joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011767
Capabilities:
Parse pe header

Disassembly:
jmp 0x140023dd0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140023df0
xor al, al
jmp 0x140023e71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140023e03
xor al, al
jmp 0x140023e71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140023e2d
xor al, al
jmp 0x140023e71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140023e41
xor al, al
jmp 0x140023e71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140023e53
xor al, al
jmp 0x140023e71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140023e6f
xor al, al
jmp 0x140023e71
mov al, 1
add rsp, 0x38
ret

Function at 0x140011771
Capabilities:
Get common file path

Disassembly:
jmp 0x14001a560
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0x270], rax
mov dword [rbp + 0x244], 0
lea rcx, [0x14003e108]
call fcn.140011aa0
mov qword [rbp + 8], 0
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400307b0]
call fcn.14001146a
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x14001a6cb
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.140011370
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rax, [rbp + 0x1a8]
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x1f8]
mov qword [rbp + 0x228], rax
lea rcx, [rbp + 0x184]
call fcn.140011280
mov qword [rbp + 0x258], rax
mov rdx, qword [rbp + 0x1d8]
lea rcx, [rbp + 0x48]
call fcn.140011843
mov qword [rbp + 0x260], rax
mov rdx, qword [rbp + 0x228]
lea rcx, [rbp + 0x48]
call fcn.14001151e
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x258]
mov r9, rax
mov r8, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0x88]
call fcn.140011582
nop
lea rdx, str.MicrosoftEdgeUser_Data_
lea rcx, [rbp + 0x88]
call fcn.1400110e1
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0x2a0]
call fcn.140011a0a
mov eax, dword [rbp + 0x244]
or eax, 1
mov dword [rbp + 0x244], eax
lea rcx, [rbp + 0x88]
call fcn.1400111fe
nop
lea rcx, [rbp + 0x48]
call fcn.140011938
mov rax, qword [rbp + 0x2a0]
jmp 0x14001a6f4
lea rdx, [0x14002dcb6]
mov rcx, qword [rbp + 0x2a0]
call fcn.1400114c4
mov eax, dword [rbp + 0x244]
or eax, 1
mov dword [rbp + 0x244], eax
mov rax, qword [rbp + 0x2a0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002c4d0]
call fcn.1400118de
mov rax, rdi
mov rcx, qword [rbp + 0x270]
xor rcx, rbp
call fcn.140011528
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret
Function at 0x140011a82
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001b760
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14003e0f2]
call fcn.140011aa0
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001b7c6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b7cd
mov al, 1
jmp 0x14001b91d
call fcn.1400112f3
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.1400112f3
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.14001187a
movzx eax, al
test eax, eax
je 0x14001b81e
xor al, al
jmp 0x14001b91d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001b883
cmp dword [rbp + 0x154], 1
je 0x14001b88e
cmp dword [rbp + 0x154], 3
je 0x14001b90c
jmp 0x14001b91b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001b8de
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001b8de
xor al, al
jmp 0x14001b91d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b8f9
mov dword [rbp + 0x154], 1
jmp 0x14001b903
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001b91d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001b91d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002cd60]
call fcn.1400118de
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011528
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140011b63
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x14001a7a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x598
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xfa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5b8]
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0x558], rax
mov dword [rbp + 0x534], 0
lea rcx, [0x14003e108]
call fcn.140011aa0
lea r8, [0x14002dcb4]
mov rdx, qword [rbp + 0x588]
lea rcx, [rbp + 0x4b8]
call fcn.14001186b
mov qword [rbp + 0x548], rax
mov rcx, qword [rbp + 0x548]
call fcn.140011118
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x4b8]
call fcn.1400111fe
cmp qword [rbp + 0x168], 0xffffffffffffffff
je 0x14001aa16
mov eax, dword [rbp + 0x10]
and eax, 0x10
test eax, eax
je 0x14001a9f0
lea rdx, [rbp + 0x3c]
lea rcx, [rbp + 0x188]
call fcn.1400114c4
nop
lea rdx, [0x14002dda4]
lea rcx, [rbp + 0x188]
call fcn.1400112cb
movzx eax, al
test eax, eax
je 0x14001a9e4
lea rdx, [0x14002dda8]
lea rcx, [rbp + 0x188]
call fcn.1400112cb
movzx eax, al
test eax, eax
je 0x14001a9e4
lea r8, [rbp + 0x188]
mov rdx, qword [rbp + 0x588]
lea rcx, [rbp + 0x4f8]
call fcn.1400118ac
mov qword [rbp + 0x548], rax
mov rax, qword [rbp + 0x548]
mov qword [rbp + 0x550], rax
lea r8, [0x14002ddb0]
mov rdx, qword [rbp + 0x550]
lea rcx, [rbp + 0x1c8]
call fcn.1400119d8
nop
lea rcx, [rbp + 0x4f8]
call fcn.1400111fe
mov edx, 0x110
lea rcx, [rbp + 0x210]
call fcn.14001174e
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x210]
call fcn.14001182f
nop
mov rax, qword [rbp + 0x210]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x210]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14001a9ca
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp + 0x210]
call fcn.140011604
lea rdx, [rbp + 0x1c8]
mov rcx, qword [rbp + 0x580]
call fcn.140011a0a
mov eax, dword [rbp + 0x534]
or eax, 1
mov dword [rbp + 0x534], eax
lea rcx, [rbp + 0x210]
call fcn.1400111b8
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400111fe
nop
lea rcx, [rbp + 0x188]
call fcn.1400111fe
mov rax, qword [rbp + 0x580]
jmp 0x14001aa3f
lea rcx, [rbp + 0x210]
call fcn.1400111b8
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400111fe
nop
lea rcx, [rbp + 0x188]
call fcn.1400111fe
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14001a853
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [0x14002dcb6]
mov rcx, qword [rbp + 0x580]
call fcn.1400114c4
mov eax, dword [rbp + 0x534]
or eax, 1
mov dword [rbp + 0x534], eax
mov rax, qword [rbp + 0x580]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002c650]
call fcn.1400118de
mov rax, rdi
mov rcx, qword [rbp + 0x558]
xor rcx, rbp
call fcn.140011528
lea rsp, [rbp + 0x568]
pop rdi
pop rbp
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140017048]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x30]
mov r15d, edx
mov ebp, ecx
mov r8, qword [rax + 0x60]
mov r14, qword [r8 + 0x18]
add r14, 0x20
mov rbx, qword [r14]
cmp rbx, r14
je 0x140001173
nop dword [rax]
cmp word [rbx + 0x48], 0x3f
jae 0x140001167
mov r9, qword [rbx + 0x50]
xor r11d, r11d
xor r10d, r10d
cmp word [r9], r10w
je 0x1400010ac
nop dword [rax + rax]
cmp r11d, 0x3f
jae 0x1400010a2
movzx edx, word [r9]
movzx r8d, dl
cmp edx, 0x61
lea eax, [r8 - 0x20]
movzx ecx, al
cmovb ecx, r8d
add r9, 2
mov byte [rsp + r10 + 0x20], cl
inc r11d
inc r10
cmp word [r9], 0
jne 0x140001070
cmp r10, 0x40
jae 0x1400011aa
mov byte [rsp + r10 + 0x20], 0
lea rcx, [rsp + 0x20]
movzx eax, byte [rsp + 0x20]
mov edx, 0x811c9dc5
test al, al
je 0x1400010e6
nop word [rax + rax]
movzx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x1400010d0
cmp edx, r15d
jne 0x140001167
mov r10, qword [rbx + 0x20]
movsxd rax, dword [r10 + 0x3c]
movsxd rcx, dword [rax + r10 + 0x88]
add rcx, r10
movsxd rax, dword [rcx + 0x20]
test eax, eax
je 0x140001167
movsxd rdi, dword [rcx + 0x24]
lea r8, [r10 + rax]
movsxd rsi, dword [rcx + 0x1c]
add rdi, r10
mov r11d, dword [rcx + 0x18]
add rsi, r10
xor r9d, r9d
test r11d, r11d
je 0x140001167
nop dword [rax]
nop dword [rax + rax]
movsxd rax, dword [r8]
mov edx, 0x811c9dc5
add rax, r10
movzx ecx, byte [rax]
test cl, cl
je 0x140001157
inc rax
movzx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140001142
cmp edx, ebp
je 0x14000119c
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140001130
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140001050
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001c40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [rdi + r9*2]
movsxd rax, dword [rsi + rcx*4]
add rax, r10
jmp 0x140001175
call fcn.140001a14
int3
Function at 0x2fc4d5240
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6320
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5c42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d5cda
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5cbe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5cb2
cmp qword [rbp - 0x10], 0
je 0x2fc4d5cb2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5c78
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5cdb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5de0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5e08
mov eax, 0
jmp 0x2fc4d5e56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5e31
mov eax, 0
jmp 0x2fc4d5e56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5e51
mov eax, 0
jmp 0x2fc4d5e56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5e5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d5eda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5ed1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5ed1
mov rax, qword [rbp - 8]
jmp 0x2fc4d5eef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5ea4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1403a51b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1403a533f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1403a51e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1403a51cf
add dl, dl
jne 0x1403a51f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1403a5256
xor eax, eax
add dl, dl
jne 0x1403a5205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1403a530d
add dl, dl
jne 0x1403a5216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403a5223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403a5230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403a523d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1403a524a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1403a51de
mov eax, 1
add dl, dl
jne 0x1403a5266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403a5273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1403a525b
sub eax, ebx
mov ebx, 1
jne 0x1403a52ac
mov ecx, 1
add dl, dl
