joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140042440]
mov dword [rax], 1
mov rax, qword [0x140042450]
mov dword [rax], 1
mov rax, qword [0x140042460]
mov dword [rax], 1
mov rax, qword [0x140042400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400209d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.140021d30
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x1400216a2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140046168]
test eax, eax
je 0x14002173a
lea rax, [0x140046140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140046170]
mov qword [rbp - 8], rax
jmp 0x14002171e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140021712
cmp qword [rbp - 0x10], 0
je 0x140021712
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400216d8
lea rax, [0x140046140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14002173b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140021840
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140021868
mov eax, 0
jmp 0x1400218b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140021891
mov eax, 0
jmp 0x1400218b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400218b1
mov eax, 0
jmp 0x1400218b6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400218bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14002193a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140021931
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140021931
mov rax, qword [rbp - 8]
jmp 0x14002194f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140021904
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x30
lea rax, [fcn.140002450]
mov rcx, qword [rsp + 0x20]
imul rdx, rcx, 0x156549f7
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], 0x645d4257
mov qword [rsp + 0x10], rcx
mov qword [rsp + 8], rax
jmp 0x14000248a
mov rax, qword [rsp]
add rsp, 0x30
ret
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
and rcx, rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x10]
xor rcx, 0xffffffffffffffff
mov dx, word [rax]
mov qword [rsp + 0x20], rcx
cmp dx, 0x5a4d
mov qword [rsp], rax
je 0x1400024fb
mov eax, 0x645d3257
mov ecx, eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x7965dfc6
mov dword [rsp + 0x2c], eax
mov rdx, qword [rsp + 0x18]
sub rcx, qword [rsp + 0x18]
mov eax, dword [rsp + 0x2c]
add rdx, 0xffffffff9ba2ada9
or eax, 0xfc77f39
mov dword [rsp + 0x2c], eax
mov r8, qword [rsp]
add r8, rcx
and r8, rdx
mov qword [rsp + 8], r8
jmp 0x14000248a
mov rax, qword [rsp]
movsxd rcx, dword [rax + 0x3c]
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x20], rdx
cmp dword [rax + rcx], 0x4550
je 0x140002481
jmp 0x1400024b8

Function at 0x140002910
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], 0x77fcf6e6
mov ax, word [rsp + 0x36]
mov r9w, ax
xor r9w, 0xffff
mov word [rsp + 0x36], r9w
mov dword [rsp + 0x36], r9d
cmp r8, 0
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rcx
mov word [rsp + 0xe], ax
je 0x140002994
xor eax, eax
mov ecx, eax
mov qword [rsp], rcx
mov rax, qword [rsp]
mov cx, word [rsp + 0xe]
xor cx, 0xffff
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffff8803091b
mov word [rsp + 0x36], cx
mov r8, qword [rsp + 0x20]
mov r9b, byte [r8 + rax]
mov r10, qword [rsp + 0x10]
mov byte [r10 + rax], r9b
add rax, rdx
add eax, edx
mov rdx, qword [rsp + 0x18]
cmp rax, rdx
mov qword [rsp], rax
jne 0x140002953
mov rax, qword [rsp + 0x10]
add rsp, 0x48
ret

Function at 0x1400029a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov al, byte [rsp + 0xd7]
mov dl, al
xor dl, 0x37
mov byte [rsp + 0xd7], dl
mov byte [rsp + 0xc7], 0x34
mov dword [rsp + 0xc0], 0x70720716
mov qword [rsp + 0xb8], 0xa2aa500
mov r8d, dword [rsp + 0xd0]
mov r9d, r8d
or r9d, 0x3545b2c8
xor eax, 0x24948b4c
mov eax, 0x44000000
mov dword [rsp + 0xd0], ecx

