joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018510
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018620
lea r14, [rbx + 0x68]
mov rcx, r14
call fcn.140016f20
cmp esi, dword [rbx + 0x48]
jae 0x1400185a0
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r14
mov byte [rax + rsi], 1
call fcn.140016f60
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx + 0x50]
lea r15d, [rsi + 1]
movsxd r13, r15d
lea rdx, [r13*8]
call sub.msvcrt.dll_realloc
test rax, rax
mov rdi, rax
je 0x14001862d
mov rcx, qword [rbx + 0x58]
mov rdx, r13
movq xmm6, rdi
call sub.msvcrt.dll_realloc
movq xmm0, rax
test rax, rax
mov r13, rax
punpcklqdq xmm6, xmm0
je 0x14001862d
mov eax, dword [rbx + 0x48]
mov edx, r15d
lea rcx, [rdi + rax*8]
sub edx, eax
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov edx, dword [rbx + 0x48]
mov r8d, r15d
lea rcx, [r13 + rdx]
sub r8d, edx
xor edx, edx
call sub.msvcrt.dll_memset
movaps xmmword [rbx + 0x50], xmm6
mov dword [rbx + 0x48], r15d
jmp 0x140018564
call fcn.1400177c0
mov rbx, rax
jmp 0x14001854f
mov rcx, r14
call fcn.140016f60
mov eax, 0xc
jmp 0x140018582

Function at 0x1400186b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400186d8
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.1400177c0
test rax, rax
jne 0x1400186ca
add rsp, 0x28
ret

Function at 0x140018740
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018768
add rax, 0x18
add rsp, 0x28
ret
call fcn.1400177c0
test rax, rax
jne 0x14001875a
jmp 0x14001875e

Function at 0x140018880
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400e0d28]
test eax, eax
jne 0x140018898
xor eax, eax
add rsp, 0x28
ret
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400188c8
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x14001888e
test byte [rax + 0x40], 3
je 0x14001888e
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140018890
call fcn.1400177c0
test rax, rax
jne 0x1400188ae
jmp 0x14001888e
Function at 0x1400188e0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018920
test ebx, ebx
jle 0x140018910
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.1400177c0
test rax, rax
jne 0x1400188fd
add rsp, 0x20
pop rbx
ret

Function at 0x140018a10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018a88
test byte [rbx + 0x40], 0xc
jne 0x140018a3f
mov eax, dword [0x1400e0d28]
test eax, eax
jne 0x140018a50
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140016920
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140018a73
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140018a73
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140018a9c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140016c10
call fcn.1400177c0
test rax, rax
mov rbx, rax
jne 0x140018a2f
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140018aba
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140016c10
call fcn.140018930
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140018b40
call fcn.1400166e0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140018b78
call fcn.140017710
mov ecx, dword [0x1400b2158]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018bd0
test esi, esi
je 0x140018b56
call fcn.140018a10
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018bb0
mov edx, edi
call fcn.140016790
call fcn.140018a10
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018bc0
call fcn.140018a10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018a10
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017710
mov ecx, dword [0x1400b2158]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x140018b15
call fcn.1400177c0
mov rbx, rax
jmp 0x140018b15
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018b2e
call fcn.1400177c0
jmp 0x140018b56
call fcn.1400177c0
mov rbx, rax
jmp 0x140018b11
Function at 0x140018ad0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018a88
test byte [rbx + 0x40], 0xc
jne 0x140018a3f
mov eax, dword [0x1400e0d28]
test eax, eax
jne 0x140018a50
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140016920
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140018a73
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140018a73
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140018a9c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140016c10
call fcn.1400177c0
test rax, rax
mov rbx, rax
jne 0x140018a2f
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140018aba
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140016c10
call fcn.140018930
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140018b40
call fcn.1400166e0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140018b78
call fcn.140017710
mov ecx, dword [0x1400b2158]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018bd0
test esi, esi
je 0x140018b56
call fcn.140018a10
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018bb0
mov edx, edi
call fcn.140016790
call fcn.140018a10
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018bc0
call fcn.140018a10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018a10
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017710
mov ecx, dword [0x1400b2158]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x140018b15
call fcn.1400177c0
mov rbx, rax
jmp 0x140018b15
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018b2e
call fcn.1400177c0
jmp 0x140018b56
call fcn.1400177c0
mov rbx, rax
jmp 0x140018b11