jne 0x1403a528e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1403a529b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1403a5283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1403a51de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1403a52c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1403a52d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1403a52bd
cmp eax, 0x7d00
jae 0x1403a52fb
cmp eax, 0x500
jb 0x1403a52f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1403a51de
cmp eax, 0x7f
ja 0x1403a52fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1403a51de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1403a5332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1403a51de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4d4730
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d5810
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5132
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f7108]
test eax, eax
je 0x2fc4d51ca
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f7110]
mov qword [rbp - 8], rax
jmp 0x2fc4d51ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d51a2
cmp qword [rbp - 0x10], 0
je 0x2fc4d51a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5168
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d51cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d52d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d52f8
mov eax, 0
jmp 0x2fc4d5346
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5321
mov eax, 0
jmp 0x2fc4d5346
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5341
mov eax, 0
jmp 0x2fc4d5346
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d534c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d53ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d53c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d53c1
mov rax, qword [rbp - 8]
jmp 0x2fc4d53df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5394
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400225b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400225e4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400225d0
ret
Function at 0x14002c030
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov r11, rcx
lea r10, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_recv
xor r9b, r9b
nop dword [rax]
movzx edx, r9b
lea r10, [r10 + 4]
movzx eax, r9b
add r9b, 4
movzx r8d, byte [rax + r11 + 1]
movzx eax, byte [rdx + r11]
shl eax, 8
or r8d, eax
movzx eax, byte [rdx + r11 + 2]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + r11 + 3]
shl r8d, 8
or r8d, eax
mov dword [r10 - 4], r8d
sub rcx, 1
jne 0x14002c060
mov r10b, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x20]
nop dword [rax]
mov ecx, dword [r9 + 4]
lea r9, [r9 + 4]
mov r8d, ecx
movzx eax, r10b
rol r8d, 0xe
inc r10b
mov edx, dword [rsp + rax*4 + 0x18]
mov eax, ecx
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r9 + 0x20]
add r8d, dword [r9 - 4]
mov dword [r9 + 0x3c], r8d
cmp r10b, 0x40
jb 0x14002c0b0
movups xmm0, xmmword [r11 + 0x50]
lea rax, [r11 + 0x50]
xor esi, esi
movups xmm1, xmmword [rax + 0x10]
mov qword [rsp + 0x168], rax
movups xmmword [rsp], xmm0
mov r15d, dword [rsp + 8]
lea r13d, [rsi + 0x40]
mov r12d, dword [rsp + 4]
mov ebx, dword [rsp]
mov r11d, dword [rsp + 0xc]
movups xmmword [rsp + 0x10], xmm1
mov ebp, dword [rsp + 0x18]
mov r14d, dword [rsp + 0x14]
mov edi, dword [rsp + 0x10]
mov eax, dword [rsp + 0x1c]
nop word [rax + rax]
mov ecx, edi
lea rsi, [rsi + 4]
rol ecx, 7
mov r10d, edi
ror r10d, 0xb
mov edx, edi
xor r10d, ecx
not edx
and edx, ebp
mov ecx, edi
ror ecx, 6
mov r9d, r12d
xor r10d, ecx
mov r8d, r15d
mov ecx, r14d
and ecx, edi
xor edx, ecx
lea rcx, [0x1401087e0]
add r10d, edx
mov edx, ebx
add r10d, dword [rsi + rcx - 4]
mov ecx, ebx
add r10d, dword [rsp + rsi + 0x1c]
rol ecx, 0xa
add r10d, eax
ror edx, 0xd
mov eax, ebp
xor edx, ecx
mov ebp, r14d
mov ecx, ebx
mov r14d, edi
ror ecx, 2
lea edi, [r11 + r10]
xor edx, ecx
mov r11d, r15d
mov r15d, r12d
and r9d, r11d
mov r12d, ebx
mov ecx, r15d
or ecx, r11d
and ebx, ecx
lea ecx, [r10 + rdx]
or ebx, r9d
add ebx, ecx
sub r13, 1
jne 0x14002c150
lea r8, [rsp]
mov dword [rsp + 0x1c], eax
sub r8, qword [rsp + 0x160]
lea edx, [r13 + 8]
mov rax, qword [rsp + 0x168]
mov dword [rsp], ebx
mov dword [rsp + 0x10], edi
mov dword [rsp + 0x18], ebp
mov dword [rsp + 0x14], r14d
mov dword [rsp + 8], r15d
mov dword [rsp + 4], r12d
mov dword [rsp + 0xc], r11d
nop word [rax + rax]
mov ecx, dword [r8 + rax - 0x50]
add dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x14002c220
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140037980
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140037a62
call fcn.14004f480
test al, al
jne 0x140037a62
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400379b2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.14005a6c0
test rax, rax
je 0x1400379f7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.14005a6c0
mov rsi, rax
test rax, rax
je 0x1400379f7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x140037a2b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.14004a190
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140037a10
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret