joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d34a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4580
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d3ea2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d3f3a
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d3f1e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d3f12
cmp qword [rbp - 0x10], 0
je 0x2fc4d3f12
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d3ed8
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d3f3b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4040
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4068
mov eax, 0
jmp 0x2fc4d40b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4091
mov eax, 0
jmp 0x2fc4d40b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d40b1
mov eax, 0
jmp 0x2fc4d40b6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d40bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d413a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4131
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4131
mov rax, qword [rbp - 8]
jmp 0x2fc4d414f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4104
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x404a9d
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
jne 0x404ad4
mov rax, qword [rbp + 0x18]
mov r9, rax
mov r8d, 0x12
mov edx, 1
lea rcx, str.Supported_targets:
call sub.msvcrt.dll_fwrite
jmp 0x404aeb
mov rax, qword [rbp + 0x18]
mov r8, qword [rbp + 0x10]
lea rdx, str._s:_supported_targets:
mov rcx, rax
call sub.msvcrt.dll_fprintf
call fcn.00418c41
mov qword [rbp - 0x10], rax
mov dword [rbp - 4], 0
jmp 0x404b2e
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp - 0x10]
add rax, rdx
mov rdx, qword [rax]
mov rax, qword [rbp + 0x18]
mov r8, rdx
lea rdx, [0x004ee3cf]
mov rcx, rax
call sub.msvcrt.dll_fprintf
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp - 0x10]
add rax, rdx
mov rax, qword [rax]
test rax, rax
jne 0x404afd
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
nop
add rsp, 0x30
pop rbp
ret
Function at 0x405117
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x10], 0
mov dword [rbp - 0xc], 2
jmp 0x405167
mov eax, dword [rbp - 0xc]
mov edx, 0
mov ecx, eax
call fcn.0040b390
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp - 0x2c], eax
mov eax, dword [rbp - 0x2c]
cmp eax, dword [rbp - 0x10]
jle 0x405163
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 0x10], eax
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0x59
jbe 0x405133
mov dword [rbp - 4], 0
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x40519a
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x4051a7
mov dword [rbp - 4], 0x50
mov dword [rbp - 8], 0
jmp 0x405285
mov eax, dword [rbp - 4]
sub eax, dword [rbp - 0x10]
lea edx, [rax - 1]
mov eax, dword [rbp - 8]
mov r8, qword [rbp + 0x10]
mov ecx, eax
call fcn.00404f56
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x10]
add eax, 1
lea r8, [0x004ee48b]
mov edx, eax
lea rcx, str._n_s
call sub.msvcrt.dll_printf
mov edx, dword [rbp - 0x1c]
mov eax, dword [rbp - 8]
mov r8, qword [rbp + 0x10]
mov ecx, eax
call fcn.00404fcb
mov ecx, 0xa
call sub.msvcrt.dll_putchar
mov dword [rbp - 0xc], 2
jmp 0x405279
mov eax, dword [rbp - 0xc]
mov edx, 0
mov ecx, eax
call fcn.0040b390
lea rdx, [0x004ee492]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x405275
mov eax, dword [rbp - 0xc]
mov edx, 0
mov ecx, eax
call fcn.0040b390
mov rdx, rax
mov eax, dword [rbp - 0x10]
mov r8, rdx
mov edx, eax
lea rcx, str._s
call sub.msvcrt.dll_printf
mov ecx, dword [rbp - 0xc]
mov edx, dword [rbp - 0x1c]
mov eax, dword [rbp - 8]
mov r9, qword [rbp + 0x10]
mov r8d, ecx
mov ecx, eax
call fcn.00405024
mov ecx, 0xa
call sub.msvcrt.dll_putchar
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0x59
jbe 0x40520c
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0xc]
cmp dword [rbp - 8], eax
jl 0x4051b3
nop
add rsp, 0x50
pop rbp
ret
Function at 0x41461b
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
not dword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
add rax, rdx
mov qword [rbp - 8], rax
jmp 0x414676
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax]
movzx eax, al
xor eax, dword [rbp + 0x10]
movzx eax, al
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x004ef900]
mov eax, dword [rdx + rax]
mov edx, dword [rbp + 0x10]
shr edx, 8
xor eax, edx
mov dword [rbp + 0x10], eax
add qword [rbp + 0x18], 1
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbp - 8]
jb 0x414642
mov eax, dword [rbp + 0x10]
not eax
add rsp, 0x10
pop rbp
ret

Function at 0x4188e5
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x418906
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
jmp 0x418916
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x418934
mov rax, qword [rbp - 8]
lea rdx, str.default
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x418982
mov rax, qword [0x004cf990]
test rax, rax
je 0x41894d
mov rax, qword [0x004cf990]
mov qword [rbp - 0x10], rax
jmp 0x41895b
mov rax, qword [0x004cf980]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
cmp qword [rbp + 0x18], 0
je 0x41897c
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp + 0x18]
movzx edx, byte [rax + 0x43]
or edx, 4
mov byte [rax + 0x43], dl
mov rax, qword [rbp - 0x10]
jmp 0x4189cc
cmp qword [rbp + 0x18], 0
je 0x418997
mov rax, qword [rbp + 0x18]
movzx edx, byte [rax + 0x43]
and edx, 0xfffffffb
mov byte [rax + 0x43], dl
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.004187c0
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x4189b5
mov eax, 0
jmp 0x4189cc
cmp qword [rbp + 0x18], 0
je 0x4189c8
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbp
ret
Function at 0x43a516
Capabilities:
Hash data using djb2

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0x1505
jmp 0x43a549
mov eax, dword [rbp - 0xc]
shl eax, 5
mov edx, eax
mov eax, dword [rbp - 0xc]
add edx, eax
movzx eax, byte [rbp - 0xd]
add eax, edx
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov qword [rbp - 8], rdx
movzx eax, byte [rax]
mov byte [rbp - 0xd], al
cmp byte [rbp - 0xd], 0
jne 0x43a533
mov eax, dword [rbp - 0xc]
add rsp, 0x10
pop rbp
ret
Function at 0x4779fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.0047791b
test eax, eax
jne 0x477a36
mov eax, 0
jmp 0x477a9e
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp - 8], rax
sub qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
and eax, 0x7f
xor eax, 0x40
sub eax, 0x40
movsxd rdx, eax
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
jmp 0x477a8f
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
shl rax, 7
mov rdx, rax
sub qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
and eax, 0x7f
or rdx, rax
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
cmp rax, qword [rbp - 0x10]
ja 0x477a65
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x488cf4
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x20]
jge 0x488d4f
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
je 0x488d4f
mov ecx, 1
call fcn.0040b4dd
mov rax, qword [rbp - 8]
jmp 0x488d67
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x20]
jge 0x488d63
mov ecx, 0x12
call fcn.0040b4dd
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret
Function at 0x4c5edb
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [0x004ec270]
mov dword [0x0053278c], eax
mov eax, dword [0x0053278c]
mov dword [0x00532788], eax
mov qword [0x00532770], 0
lea rcx, str.POSIXLY_CORRECT
call sub.msvcrt.dll_getenv
mov qword [0x00532780], rax
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2d
jne 0x4c5f40
mov dword [0x00532778], 2
add qword [rbp + 0x20], 1
jmp 0x4c5f7e
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2b
jne 0x4c5f5c
mov dword [0x00532778], 0
add qword [rbp + 0x20], 1
jmp 0x4c5f7e
mov rax, qword [0x00532780]
test rax, rax
je 0x4c5f74
mov dword [0x00532778], 0
jmp 0x4c5f7e
mov dword [0x00532778], 1
mov rax, qword [rbp + 0x20]
add rsp, 0x20
pop rbp
ret
Function at 0x4c9370
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x005327a0]
test rax, rax
jne 0x4c9408
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x4c93e9
mov eax, dword [rbp - 4]
mov rcx, rax
call fcn.004cb1b6
mov qword [0x005327a0], rax
mov rdx, qword [0x005327a0]
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
test eax, eax
jne 0x4c93e9
mov rax, qword [0x005327a0]
mov rcx, rax
call sub.msvcrt.dll_free
mov qword [0x005327a0], 0
mov rax, qword [0x005327a0]
test rax, rax
jne 0x4c9408
lea rcx, [0x00518730]
call fcn.004cb2d0
mov qword [0x005327a0], rax
mov rax, qword [0x005327a0]
add rsp, 0x30
pop rbp
ret

Function at 0x4cbd60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00532e04]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4cbe80
mov rax, qword [0x00532e08]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x4cbdac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4cbe66
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x4cbd90
mov rcx, rsi
call fcn.004cc9a0
test rax, rax
mov r12, rax
je 0x4cbeb8
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00532e08]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.004ccaf0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x00532e08]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4cbe9b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4cbe5f
sub eax, 0x40
and eax, 0xffffffbf
je 0x4cbe5f
add rbx, qword [0x00532e08]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4cbe87
add dword [0x00532e04], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x4cbdb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004cbcf0
mov rax, qword [0x00532e08]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.004cbcf0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.004cbcf0
nop
nop dword [rax + rax]
Function at 0x4cc610
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005330e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x005330c0]
test rbx, rbx
je 0x4cc664
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4cc65b
test rsi, rsi
je 0x4cc65b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4cc640
lea rcx, [0x005330e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4cc9a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00519500]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x4cc9c0
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.004cc880
test eax, eax
je 0x4cc9b8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x4cca1d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x4cca14
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x4cc9b8
add rdx, 0x28
cmp rdx, r9
jne 0x4cca00
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x4ccce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x4cce6c
cmp byte [rbx], 0
je 0x4cce34
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4cce50
test al, 0x10
je 0x4cce34
lea rdi, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rdi
mov rsi, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rsi]
add rsi, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4ccd3e
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rsi + 2]
mov ecx, eax
cmove rsi, rdx
add cl, al
sbb rsi, 3
sub rsi, rdi
lea rcx, [rsi + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x4cce5f
lea r9, [rax + 0x244]
lea rbp, [rsi + 1]
mov rdx, rdi
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov r9, rax
je 0x4ccdd0
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x2f
je 0x4ccdd0
cmp al, 0x5c
je 0x4ccdd0
mov r8d, 0x5c
mov word [r9 + rsi], r8w
mov rsi, rbp
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [r9 + rsi], ax
mov word [rbx + 0x12c], dx
lea rdx, [rbx + 0x130]
mov word [rbx + 0x12e], cx
xor eax, eax
mov ecx, 0x20
mov rdi, rdx
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov dword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x4cce25
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x4cce25
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x4cce25
Function at 0x2fc4d8930
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d9a10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d9332
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d93ca
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d93ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d93a2
cmp qword [rbp - 0x10], 0
je 0x2fc4d93a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9368
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d93cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d94d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d94f8
mov eax, 0
jmp 0x2fc4d9546
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d9521
mov eax, 0
jmp 0x2fc4d9546
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9541
mov eax, 0
jmp 0x2fc4d9546
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d954c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d95ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d95c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d95c1
mov rax, qword [rbp - 8]
jmp 0x2fc4d95df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9594
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140099505
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401c0ca0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14023e833]
call fcn.14009c5f2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1401c0cf7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1401c0e03
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1401c0d9c
cmp qword [rbp + 0x28], 0
jle 0x1401c0d9c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1401c0d3c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14009c255
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1401c0df2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1401c0df2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret