joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bf970
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read_1
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1401bf9b8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1401bf98a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1401d2320
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1401d2348
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read_1
test eax, eax
jle 0x1401d2390
cdqe
add rsi, rax
sub rbx, rax
jne 0x1401d2360
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1401d239c
call rbp
cmp dword [rax], 4
je 0x1401d2360
lea rcx, str.random_device_could_not_be_read
call fcn.140215480
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [0x140233b40]
add rax, 0x10
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov eax, dword [rax - 8]
test eax, eax
mov rax, qword [rcx + 8]
jg 0x1401d23e0
mov dword [rax - 8], 1
ret
lock add dword [rax - 8], 1
ret
Function at 0x1401deac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movdqa xmm3, xmmword [0x140224ab0]
pxor xmm7, xmm7
movdqa xmm4, xmmword [0x140224ac0]
movdqa xmm5, xmmword [0x140224ad0]
movdqa xmm6, xmmword [0x140224ae0]
mov rdx, rcx
lea rcx, [rcx + 0x380]
mov rax, rdx
nop
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 4]
add rax, 0x10
movdqu xmm2, xmmword [rax + 0x624]
pand xmm1, xmm4
pand xmm0, xmm3
por xmm0, xmm1
movdqa xmm1, xmm0
pand xmm0, xmm5
psrld xmm1, 1
pxor xmm1, xmm2
movdqa xmm2, xmm7
psubd xmm2, xmm0
pand xmm2, xmm6
movdqa xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rcx, rax
jne 0x1401deb00
movq xmm0, qword [rdx + 0x380]
mov eax, dword [rdx + 0x388]
movq xmm1, qword [0x140224ab0]
mov ecx, dword [rdx + 0x38c]
movq xmm2, qword [0x140224ac0]
and eax, 0x80000000
pand xmm0, xmm1
and ecx, 0x7fffffff
movq xmm1, qword [rdx + 0x384]
or eax, ecx
pand xmm1, xmm2
mov ecx, eax
and eax, 1
por xmm0, xmm1
neg eax
shr ecx, 1
xor ecx, dword [rdx + 0x9bc]
movdqa xmm2, xmm0
and eax, 0x9908b0df
movq xmm1, qword [rdx + 0x9b4]
psrld xmm2, 1
xor eax, ecx
lea rcx, [rdx + 0x9bc]
pxor xmm1, xmm2
mov dword [rdx + 0x388], eax
movq xmm2, qword [0x140224ad0]
lea rax, [rdx + 0x38c]
pand xmm0, xmm2
pxor xmm2, xmm2
psubd xmm2, xmm0
movq xmm0, qword [0x140224ae0]
pand xmm0, xmm2
pxor xmm2, xmm2
pxor xmm1, xmm0
movq qword [rdx + 0x380], xmm1
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 4]
add rax, 0x10
movdqu xmm7, xmmword [rax - 0x39c]
pand xmm1, xmm4
pand xmm0, xmm3
por xmm0, xmm1
movdqa xmm1, xmm0
pand xmm0, xmm5
psrld xmm1, 1
pxor xmm1, xmm7
movdqa xmm7, xmm2
psubd xmm7, xmm0
pand xmm7, xmm6
movdqa xmm0, xmm7
pxor xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rcx, rax
jne 0x1401dec03
mov eax, dword [rdx + 0x9bc]
mov ecx, dword [rdx]
mov qword [rdx + 0x9c0], 0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
and ecx, 0x7fffffff
and eax, 0x80000000
or eax, ecx
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
xor ecx, dword [rdx + 0x630]
and eax, 0x9908b0df
xor eax, ecx
mov dword [rdx + 0x9bc], eax
add rsp, 0x28
ret

Function at 0x140202810
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x140202868
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x140202840
and edx, 7
je 0x14020289d
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x140202878
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x14020bac8
Capabilities:
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14020bcc0
mov rsi, rax
lea rdx, str.RtlGetVersion
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov qword [0x1402fa8e0], rax
lea rdx, str.RtlNtStatusToDosError
mov rcx, rsi
call rdi
mov qword [0x1402fa8b8], rax
test rax, rax
je 0x14020bcb1
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8f8], rax
test rax, rax
je 0x14020bcb1
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8d0], rax
test rax, rax
je 0x14020bcb1
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8c8], rax
test rax, rax
je 0x14020bcb1
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8d8], rax
test rax, rax
je 0x14020bcb1
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8f0], rax
cmp qword [0x1402fa8d8], 0
je 0x14020bcb1
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8a0], rax
test rax, rax
je 0x14020bcb1
lea rdx, str.NtQueryInformationProcess
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8c0], rax
test rax, rax
je 0x14020bcb1
lea rcx, [0x14022d380]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14020bcc0
lea rdx, str.GetQueuedCompletionStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa900], rax
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14020bc58
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8e8], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14020bc81
lea rdx, str.SetWinEventHook
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8b0], rax
lea rcx, [0x14022d3f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14020bcc0
lea rdx, [0x14022d405]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402fa8a8], rax
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
jmp 0x14020bccd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.140060580
ud2
Function at 0x140211ba0
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xa0
mov ebx, ecx
mov rsi, rdx
lea rdi, [rsp + 0x30]
call fcn.1400c8840
mov rcx, rdi
mov r8, rsi
mov edx, ebx
call fcn.140016c00
mov rcx, rdi
call fcn.140016a90
test eax, eax
je 0x140211bf5
mov edx, eax
mov rcx, rdi
call fcn.140016aa0
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.1401e42b0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
ret
lea rsi, [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
call fcn.140050000
call fcn.14005ed20
test al, al
je 0x140211c81
mov dword [rsp + 0x2a], 0x74766271
lea rcx, [rsp + 0x2a]
mov word [rsp + 0x2e], 0x66
movzx eax, byte [rsp + 0x2a]
mov dword [rsp + 0x24], 0x74766271
sub eax, 1
mov word [rsp + 0x28], 0x66
mov byte [rsp + 0x2a], al
movzx eax, byte [rsp + 0x2b]
sub eax, 1
mov byte [rsp + 0x2b], al
movzx eax, byte [rsp + 0x2c]
sub eax, 1
mov byte [rsp + 0x2c], al
movzx eax, byte [rsp + 0x2d]
sub eax, 1
mov byte [rsp + 0x2d], al
movzx eax, byte [rsp + 0x2e]
sub eax, 1
mov byte [rsp + 0x2e], al
call sub.msvcrt.dll_system
xor ebx, ebx
mov rcx, rsi
call fcn.1400500f0
jmp 0x140211bde
mov rcx, rsi
call fcn.1400505a0
mov ebx, eax
jmp 0x140211c74
Function at 0x140213db0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.14020b260
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.1400e3cd0
mov rcx, rax
jmp 0x140213c20
call fcn.14020b260
call fcn.14020b4b0
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x140213ca7
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.1400e38a0
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.1400e3990
test al, al
jne 0x140213cc5
lea rbx, [0x1402360c0]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.1400e3990
test al, al
je 0x140213cca
mov ecx, 8
call fcn.14020b1f0
lea r8, [0x1401c5bd0]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x140233b20]
add rax, 0x10
mov qword [rcx], rax
call fcn.14020b770
add rbx, 0x90
jmp 0x140213c36
call fcn.14020b720
mov rcx, rdi
call fcn.1400e3cb0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov rcx, rax
call fcn.14020b260
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.14014d830
mov ecx, 8
call fcn.14020b1f0
lea r8, [0x14014d4e0]
lea rdx, [0x140234f00]
mov rcx, rax
lea rax, [0x14023aba0]
mov qword [rcx], rax
call fcn.14020b770
call fcn.14014d860
mov rcx, qword [0x140218be0]
mov rbx, rax
call fcn.1400d5870
test eax, eax
je 0x140213d4c
call fcn.14014d860
mov rcx, rbx
call fcn.1400c9b10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.14014d830
call fcn.14014d860
call fcn.14014d890
nop
call fcn.14014d830
call fcn.14014d860
call fcn.14014d890
nop
mov ecx, 8
call fcn.14020b1f0
lea r8, [fcn.1402012a0]
lea rdx, [0x140236c60]
mov rcx, rax
mov rax, qword [0x140233dc0]
add rax, 0x10
mov qword [rcx], rax
call fcn.14020b770
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x140213e2c
call fcn.14020b260
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.msvcrt.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
call fcn.14020b390
call sub.msvcrt.dll_abort
mov rcx, rdi
call fcn.1400d47d8
call fcn.14020b720
call fcn.14020b260
call fcn.14020b390
jmp 0x140213e1a
Function at 0xf44058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f441df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xf44089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf4406f
add dl, dl
jne 0xf44096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf440f6
xor eax, eax
add dl, dl
jne 0xf440a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf441ad
add dl, dl
jne 0xf440b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf440c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf440d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf440dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xf440ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xf4407e
mov eax, 1
add dl, dl
jne 0xf44106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf44113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf440fb
sub eax, ebx
mov ebx, 1
jne 0xf4414c
mov ecx, 1
add dl, dl
jne 0xf4412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf4413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf44123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf4407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf44168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf44175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf4415d
cmp eax, 0x7d00
