joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab080
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4ab29c
push rbp
mov rbp, rsp
sub rsp, 0x90
mov word [rsp + 0xb0], cx
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x30], 0
lea rax, [0x004cd560]
lea rbx, [rsp + 0x30]
call fcn.004a3de0
movzx ecx, word [rsp + 0xb0]
movzx edx, cx
mov esi, dword [rsp + 0xb4]
mov edi, esi
imul rdi, rax
cmp rdx, rdi
jne 0x4ab132
mov ecx, esi
mov qword [rsp + 0x38], rcx
lea rax, [0x004cd560]
mov rbx, rcx
call fcn.0044ba80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x4ab1b0
mov rbx, qword [rdx + 8]
mov r9, qword [0x00602800]
mov r10, qword [r9]
mov edx, dword [rdx + 0x10]
jmp 0x4ab257
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov eax, ecx
call fcn.0040af60
lea rcx, [0x004c3700]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0xb4]
call fcn.0040afe0
lea rcx, [0x004c3780]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x004eafe6]
mov ebx, 0x50
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.00498640
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r9
mov rbx, qword [rsp + 0xa8]
lea rcx, [0x0050a4e8]
lea rdi, [0x00696600]
lea rsi, [0x004c21c0]
lea r8, [rsp + 0x48]
mov rax, rdx
call fcn.004a2ce0
test rax, rax
je 0x4ab23d
movups xmmword [rsp + 0x60], xmm15
je 0x4ab1ff
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
lea rax, [0x004e7d93]
mov ebx, 0x24
lea rcx, [rsp + 0x60]
mov edi, 1
mov rsi, rdi
call fcn.00498640
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
add rsp, 0x90
pop rbp
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
xor edi, edi
xor esi, esi
add rsp, 0x90
pop rbp
ret
mov r11, rdx
and rdx, r10
shl rdx, 4
mov r12, qword [rdx + r9 + 8]
cmp r12, rbx
je 0x4ab292
lea rdx, [r11 + 1]
test r12, r12
jne 0x4ab257
lea rax, [0x00602800]
nop dword [rax + rax]
call fcn.0040b220
mov rdx, rax
mov rax, qword [rsp + 0x40]
jmp 0x4ab1b0
mov rdx, qword [rdx + r9 + 0x10]
jmp 0x4ab1b0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], cx
mov dword [rsp + 0x1c], edi
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, word [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.004ab080
Function at 0x4ab3c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4ab625
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rcx
cmp word [rax + 0x28], 0
jbe 0x4ab522
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xb0], rbx
mov rdx, qword [rbx + 0x20]
mov esi, dword [rax + 0x20]
mov rax, rcx
mov rbx, rsi
xor ecx, ecx
call rdx
nop
test rbx, rbx
jne 0x4ab485
mov rdx, qword [rsp + 0xa8]
movzx ecx, word [rdx + 0x28]
lea rax, [0x004d04e0]
mov rbx, rcx
nop dword [rax + rax]
call fcn.0044ba80
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0xa8]
movzx edx, word [rdx + 0x28]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rsp + 0xb0]
test rsi, rsi
je 0x4ab536
mov rbx, qword [rsi + 8]
mov r9, qword [0x00602820]
mov r10, qword [r9]
mov r11d, dword [rsi + 0x10]
nop
jmp 0x4ab5d8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
call fcn.0040b0c0
lea rcx, [0x004c3600]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x4ab4d6
mov rbx, qword [rcx + 8]
jmp 0x4ab4d9
mov rbx, rcx
mov qword [rsp + 0x88], rbx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x90], rdx
lea rax, [0x004e8fa1]
mov ebx, 0x2a
lea rcx, [rsp + 0x78]
mov edi, 2
mov rsi, rdi
call fcn.00498640
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
add rsp, 0x98
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
xor esi, esi
add rsp, 0x98
pop rbp
ret
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdx
mov rbx, qword [rsp + 0xb8]
lea rcx, [0x0050a4e8]
lea rdi, [0x00696600]
lea r8, [rsp + 0x50]
mov rax, rsi
lea rsi, [0x004c20c0]
call fcn.004a2ce0
test rax, rax
je 0x4ab5be
movups xmmword [rsp + 0x68], xmm15
je 0x4ab580
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
lea rax, [0x004e7db7]
mov ebx, 0x24
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.00498640
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
add rsp, 0x98
pop rbp
ret
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
xor edi, edi
xor esi, esi
add rsp, 0x98
pop rbp
ret
mov r12, r11
and r11, r10
shl r11, 4
mov r13, qword [r11 + r9 + 8]
cmp r13, rbx
je 0x4ab617
lea r11, [r12 + 1]
test r13, r13
jne 0x4ab5d8
lea rax, [0x00602820]
nop dword [rax]
call fcn.0040b220
mov rdx, qword [rsp + 0x38]
mov rsi, rax
mov rax, qword [rsp + 0x48]
jmp 0x4ab536
mov rsi, qword [r11 + r9 + 0x10]
nop dword [rax]
jmp 0x4ab536
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ab3c0
