joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001cf00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 8], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x14], 0
mov qword [rbp - 0x38], 0
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x88]
mov ecx, eax
call fcn.14002af40
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x20]
mov ecx, eax
call fcn.14002af40
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 8], rax
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x24]
mov ecx, eax
call fcn.14002af40
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x18]
mov dword [rbp - 0x14], eax
jmp 0x14001d079
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
call fcn.14002af40
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14001dbc0
cmp eax, 0xa6caa1c5
je 0x14001d00b
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14001dbc0
cmp eax, 0xffe885ef
jne 0x14001d06f
mov rax, qword [rbp - 0x38]
mov r9, rax
mov r8d, 0x3a
lea rdx, str.GetReflectiveLoaderOffset
lea rcx, str._DEBUG::_s::_d__FunctionName____s_n
call fcn.140035910
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x1c]
mov ecx, eax
call fcn.14002af40
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x10]
movzx eax, word [rax]
movzx eax, ax
shl rax, 2
add qword [rbp - 0x30], rax
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x30]
mov eax, dword [rax]
mov ecx, eax
call fcn.14002af40
jmp 0x14001d08f
add qword [rbp - 8], 4
add qword [rbp - 0x10], 2
mov eax, dword [rbp - 0x14]
lea edx, [rax - 1]
mov dword [rbp - 0x14], edx
test eax, eax
jne 0x14001cfc7
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x14001db10
Capabilities:
Hash data using djb2

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov dword [rbp + 0x20], r8d
mov dword [rbp - 4], 0x1505
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x14001db40
mov eax, 0
jmp 0x14001dbab
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
mov byte [rbp - 0x11], al
cmp dword [rbp + 0x18], 0
jne 0x14001db5d
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
test al, al
jne 0x14001db7a
jmp 0x14001dba8
mov rax, qword [rbp - 0x10]
sub rax, qword [rbp + 0x10]
cmp dword [rbp + 0x18], eax
jbe 0x14001dba7
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
test al, al
jne 0x14001db7a
add qword [rbp - 0x10], 1
cmp dword [rbp + 0x20], 0
je 0x14001db8a
cmp byte [rbp - 0x11], 0x60
jbe 0x14001db8a
sub byte [rbp - 0x11], 0x20
mov eax, dword [rbp - 4]
shl eax, 5
mov edx, eax
mov eax, dword [rbp - 4]
add edx, eax
movzx eax, byte [rbp - 0x11]
add eax, edx
mov dword [rbp - 4], eax
add qword [rbp - 0x10], 1
jmp 0x14001db40
nop
mov eax, dword [rbp - 4]
add rsp, 0x20
pop rbp
ret