jae 0xf4419b
cmp eax, 0x500
jb 0xf44196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf4407e
cmp eax, 0x7f
ja 0xf4419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf4407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xf441d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xf4407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001128a
Capabilities:
Terminate process

Disassembly:
jmp 0x140014a50
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001132f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015da0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015dc0
xor al, al
jmp 0x140015e41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015dd3
xor al, al
jmp 0x140015e41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015dfd
xor al, al
jmp 0x140015e41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015e11
xor al, al
jmp 0x140015e41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015e23
xor al, al
jmp 0x140015e41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015e3f
xor al, al
jmp 0x140015e41
mov al, 1
add rsp, 0x38
ret
Function at 0x1405d8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405d81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405d8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405d806f
add dl, dl
jne 0x1405d8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405d80f6
xor eax, eax
add dl, dl
jne 0x1405d80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405d81ad
add dl, dl
jne 0x1405d80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405d80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405d807e
mov eax, 1
add dl, dl
jne 0x1405d8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405d80fb
sub eax, ebx
mov ebx, 1
jne 0x1405d814c
mov ecx, 1
add dl, dl
jne 0x1405d812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405d813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405d8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405d807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405d8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405d8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405d815d
cmp eax, 0x7d00
jae 0x1405d819b
cmp eax, 0x500
jb 0x1405d8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405d807e
cmp eax, 0x7f
ja 0x1405d819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405d807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405d81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405d807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4cf0c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d01a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4cfac2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f2108]
test eax, eax
je 0x2fc4cfb5a
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f2110]
mov qword [rbp - 8], rax
jmp 0x2fc4cfb3e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cfb32
cmp qword [rbp - 0x10], 0
je 0x2fc4cfb32
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cfaf8
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cfb5b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cfc60
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cfc88
mov eax, 0
jmp 0x2fc4cfcd6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cfcb1
mov eax, 0
jmp 0x2fc4cfcd6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cfcd1
mov eax, 0
jmp 0x2fc4cfcd6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cfcdc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cfd5a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cfd51
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cfd51
mov rax, qword [rbp - 8]
jmp 0x2fc4cfd6f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cfd24
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x446a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x446bb6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x446b82
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x70]
mov byte [rsp + 0x28], bl
call fcn.004462a0
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
mov edx, dword [rcx + 0x1c]
mov dword [rsp + 0x10], edx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x70]
mov byte [rsp + 0x28], dl
call fcn.004462a0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x446b1d
lea rax, [0x00679a16]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp eax, 0xffffffff
je 0x446af0
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x446af0
mov rbx, qword [rdx + 8]
mov rdx, qword [rdx]
jae 0x446baf
mov ecx, dword [rsi + rcx*4]
cmp rcx, rbx
jae 0x446baf
mov dword [rsp + 0x3c], eax
lea rax, [rdx + rcx]
mov qword [rsp], rax
call fcn.00444510
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00679a16]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0042b370
ud2
call fcn.004548e0
jmp fcn.00446a30