joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140754b98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx r10w, bp
sub qword [rsp + 0x38], 0x5f742721
cmp r10d, dword [rsp + 0x3b]
jno 0x1407110b0
neg ebp
xor r10d, 0x3daa7b69
seta byte [rsp + 0x38]
mov r14, qword [rsp + 0x30]
jb 0x140cb5c52
sub word [rsp + 0x30], 0x72d6
add qword [rsp + 0x40], 0xffffffffbf23d761
cmp r14b, bpl
setae r14b
mov r14, qword [rsp + 0x28]
sub r10, r10
sub bpl, byte [rsp + 0x3b]
movzx r10d, byte [rsp + 0x39]
or rbp, 0xff36ea
call fcn.140cda69a
not word [rsp + 0x18]
movsx r9d, r9b
call fcn.1407996c0
adc byte [rbx - 0x1fd11c5c], cl
push rsi
invalid
bswap r10d
jo 0x1407110f3
movabs rdx, 0x64d05b72189c01de
setne r10b
push r10
push 0x644e429e
lea r13, [rcx + rcx*2 + 0x5ff80851]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x4bd7a519
and r10b, byte [rsp + 2]
sub r13, qword [rsp]
mov rdx, r10
mov dx, word [rsp + 1]
setbe byte [rsp]
cmp edx, 0x3f6f0dde
setge dl
add r10w, word [rsp + 5]
or word [rsp], r13w
cmp byte [rsp + 8], 0x37
push r14
push r11
push rbp
jge 0x14079efbb
setge byte [rsp + 0x20]
call fcn.140d65c72
push r8
movabs r8, 0x46905a648220d8a
push rdi
push r11
movabs rdi, 0x39c21a0f4a723159
push r9
push r10
movabs r10, 0x779a1aec386c3678
push r12
add dx, word [rsp + 1]
pop r11
mov rbp, qword [rsp + 0x70]
not r8w
not dil
call fcn.140d962fa
std
adc byte [rsi - 0x2fd0869], bl
push rax
js 0x140754ca7
add ebp, 0x4fd442ec
add qword [rsp], 0xffffffffff9992e1
mov qword [rsp + 0x28], 0x50b37e4d
add ebp, dword [rsp + 0x2b]
or qword [rsp + 0x28], rbp
sete bpl
neg ecx
sub qword [rsp + 0x28], rcx
setno r13b
sub word [rsp + 0x28], 0x44b7
not word [rsp + 0x28]
sub r13b, byte [rsp + 0x2d]
jg 0x14077c6ba
add byte [rax], al
add byte [rdi + 0x64], bl
jae 0x140754d15
outsb dx, byte [esi]
add byte [rsi + 0xb], ah
or cx, word [rsp + 0x11]
neg word [rsp + 0x10]
lea rcx, [rcx + rcx*8 + 0x243d09c4]
lea rcx, [rcx + rcx*2 + 0x5e684739]
xor cx, 0x20a6
xor ecx, ecx
not byte [rsp + 0x10]
setbe byte [rsp + 0x10]
lea rsp, [rsp + 8]
ret 8
and ebx, 0xffffffb8
iretd
ret
movabs rcx, 0x786d64e025837d9b
add qword [rsp + 0x38], 0xfffffffffff96063
xor r8b, bpl
or bpl, 0x93
mov qword [rsp + 0x48], 0x14f503c6
cmp r8d, 0x77105e68
setbe cl
neg rcx
not cx
add dx, 0x685d
add ecx, 0x453c168d
push rdi
cmovl r8, r15
add cx, 0x6aa4
sub rcx, rbp
and rdx, 0x51f351c2
push r15
push r13
push r14
call fcn.14070a66f
lahf
loop 0x14078b860
add al, 0x7b
mov ebx, 0xb1d64374
cmp ch, byte [rdi + 0x49]
jno 0x14078b806
cli
movsd dword [rdi], dword [rsi]
out 0xdb, al
push 0x31
fld xword [rdx + 0x31]
xchg cl, cl
sahf
mov gs, eax
or r15b, byte [r9 + 0x32489079]
insb byte [rdi], dx
jmp 0x100454222
mov ebx, 0x9f0f35c6
mov al, 0x87
int1
leave
push rsp
retf
lea rbp, [r14 + r10 + 0x3bb63da4]
setno r14b
add qword [rsp], 0xffffffffbf34a3a9
sub dword [rsp + 0x38], 0x45db27d5
xor byte [rsp + 0x30], r14b
mov r10d, dword [rsp + 0x3c]
xor ebp, 0x23281b4f
cmp bp, word [rsp + 0x3d]
lea r10, [rbp + r10*2 + 0x5df070e3]
jae 0x1406f82cb
call fcn.140760238
mov r15d, 0x6241420b
push rcx
jae 0x14078b797
Function at 0x1407601a5
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
call fcn.140cee97e
add rcx, 0x23cc5beb
add ecx, ecx
mov cx, 0x1721
xor cl, 0x5e
add cx, 0x6402
lea rcx, [rcx*2 + 0x6dd12e9d]
cmp rcx, 0x217210bd
not ecx
not rcx
not rcx
mov rcx, qword [rsp + 0x20]
jno 0x1406f7bbc