Function at 0x14001dbc0
Capabilities:
Hash data using djb2

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0x1505
jmp 0x14001dbea
mov eax, dword [rbp - 4]
shl eax, 5
mov edx, eax
mov eax, dword [rbp - 4]
add edx, eax
mov eax, dword [rbp - 8]
add eax, edx
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
lea rdx, [rax + 1]
mov qword [rbp + 0x10], rdx
movzx eax, byte [rax]
movsx eax, al
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x14001dbd5
mov eax, dword [rbp - 4]
add rsp, 0x10
pop rbp
ret
Function at 0x140022330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
cmp qword [rbp + 0x10], 0
je 0x14002239c
cmp dword [rbp + 0x18], 0
jne 0x1400223a6
mov eax, 0
jmp 0x14002257b
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x8c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 4], 0
jmp 0x140022547
mov eax, dword [rbp - 4]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov r8d, 1
mov edx, 0
mov rcx, rax
call fcn.14001db10
cmp dword [rbp + 0x18], eax
jne 0x140022543
mov eax, dword [rbp - 4]
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x38]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp - 0x28]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rdx, rax
mov rax, qword [rbp - 0x18]
cmp rdx, rax
jb 0x14002253d
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x20]
add rdx, rax
mov rax, qword [rbp - 0x48]
cmp rdx, rax
jbe 0x14002253d
mov rax, qword [rbp - 0x40]
mov rcx, rax
call fcn.14002cd50
mov word [rbp - 0x60], ax
movzx eax, word [rbp - 0x60]
add eax, 1
mov word [rbp - 0x5e], ax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x58], rax
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x130]
test rax, rax
je 0x140022536
mov rax, qword [0x14003d880]
mov r10, qword [rax + 0x130]
lea rdx, [rbp - 0x48]
lea rax, [rbp - 0x60]
mov r9, rdx
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call r10
test eax, eax
jns 0x14002253d
mov eax, 0
jmp 0x14002257b
mov eax, 0
jmp 0x14002257b
mov rax, qword [rbp - 0x48]
jmp 0x14002257b
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x18]
cmp dword [rbp - 4], eax
jb 0x140022431
mov eax, dword [rbp + 0x18]
mov r9d, eax
mov r8d, 0x1c0
lea rdx, str.LdrFunctionAddr
lea rcx, str._DEBUG::_s::_d__API_not_found:_FunctionHash:__lx__n
call fcn.1400351f0
mov eax, 0
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x14002af40
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x18]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 0x18]
mov rax, qword [rbp - 0x10]
movzx eax, word [rax + 0x14]
movzx eax, ax
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x14]
cmp dword [rbp + 0x10], eax
jae 0x14002af92
mov eax, dword [rbp + 0x10]
jmp 0x14002b03d
mov word [rbp - 2], 0
jmp 0x14002b026
movzx edx, word [rbp - 2]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov eax, dword [rax + 0xc]
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp + 0x10]
cmp eax, dword [rbp - 0x1c]
jb 0x14002b01b
movzx edx, word [rbp - 2]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov edx, dword [rax + 0x10]
mov eax, dword [rbp - 0x1c]
add eax, edx
cmp dword [rbp + 0x10], eax
jae 0x14002b01b
mov eax, dword [rbp + 0x10]
sub eax, dword [rbp - 0x1c]
mov ecx, eax
movzx edx, word [rbp - 2]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov eax, dword [rax + 0x14]
add eax, ecx
jmp 0x14002b03d
movzx eax, word [rbp - 2]
add eax, 1
mov word [rbp - 2], ax
mov rax, qword [rbp - 0x10]
movzx eax, word [rax + 6]
cmp word [rbp - 2], ax
jb 0x14002af9d
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x14002ced0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x14002cf43
mov byte [rbp - 2], 0
jmp 0x14002cf39
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx ecx, byte [rbp - 2]
movzx r8d, byte [rbp - 1]
cdqe
lea rdx, str.cw
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd r8, r8d
movsxd rax, ecx
shl rax, 2
add rax, r9
add rax, r8
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x14002cee8
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x14002cee2
nop
nop
add rsp, 0x10
pop rbp
ret
Function at 0x140cd9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140cd91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140cd9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cd906f
add dl, dl
jne 0x140cd9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cd90f6
xor eax, eax
add dl, dl
jne 0x140cd90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cd91ad
add dl, dl
jne 0x140cd90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cd90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cd90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cd90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140cd90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140cd907e
mov eax, 1
add dl, dl
jne 0x140cd9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cd9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cd90fb
sub eax, ebx
mov ebx, 1
jne 0x140cd914c
mov ecx, 1
add dl, dl
jne 0x140cd912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cd913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cd9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cd907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140cd9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cd9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cd915d
cmp eax, 0x7d00
jae 0x140cd919b
cmp eax, 0x500
jb 0x140cd9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cd907e
cmp eax, 0x7f
ja 0x140cd919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cd907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140cd91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140cd907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4cf270
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d0350
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4cfc72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f2108]
test eax, eax
je 0x2fc4cfd0a
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f2110]
mov qword [rbp - 8], rax
jmp 0x2fc4cfcee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cfce2
cmp qword [rbp - 0x10], 0
je 0x2fc4cfce2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cfca8
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cfd0b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cfe10
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cfe38
mov eax, 0
jmp 0x2fc4cfe86
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cfe61
mov eax, 0
jmp 0x2fc4cfe86
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cfe81
mov eax, 0
jmp 0x2fc4cfe86
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cfe8c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cff0a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cff01
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cff01
mov rax, qword [rbp - 8]
jmp 0x2fc4cff1f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cfed4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc526470
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc527550
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc526e72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc549108]
test eax, eax
je 0x2fc526f0a
lea rax, [0x2fc5490e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc549110]
mov qword [rbp - 8], rax
jmp 0x2fc526eee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc526ee2
cmp qword [rbp - 0x10], 0
je 0x2fc526ee2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc526ea8
lea rax, [0x2fc5490e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc526f0b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc527010
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc527038
mov eax, 0
jmp 0x2fc527086
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc527061
mov eax, 0
jmp 0x2fc527086
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc527081
mov eax, 0
jmp 0x2fc527086
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52708c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc52710a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc527101
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc527101
mov rax, qword [rbp - 8]
jmp 0x2fc52711f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5270d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d3a40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4b20
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d4442
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d44da
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d44be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d44b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d44b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d4478
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d44db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d45e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4608
mov eax, 0
jmp 0x2fc4d4656
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4631
mov eax, 0
jmp 0x2fc4d4656
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4651
mov eax, 0
jmp 0x2fc4d4656
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d465c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d46da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d46d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d46d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d46ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d46a4
mov eax, 0
add rsp, 0x20
pop rbp
ret