Function at 0x1400029ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x24948b4c
mov eax, 0x44000000
mov dword [rsp + 0xd0], ecx
mov r11, r10
xor r11, 0x24939f7f
mov qword [rsp + 0xa8], r11
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x4f], al
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x40], r10
call fcn.140003220
mov si, word [rsp + 0xc4]
mov di, si
mov edi, esi
xor di, 0xe8d5
mov rcx, rax
mov word [rsp + 0x3e], di
mov word [rsp + 0x3c], si
mov qword [rsp + 0x30], rax
call fcn.1400025d0
mov si, word [rsp + 0x3e]
je 0x140002a76
mov word ds:[rsp + 0xc4], si
mov rcx, qword [rsp + 0xa8]
mov r8d, dword [rax + 0x88]
mov si, word [rsp + 0x3c]
and si, 0x29bd
mov word [rsp + 0xc4], si
mov r8d, r8d
mov eax, r8d
mov r10, qword [rsp + 0xb8]
invalid
invalid
Function at 0x140003348
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x58]
mov r8, rdx
mov eax, dword [rsp + 0x28]
xor eax, 0x359400ba
mov dword [rsp + 0xe4], eax
mov r9b, byte [rsp + rdx + 0x30]
movsx eax, r9b
mov r10w, ax
mov qword [rsp + 0xd8], 0xffffffffd14fa791
sub rcx, qword [rsp + 0xc8]
mov word [rsp + r8*2 + 0x70], r10w
add r8, 1
mov r9b, byte [rsp + 0x2d]
add r9b, 0x43
mov byte [rsp + 0xef], r9b
mov qword [rsp + 0x58], r8
cmp r8, rcx
jne 0x140003341
lea rax, [rsp + 0x70]
mov qword [rsp + 0xb8], rax
mov byte [rsp + 0xc7], 0xc6
add byte [rax], al
mov byte [rax + 0xc724bc], 0
add dh, al
Function at 0x2fc4da86c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da8ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da8e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da8e1
mov rax, qword [rbp - 8]
jmp 0x2fc4da8ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da8b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140009e40
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x1400b6088]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x30], r9b
mov r14, r8
mov r15, rdx
mov r12, rcx
xor esi, esi
mov dword [rsp + 0x38], esi
movdqa xmm0, xmmword [0x1400a07e0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], si
mov dword [rsp + 0x38], 1
mov rdx, qword [r8 + 0x10]
add rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x50]
call fcn.14000ad10
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x140009ec1
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140005500
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140009edc
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140005500
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140009f44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a009
call fcn.14003e9b0
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x34], esi
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x140009f76
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140009fe1
mov rbx, qword [rsp + 0x40]
mov edi, esi
cmp dword [rsp + 0x34], esi
jbe 0x140009fdf
movzx ebp, byte [rsp + 0xe8]
movzx r13d, byte [rsp + 0xe0]
movzx eax, byte [rsp + 0x30]
nop dword [rax]
test al, al
je 0x140009faa
cmp dword [rbx + 0x10], 0
jne 0x140009fd3
mov r9d, dword [rbx]
mov byte [rsp + 0x20], bpl
mov r8, r14
mov rdx, r15
mov rcx, r12
test r13b, r13b
je 0x140009fc7
call sym.fik.exe_private:_unsigned_long_int___cdecl_NativeUserUnmanaged::LaunchAppIntoDifferentSessionFromService_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__unsigned_long_int__bool____ptr64
jmp 0x140009fcc
call sym.fik.exe_private:_unsigned_long_int___cdecl_NativeUserUnmanaged::LaunchAppIntoDifferentSession_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__unsigned_long_int__bool____ptr64
mov esi, eax
movzx eax, byte [rsp + 0x30]
add rbx, 0x18
inc edi
cmp edi, dword [rsp + 0x34]
jb 0x140009fa0
mov eax, esi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003e950
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140060238
int3
Function at 0x140011cd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor ebp, ebp
mov dword [rax - 0x48], ebp
mov dword [rax + 8], ebp
cmp qword [r8 + 0x18], 8
jb 0x140011d05
mov r8, qword [r8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140011e3c
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov dword [rsp + 0x40], 1
mov edx, dword [rsp + 0x90]
shr rdx, 1
mov rax, qword [rbx + 0x10]
cmp rdx, rax
ja 0x140011d74
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140011d6e
mov rax, qword [rbx]
mov word [rax + rdx*2], bp
jmp 0x140011d82
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.140005490
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140011d8f
mov rax, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x140011d99
mov rdi, qword [rdi]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 2
mov r8, rdi
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140011e16
mov edx, dword [rsp + 0x90]
shr rdx, 1
dec rdx
mov rax, qword [rbx + 0x10]
cmp rdx, rax
ja 0x140011df5
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140011def
mov rax, qword [rbx]
mov word [rax + rdx*2], bp
jmp 0x140011e03
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.140005490
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov r8d, eax
lea rdx, str.Cannot_get_string_value:_RegGetValue_failed.
lea rcx, [rsp + 0x50]
call fcn.140011ae0
lea rdx, [0x1400b36c8]
lea rcx, [rsp + 0x50]
call fcn.14005d238
int3
mov r8d, eax
lea rdx, str.Cannot_get_size_of_string_value:_RegGetValue_failed.
lea rcx, [rsp + 0x50]
call fcn.140011ae0
lea rdx, [0x1400b36c8]
lea rcx, [rsp + 0x50]
call fcn.14005d238
int3