Function at 0x4ab9c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4abaa6
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
cmp edi, 4
jb 0x4aba5a
lea edx, [rdi - 4]
nop
cmp rbx, rdx
jge 0x4aba35
movups xmmword [rsp + 0x28], xmm15
mov eax, edx
call fcn.0040afe0
lea rcx, [0x004c3780]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x004e926b]
mov ebx, 0x2b
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.00498640
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
sub rcx, rdx
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rsi, rdx
add rax, rsi
sub rbx, rdx
call fcn.004ab660
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
movups xmmword [rsp + 0x28], xmm15
mov eax, edi
call fcn.0040afe0
lea rcx, [0x004c3780]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x004e9784]
mov ebx, 0x2d
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.00498640
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
jmp fcn.004ab9c0
Function at 0x4adaa0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae1df
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4adacd
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4add51
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4add7d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x0050b7c0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509e20]
call fcn.00436480
inc rax
cmp rax, r8
jge 0x4adda2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4addd7
lea rdi, [0x004c3680]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4adac3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4addbb
jmp 0x4add90
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004adaa0

Function at 0x4ae380
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4ae397
inc rax
cmp rax, 4
jge 0x4ae3af
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4ae394
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4ae3c0
inc rax
cmp rax, 4
jge 0x4ae3ce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4ae3f7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4ae3db
jmp 0x4ae3bd
Function at 0x2fc4d3650
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4730
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d4052
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d40ea
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d40ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d40c2
cmp qword [rbp - 0x10], 0
je 0x2fc4d40c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d4088
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d40eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d41f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4218
mov eax, 0
jmp 0x2fc4d4266
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4241
mov eax, 0
jmp 0x2fc4d4266
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4261
mov eax, 0
jmp 0x2fc4d4266
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d426c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d42ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d42e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d42e1
mov rax, qword [rbp - 8]
jmp 0x2fc4d42ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d42b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d4d40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d5e20
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5742
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d57da
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d57be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d57b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d57b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5778
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d57db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d58e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5908
mov eax, 0
jmp 0x2fc4d5956
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5931
mov eax, 0
jmp 0x2fc4d5956
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5951
mov eax, 0
jmp 0x2fc4d5956
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d595c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d59da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d59d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d59d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d59ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d59a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d6b00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d7be0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d7502