Function at 0x140018be0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140017710
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018c50
test esi, esi
je 0x140018c30
call fcn.140018a10
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018c60
mov edx, esi
call fcn.140016790
call fcn.140018a10
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140018a10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018a10
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1400177c0
mov rbx, rax
jmp 0x140018c01
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018c1a
Function at 0x1400772a0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x1400772c7
call rbp
cmp dword [rax], 4
jne 0x1400772e4
mov rcx, rdi
call fcn.1400770d0
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
movsxd r12, eax
je 0x1400772c0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1800021ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov r14d, edx
mov r8d, dword [rax + rcx + 0x88]
mov ebp, dword [r8 + rcx + 0x1c]
mov r10d, dword [r8 + rcx + 0x20]
mov esi, dword [r8 + rcx + 0x24]
add r10, rcx
add rsi, rcx
lea rdi, [rcx + rbp]
xor ecx, ecx
test ebp, ebp
je 0x18000227a
mov r8d, dword [r10]
mov r11d, 0x35
add r8, r9
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [r8 + rdx], 0
jne 0x180002242
xor ebx, ebx
test rdx, rdx
je 0x18000226b
movsx eax, byte [r8]
lea r11d, [r11 + r11*2]
inc ebx
add r11d, eax
movsxd rax, ebx
inc r8
cmp rax, rdx
jb 0x180002253
cmp r11d, r14d
je 0x180002293
inc ecx
add r10, 4
cmp ecx, ebp
jb 0x180002232
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
movzx ecx, word [rsi + rcx*2]
mov eax, dword [rdi + rcx*4]
add rax, r9
jmp 0x18000227c
Function at 0x18000fdd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18000fca7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000fca7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18000fca7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18000fca7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18000fca7
cmp dword [rcx + 0x84], 0xe
jbe 0x18000fca7
cmp dword [rcx + 0xf8], 0
je 0x18000fca7
mov ecx, ebx
call fcn.18000fd48
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.18000fb38
cmp dword [rbp + 0x20], 0
je 0x18000fcf4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18000fcfc
int3
xor r8d, r8d
xor edx, edx
jmp 0x18000fc40
Function at 0x2fc54d890
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc54e970
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc54e292
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc570108]
test eax, eax
je 0x2fc54e32a
lea rax, [0x2fc5700e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc570110]
mov qword [rbp - 8], rax
jmp 0x2fc54e30e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc54e302
cmp qword [rbp - 0x10], 0
je 0x2fc54e302
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc54e2c8
lea rax, [0x2fc5700e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc54e32b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc54e430
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc54e458
mov eax, 0
jmp 0x2fc54e4a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc54e481
mov eax, 0
jmp 0x2fc54e4a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc54e4a1
mov eax, 0
jmp 0x2fc54e4a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc54e4ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc54e52a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc54e521
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc54e521
mov rax, qword [rbp - 8]
jmp 0x2fc54e53f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc54e4f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d2940
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d3a20
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d3342
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f5108]
test eax, eax
je 0x2fc4d33da
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f5110]
mov qword [rbp - 8], rax
jmp 0x2fc4d33be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d33b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d33b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d3378
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d33db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d34e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d3508
mov eax, 0
jmp 0x2fc4d3556
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d3531
mov eax, 0
jmp 0x2fc4d3556
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3551
mov eax, 0
jmp 0x2fc4d3556
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d355c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d35da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d35d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d35d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d35ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d35a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53a520
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc53b600
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc53af22
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc55d108]
test eax, eax
je 0x2fc53afba
lea rax, [0x2fc55d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc55d110]
mov qword [rbp - 8], rax
jmp 0x2fc53af9e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc53af92
cmp qword [rbp - 0x10], 0
je 0x2fc53af92
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc53af58
lea rax, [0x2fc55d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53afbb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc53b0c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc53b0e8
mov eax, 0
jmp 0x2fc53b136
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc53b111
mov eax, 0
jmp 0x2fc53b136
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc53b131
mov eax, 0
jmp 0x2fc53b136
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53b13c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc53b1ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc53b1b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc53b1b1
mov rax, qword [rbp - 8]
jmp 0x2fc53b1cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc53b184
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d7250
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d8330
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d7c52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d7cea
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d7cce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7cc2
cmp qword [rbp - 0x10], 0
je 0x2fc4d7cc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7c88
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d7ceb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7df0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7e18
mov eax, 0
jmp 0x2fc4d7e66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7e41
mov eax, 0
jmp 0x2fc4d7e66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7e61
mov eax, 0
jmp 0x2fc4d7e66
mov eax, 1
add rsp, 0x20
pop rbp
ret