6f8d6cda
test r14d, r14d
je 0x6f8d6cde
movupd xmm6, xmm1
mov r8, r13
mov rdx, rbx
mov rcx, rdi
call fcn.6f8d6170
comisd xmm0, xmmword [0x6fa28208]
ja 0x6f8d6d01
xor r14d, r14d
dec ebp
jne 0x6f8d6c37
comisd xmm6, xmmword [0x6fa28210]
jb 0x6f8d6d3c
xor edx, edx
mov rcx, r12
call fcn.6f8d8160
cvtsi2sd xmm0, esi
movups xmm7, xmmword [rsp + 0x40]
divsd xmm6, xmm0
movupd xmm0, xmm6
movups xmm6, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add esi, esi
jmp 0x6f8d6c21

Function at 0x6f8dcee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov qword [rdx], rcx
mov r10, rdx
mov edx, dword [rsp + 0x50]
mov rcx, r8
mov r11, r8
call fcn.6f9c7a60
mov r8d, eax
cmp eax, 0xffffffff
je 0x6f8dcf10
mov rdx, r11
mov rcx, r10
add rsp, 0x28
jmp fcn.6f9ca390
xor eax, eax
add rsp, 0x28
ret
Function at 0x2fc4d7570
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d7f72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4d800a
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4d7fee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7fe2
cmp qword [rbp - 0x10], 0
je 0x2fc4d7fe2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7fa8
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d800b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8110
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8138
mov eax, 0
jmp 0x2fc4d8186
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8161
mov eax, 0
jmp 0x2fc4d8186
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8181
mov eax, 0
jmp 0x2fc4d8186
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d818c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d820a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d8201
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d8201
mov rax, qword [rbp - 8]
jmp 0x2fc4d821f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d81d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d83e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d8de2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4d8e7a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4d8e5e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8e52
cmp qword [rbp - 0x10], 0
je 0x2fc4d8e52
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8e18
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d8e7b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8f80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8fa8
mov eax, 0
jmp 0x2fc4d8ff6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8fd1
mov eax, 0
jmp 0x2fc4d8ff6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8ff1
mov eax, 0
jmp 0x2fc4d8ff6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d8ffc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d907a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9071
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9071
mov rax, qword [rbp - 8]
jmp 0x2fc4d908f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9044
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d30c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d3ac2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d3b5a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d3b3e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d3b32
cmp qword [rbp - 0x10], 0
je 0x2fc4d3b32
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d3af8
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d3b5b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d3c60
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d3c88
mov eax, 0
jmp 0x2fc4d3cd6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d3cb1
mov eax, 0
jmp 0x2fc4d3cd6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3cd1
mov eax, 0
jmp 0x2fc4d3cd6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d3cdc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d3d5a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d3d51
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d3d51
mov rax, qword [rbp - 8]
jmp 0x2fc4d3d6f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d3d24
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ddc10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4de612
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc503108]
test eax, eax
je 0x2fc4de6aa
lea rax, [0x2fc5030e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc503110]
mov qword [rbp - 8], rax
jmp 0x2fc4de68e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4de682
cmp qword [rbp - 0x10], 0
je 0x2fc4de682
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4de648
lea rax, [0x2fc5030e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4de6ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4de7b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4de7d8
mov eax, 0
jmp 0x2fc4de826
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4de801
mov eax, 0
jmp 0x2fc4de826
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4de821
mov eax, 0
jmp 0x2fc4de826
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4de82c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4de8aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4de8a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4de8a1
mov rax, qword [rbp - 8]
jmp 0x2fc4de8bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4de874
mov eax, 0
add rsp, 0x20
pop rbp
ret