Function at 0x140760209
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov r8b, byte [rsp + 0x39]
movzx r8d, word [rsp + 0x3b]
not word [rsp + 0x20]
call fcn.140cbb133

Function at 0x14079e484
Capabilities:
Encode data using xor

Disassembly:
mov rsi, rbp
push r9
movzx r15d, bp
call fcn.140753c33
and qword [rsp + 0x20], 0x61da13c5
and qword [rsp + 0x20], 0x414667ef
xor dword [rsp + 0x20], 0x1bc67ba1
neg byte [rsp + 0x20]
jns 0x140c7e210
xor ebx, edi
pop rsi
jp 0x14079e537
pop rsi
invalid
xchg esi, eax
ja 0x14079e589
invalid
xchg ebx, eax
xchg esp, eax
xchg byte [rbx - 0x58bbdd3f], ch
pop rbp
insd dword [rdi], dx
pop rbx
sbb ch, byte [rdx]
ret 0x9284

Function at 0x14079ed0e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs r10, 0x71e52c5b07453412
mov rdx, r14
not r10b
setbe r14b
not r10
push r11
add qword [rsp + 8], 0xfffffffffffe4602
xor r14d, 0x467e7d9b
neg r14b
mov r11, r14
call fcn.140cee9af

Function at 0x14079ed42
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x10], 0xffffffffbf8ccfe8
not byte [rsp + 0x28]
xor byte [rsp + 0x28], 0xcb
add qword [rsp + 0x28], 0x1bae3729
je 0x140d64e0a
test qword [rsp + 0x28], 0x7e775511
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
call fcn.140e80baa

Function at 0x1407a0870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setno dl
bswap edx
movsxd r14, r14d
neg dx
add r14w, 0x1bcd
mov esi, dword [rsp + 0x84]
jge 0x140d64dd5
jns 0x140702fde
sub r14b, r14b

Function at 0x140c6fa70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x38]
jo 0x140d64db3
ja 0x140c6faa0
loope 0x140c6faf6
sbb byte [rax - 0x61193f91], ch
lodsd eax, dword [rsi]
invalid
xchg byte es:[rdx + 0x2f5776de], ch
pop r9
idiv byte [rsp + rbp*2]
xchg edi, eax
invalid
push qword [rbp - 0x5e]
jns 0x140c6fb3f
lahf
mov ch, 0x59
shl byte cs:[rax], cl
invalid
out dx, al
test eax, 0x9648e6e3
test eax, 0x155c210c
push rsi
xchg edi, eax
invalid

Function at 0x140cb5bf8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r14w, dx
or r14w, 0x176f
test r14w, 0x4066

Function at 0x140cbb0cb
Capabilities:
Check http status code

Disassembly:
mov dword [rsp + 0x38], 0x3dbc3977
not dword [rsp + 0x30]
xor qword [rsp + 0x30], 0x44235e05
sub word [rsp + 0x38], bp
and byte [rsp + 0x38], 0x13
test byte [rsp + 0x3f], bpl
ja 0x14070acf9
lea rbp, [rbp + 0x702e162c]
and word [rsp + 0x38], 0x794
xor qword [rsp + 0x38], 0x74190f45
or qword [rsp + 0x30], 0x25f666ca
mov dword [rsp + 0x38], 0xc7f6e96
lea rbp, [rbp + 0xe5e309e]
mov rbp, qword [rsp + 0x18]
mov word [rsp + 0x30], 0x3733
test dword [rsp + 0x30], 0x15db7072
test byte [rsp + 0x38], 0xc8
mov dword [rsp + 0x38], 0x7cf41d6b
jne 0x14070ac9b
Function at 0x140cc998f
Capabilities:
Encode data using xor

