joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003306e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140054254
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140053fb8

Function at 0x1400330fa
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14007c1e0
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1400a83f8]
mov ecx, 5
lea r8, [0x1400a83f0]
lea rdx, [0x1400a8400]
call fcn.14007b7d8
mov ecx, ebx
test rax, rax
je 0x14007c21a
add rsp, 0x20
pop rbx
jmp qword [0x1400c8010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1400333ca
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x14003e2b0
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400c707c]
call fcn.140033820
lea rcx, [0x1400a50d0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14003e36a
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bb5a8], rax
lea rdx, str.NtCreateFile
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bb5b0], rax
lea rdx, str.NtQueryDirectoryObject
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bb5c0], rax
lea rdx, str.NtOpenDirectoryObject
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bb5c8], rax
lea rdx, str.NtSetInformationFile
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bb5b8], rax
cmp qword [0x1400bb5a8], 0
je 0x14003e39c
cmp qword [0x1400bb5b0], 0
je 0x14003e39c
cmp qword [0x1400bb5c0], 0
je 0x14003e39c
cmp qword [0x1400bb5c8], 0
je 0x14003e39c
cmp qword [0x1400bb5b8], 0
jne 0x14003e3b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_load_apis__d_n
call fcn.1400347b6
xor ecx, ecx
call fcn.140033cbc
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14003390b
Capabilities:
Terminate process

Disassembly:
jmp 0x14004096c
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140033b4a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140099854
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1400ba2d8]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r11d, r11d
lea r10, [0x1400bd688]
test r9, r9
lea rdi, [0x1400ae70e]
mov rax, rdx
mov r15, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r14d, ebp
cmovne r14, r8
neg rax
sbb rsi, rsi
and rsi, rcx
test r14, r14
jne 0x1400998bd
mov rax, 0xfffffffffffffffe
jmp 0x140099a0f
movzx r9d, word [r10 + 6]
test r9w, r9w
jne 0x14009992d
mov bl, byte [rdi]
inc rdi
test bl, bl
js 0x1400998e9
test rsi, rsi
je 0x1400998db
movzx ecx, bl
mov dword [rsi], ecx
test bl, bl
setne r11b
mov rax, r11
jmp 0x140099a0f
mov al, bl
and al, 0xe0
cmp al, 0xc0
jne 0x1400998f6
mov r8b, 2
jmp 0x140099912
mov al, bl
and al, 0xf0
cmp al, 0xe0
jne 0x140099903
mov r8b, 3
jmp 0x140099912
mov al, bl
and al, 0xf8
cmp al, 0xf0
jne 0x1400999fb
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov r9b, r8b
sub edx, ebp
movzx eax, bl
and edx, eax
jmp 0x140099952
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
lea eax, [r8 - 2]
cmp al, 2
ja 0x1400999fb
cmp r9b, bpl
jb 0x1400999fb
cmp r9b, r8b
jae 0x1400999fb
movzx ebp, r9b
cmp rbp, r14
mov ebx, ebp
cmovae rbx, r14
jmp 0x140099981
mov cl, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x1400999fb
mov eax, edx
movzx ecx, cl
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r15
cmp rax, rbx
jb 0x140099961
cmp rbx, rbp
jae 0x1400999ae
movzx eax, r8b
sub r9b, bl
mov word [r10 + 4], ax
movzx eax, r9b
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x1400998b1
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x1400999fb
cmp edx, 0x110000
jae 0x1400999fb
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x1400999fb
test rsi, rsi
je 0x1400999ec
mov dword [rsi], edx
xor eax, eax
neg edx
mov qword [r10], rax
sbb rax, rax
and rax, rbp
jmp 0x140099a0f
xor eax, eax
mov qword [r10], rax
call fcn.140033dca
mov dword [rax], 0x2a
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140033cb7
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140033c49
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14007c238
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400a8418]
mov edi, ecx
lea rdx, [0x1400a8420]
mov ecx, 6
lea r8, [0x1400a8410]
call fcn.14007b7d8
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14007c278
call qword [0x1400c8010]
jmp 0x14007c27e
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140033cbc
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400542c8
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14005401f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005401f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005401f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005401f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005401f
cmp dword [rcx + 0x84], 0xe
jbe 0x14005401f
cmp dword [rcx + 0xf8], 0
je 0x14005401f
mov ecx, ebx
call fcn.1400541b0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140053d28
cmp dword [rbp + 0x20], 0
je 0x14005406c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400540a4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140053fb8

Function at 0x140034b17
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140049a68
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400a6160]
xor ecx, ecx
lea r8, [0x1400a6158]
lea rdx, [0x1400a6168]
call fcn.1400494c8
test rax, rax
je 0x140049aa1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400c8010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x14003503a
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14004124c
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400412da
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400412da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400412da
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400412c1
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400412bb
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400412c3
add rdx, 0x28
jmp 0x1400412a0
xor edx, edx
test rdx, rdx
jne 0x1400412cc
xor al, al
jmp 0x1400412e0
cmp dword [rdx + 0x24], 0
jge 0x1400412d6
xor al, al
jmp 0x1400412e0
mov al, 1
jmp 0x1400412e0
xor al, al
jmp 0x1400412e0
add rsp, 0x18
ret
Function at 0x14003539b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140054264
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140053fb8

Function at 0x140035409
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140049b70
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400a61c0]
mov edi, ecx
lea rdx, [0x1400a61c8]
mov ecx, 3
lea r8, [0x1400a61b8]
call fcn.1400494c8
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x140049bb0
call qword [0x1400c8010]
jmp 0x140049bb6
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003576a
Capabilities:
Parse pe header

Disassembly:
jmp 0x14004183c
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140041887
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140041887
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140041887
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140041887
cmp dword [rcx + 0x84], 0xe
jbe 0x140041887
cmp dword [rcx + 0xf8], 0
je 0x140041887
mov al, 1
jmp 0x140041889
xor al, al
add rsp, 0x28
ret

Function at 0x140035a17
Capabilities:
Terminate process

Disassembly:
jmp 0x14007ab0c
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14007ab26
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.140035b57
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140035c56
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14007c12c
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400a83b8]
mov ecx, 3
lea r8, [0x1400a83b0]
lea rdx, [0x1400a83c0]
call fcn.14007b7d8
test rax, rax
je 0x14007c168
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400c8010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140035dd2
Capabilities:
Get geographical location

Disassembly:
jmp 0x14007c3cc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x1400a84e0]
mov rbp, rcx
lea r8, [0x1400a84d8]
lea rdx, [0x1400a84e8]
mov ecx, 0xb
call fcn.14007b7d8
mov rcx, rbp
test rax, rax
je 0x14007c422
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [0x1400c8010]
jmp 0x14007c439
xor edx, edx
call fcn.140034798
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140035ef4
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
jmp 0x14003e090
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4b8
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4d8]
mov rax, qword [0x1400ba2d8]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x1400c707c]
call fcn.140033820
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
lea r8, [0x1400a5298]
mov edx, 0x66
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, [0x1400a52a8]
lea rcx, str.C:windows_temp_
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rdx, [rbp + 0x50]
lea rcx, str.___MSI_file:__ls_n
call fcn.1400347b6
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x274], eax
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x298], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 7
mov edx, 0x40040000
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x2b8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0x274]
mov rdx, qword [rbp + 0x298]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov ecx, 2
call fcn.1400344dc
lea rdx, str.ACTIONINSTALL
lea rcx, [rbp + 0x50]
call fcn.1400344fa
mov dword [rbp + 0x2d4], eax
lea rdx, str.REMOVEALL
lea rcx, [rbp + 0x50]
call fcn.1400344fa
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400a4550]
call fcn.140035d46
mov eax, edi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.140033cb7
lea rsp, [rbp + 0x478]
pop rdi
pop rbp
ret

Function at 0x140035f7b
Capabilities:
Query environment variable

Disassembly:
jmp 0x140087448
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x1400874cf
mov rbp, rax
cmp word [rax], si
je 0x140087491
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140087478
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140087474
sub rbp, rbx
add rbp, 2
sar rbp, 1
add rbp, rbp
mov rcx, rbp
call fcn.140034c2a
mov rdi, rax
test rax, rax
je 0x1400874bf
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.14003575b
mov rsi, rdi
xor ecx, ecx
call fcn.140034905
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x2fc4d52b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6390
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5cb2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d5d4a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5d2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5d22
cmp qword [rbp - 0x10], 0
je 0x2fc4d5d22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5ce8
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5d4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5e50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5e78
mov eax, 0
jmp 0x2fc4d5ec6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5ea1
mov eax, 0
jmp 0x2fc4d5ec6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5ec1
mov eax, 0
jmp 0x2fc4d5ec6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5ecc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d5f4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5f41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5f41
mov rax, qword [rbp - 8]
jmp 0x2fc4d5f5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5f14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9af0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4dabd0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4da4f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4da58a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4da56e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da562
cmp qword [rbp - 0x10], 0
je 0x2fc4da562
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da528
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da58b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da690
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da6b8
mov eax, 0
jmp 0x2fc4da706
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da6e1
mov eax, 0
jmp 0x2fc4da706
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da701
mov eax, 0
jmp 0x2fc4da706
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da70c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da78a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da781
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da781
mov rax, qword [rbp - 8]
jmp 0x2fc4da79f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da754
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0fd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d20b0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d19d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d1a6a
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d1a4e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d1a42
cmp qword [rbp - 0x10], 0
je 0x2fc4d1a42
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d1a08
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d1a6b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d1b70
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1b98
mov eax, 0
jmp 0x2fc4d1be6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1bc1
mov eax, 0
jmp 0x2fc4d1be6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d1be1
mov eax, 0
jmp 0x2fc4d1be6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d1bec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d1c6a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d1c61
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d1c61
mov rax, qword [rbp - 8]
jmp 0x2fc4d1c7f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d1c34
mov eax, 0
add rsp, 0x20
pop rbp
ret