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d759a
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d757e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7572
cmp qword [rbp - 0x10], 0
je 0x2fc4d7572
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7538
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d759b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d76a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d76c8
mov eax, 0
jmp 0x2fc4d7716
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d76f1
mov eax, 0
jmp 0x2fc4d7716
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7711
mov eax, 0
jmp 0x2fc4d7716
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d771c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d779a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7791
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7791
mov rax, qword [rbp - 8]
jmp 0x2fc4d77af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d7764
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x3985d1500
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movzx edi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rsi, r8
mov r8, r9
movq xmm1, rcx
mov rcx, rdx
mov rax, qword [rax + 0x20]
mov rbp, qword [rax]
mov rbx, qword [rbp - 0x10]
lea r9, [rbp - 0x10]
cmp rbp, rbx
je 0x3985d158d
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
lea r10, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x3985d1582
mov edx, 0xe0e
nop dword [rax]
mov r11d, edx
add r10, 2
shl r11d, 6
add edx, r11d
add edx, eax
movzx eax, word [r10 - 2]
test ax, ax
jne 0x3985d1560
cmp edx, 0x18cf5f14
je 0x3985d15fd
mov r9, rbx
mov rbx, qword [r9]
cmp rbp, rbx
jne 0x3985d1548
xor eax, eax
movq xmm0, rax
mov rdx, rsi
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], 0
mov r9, qword [rsp + 0xc0]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.3985d16a0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [r9 + 0x40]
mov rax, qword [r9 + 0x30]
cmp edx, 2
je 0x3985d158d
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
cmp word [rax], di
je 0x3985d158f
add rax, 1
cmp rax, rdx
jne 0x3985d1618
jmp 0x3985d158d
Function at 0x3985d1ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [str.kernel32LoadLibrGetProcALocalAll_not_found_]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0x2c], 0
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x6c6c642e
call fcn.3985d19a0
mov byte [rsp + 0x2c], 0
mov rbx, rax
mov rax, qword [0x398691028]
mov dword [rsp + 0x28], 0x41797261
mov qword [rsp + 0x20], rax
movsxd rax, dword [rbx + 0x3c]
mov r12d, dword [rbx + rax + 0x88]
test r12d, r12d
je 0x3985d2090
lea r13, [rbx + r12]
mov esi, dword [r13 + 0x20]
mov ebp, dword [r13 + 0x18]
add rsi, rbx
test ebp, ebp
je 0x3985d20aa
mov r14, rsi
xor r15d, r15d
jmp 0x3985d1f41
add r15, 1
add r14, 4
cmp rbp, r15
je 0x3985d20c0
mov ecx, dword [r14]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x3985d1f30
mov edx, dword [r13 + 0x24]
lea rcx, [rbx + r15*2]
mov eax, dword [r13 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
mov qword [0x3986b6030], rax
mov rax, qword [0x398691030]
mov edx, 0x7373
mov byte [rsp + 0x2e], 0
xor r14d, r14d
mov dword [rsp + 0x28], 0x65726464
mov word [rsp + 0x2c], dx
mov qword [rsp + 0x20], rax
jmp 0x3985d1fb1
add r14, 1
add rsi, 4
cmp rbp, r14
je 0x3985d20b8
mov ecx, dword [rsi]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x3985d1fa0
mov edx, dword [r13 + 0x24]
lea rcx, [rbx + r14*2]
mov eax, dword [r13 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
mov qword [0x3986b6038], rax
mov rax, qword [0x398691038]
add r12, rbx
xor ebp, ebp
mov byte [rsp + 0x2a], 0
mov qword [rsp + 0x20], rax
mov eax, 0x636f
mov word [rsp + 0x28], ax
mov esi, dword [r12 + 0x20]
mov r13d, dword [r12 + 0x18]
add rsi, rbx
test r13d, r13d
jne 0x3985d202d
jmp 0x3985d20a6
add rbp, 1
add rsi, 4
cmp r13, rbp
je 0x3985d20a6
mov ecx, dword [rsi]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x3985d2020
mov edx, dword [r12 + 0x24]
lea rcx, [rbx + rbp*2]
mov eax, dword [r12 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
mov ecx, 0x4098
mov qword [0x3986b6028], rax
call fcn.3985d1e10
test rax, rax
mov qword [0x3986b6020], rax
setne al
movzx eax, al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [0x3986b6030], 0
mov qword [0x3986b6038], 0
xor eax, eax
jmp 0x3985d205a
mov qword [0x3986b6030], 0
nop dword [rax]
xor eax, eax
jmp 0x3985d1fdc
mov qword [0x3986b6030], 0
jmp 0x3985d1f74
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp 0x3985d1ea0