Function at 0x140012540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400125b5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400125b5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400125a5
nop
cmp rbx, rcx
jae 0x1400125b5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140012590
cmp rbx, rcx
jae 0x1400125b5
cmp word [rbx], 0
je 0x1400125b5
mov rax, rbx
jmp 0x1400125b7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140035598
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
xor r10d, r10d
sar r8, 1
movabs rax, 0xcbf29ce484222325
add r8, r8
mov r9, rdx
lea rcx, [r8 + rdx]
cmp rdx, rcx
cmova r8, r10
test r8, r8
je 0x1400355e4
movzx ecx, byte [r9]
movabs r10, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, rdx
imul rax, r10
cmp rcx, r8
jne 0x1400355c1
ret

Function at 0x14003ce38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ecx, ecx
mov r10, r8
sub r10, rdx
movabs rax, 0xcbf29ce484222325
cmp rdx, r8
mov r9, rdx
cmova r10, rcx
test r10, r10
je 0x14003ce7c
movzx ecx, byte [r9]
movabs r8, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, rdx
imul rax, r8
cmp rcx, r10
jne 0x14003ce59
ret

Function at 0x140042868
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14004287b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14004c7bc
lea rdx, [0x1400b2cd8]
lea rcx, [rsp + 0x20]
call fcn.14005d238
int3

Function at 0x1400487bc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, dword [0x1400baca0]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1400487e1
mov rcx, rax
call fcn.14004d5a0
cmp rax, rdi
je 0x14004882a
mov bl, 1
mov rcx, rdi
mov dl, bl
call fcn.140048848
mov al, byte [0x1400bad94]
mov dl, 4
mov r8d, dword [rdi + 0x258]
cmp al, dl
jb 0x14004880f
mov eax, dword [0x1400bad90]
test bl, al
jne 0x140048811
xor bl, bl
test bl, bl
je 0x14004881f
mov ecx, 7
call fcn.14004c278
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.14004c694
lea rdx, [0x1400b2e58]
lea rcx, [rsp + 0x20]
call fcn.14005d238
int3

Function at 0x14004d154
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400baca0]
xor edx, edx
jmp fcn.140042868

Function at 0x14004daec
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400baca0]
jmp fcn.140042868

Function at 0x140059718
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400597d4]
mov r9, qword [r9 + 8]
jmp fcn.14004a934

Function at 0x1400597ac
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400597e4]
mov r9, qword [r9 + 8]
jmp fcn.14004a934

Function at 0x1400713f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140071214
Function at 0x2fc4d5b30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6c10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d6532
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d65ca
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d65ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d65a2
cmp qword [rbp - 0x10], 0
je 0x2fc4d65a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6568
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d65cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d66d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d66f8
mov eax, 0
jmp 0x2fc4d6746
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6721
mov eax, 0
jmp 0x2fc4d6746
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6741
mov eax, 0
jmp 0x2fc4d6746
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d674c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d67ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d67c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d67c1
mov rax, qword [rbp - 8]
jmp 0x2fc4d67df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6794
mov eax, 0
add rsp, 0x20
pop rbp
ret