Disassembly:
push rsi
movabs rsi, 0x1a17765411e00a22
pushfq
test esi, esi
setbe sil
push r10
mov r10, rsi
or ah, al
adc dword [rsi + rsi*2 + 0x17], edx
sbb bl, byte [rbp + rax*4 - 0x69f0bf0a]
mov byte [rcx + 0x52], 0x4c
mov edx, esi
sub si, si
push r10
cmp byte [rsp], 0x2b
push r14
call fcn.140d79968
mov bl, 0x91
xor al, 0x72
sbb dh, byte [rsi]
xlatb
xor edi, dword [rdi + 0x3235b753]
mov edi, 0x378c3ad1
mov edi, 0xcf385c6e
xor spl, byte [rdi]
and al, 0xc9
jb 0x140cc9993
sar dword [rdi], 1
mov edi, 0xc2ff68d1
sbb byte [0x1be0d690b], dl
invalid

Function at 0x140cdf590
Capabilities:
Check for software breakpoints

Disassembly:
add r15, rdx
not edx
setg r15b
jb 0x1407881af
sub r8, rcx
mov r15, qword [rsp + 0x78]
je 0x14075300f
cmp qword [rsp + 0x20], 0x7f7010ec
not sil
call fcn.140704cf3
xor byte [rdi - 0x79], 0x66
invalid

Function at 0x140cfc692
Capabilities:
Encode data using xor

Disassembly:
jl 0x1406f9278
jae 0x140c7e4d2
mov ah, byte [rsi - 0x4a]
mov bh, 0xac
and eax, 0x3f5447ee
mov dh, 0x66
push rsi
invalid
jo 0x1407a0897
jno 0x140dbe314
std
adc byte [rsi - 0x8da317d], bl
js 0x140cfc6f1
add dword [rsp + 0x18], 0xbf391213
push rbp
int3
add rbx, rbx
jge 0x140ced973
jns 0x140dbe2cc
xchg edi, eax
sub dx, word [rsi + 0x69]
cmp esp, dword [rdx + 0x341e3a45]
and bh, ch
sub esi, dword [rax - 0x3b]
popfq
mov dh, 0x78
invalid
Function at 0x140d082e7
Capabilities:
Encode data using xor

Disassembly:
not r10
call fcn.14076699e
add qword [rsp], 0xffffffffbf37f5d2
add qword [rsp + 0x20], 0xffffffffbf2f9fee
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
call fcn.140e80baa
push rcx
pushfq
movabs rcx, 0x51643ec95582700e
xor ecx, 0x5d587639
mov cl, 0x16
setg cl
lea rcx, [rcx + rcx + 0x13dc0167]
bswap rcx
call fcn.14070091d
jrcxz 0x140d082f8
and cl, ah
invalid

Function at 0x140d64def
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap rdx
and r11d, dword [rsp + 0x30]
sub byte [rsp + 0x30], 0x72
add byte [rsp + 0x30], 0xad
mov r9d, dword [rsp + 0x31]
setno r9b
mov rdx, qword [rsp + 0x10]
add qword [rsp], 0xffffffffbf329034
or byte [rsp + 0x30], 0x16
and r9b, 0x65
sub r9b, r8b
add qword [rsp + 0x18], 0xffffffffbf911f57
cmp r11w, r8w
lea r9, [r8 + r9 + 0x37c15c66]
lea r9, [r8 + r9*4 + 0x7a9a784d]
bswap r9
movsxd r11, r8d
mov dword [rsp + 0x30], 0x8400a
jno 0x1407228fd
add qword [rsp + 0x20], 0xffffffffbf8cdde1
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x68]
call fcn.140e9b72b
sub r9b, byte [rsp + 0x30]
add r11, qword [rsp + 0x30]
add r9b, 0xa8
neg r11
sete r11b
xor qword [rsp + 0x30], 0x15b825e5
not dword [rsp + 0x30]
or word [rsp + 0x30], 0x603d
mov r8, qword [rsp + 0x20]
test r11d, 0x44971b15
setle byte [rsp + 0x30]
or r11w, r11w
test r11d, r9d
setb r9b
movsx r11d, r9b
lea r9, [r11 + 0x729f3967]
add dword [rsp + 0x30], 0x6600643f
jno 0x140750ba0
bswap rbx
movabs r15, 0x5c73236b703d77c5
call fcn.140798ffe
imul edi, dword [rcx], 0x8bd51f46
invalid
ja 0x1407131a9
cmp qword [rsp + 0x30], 0x439c4a0c
setge r11b
not r9d
mov r9, qword [rsp + 0x40]
setle r11b
xor dword [rsp + 0x30], r11d
and r11, r11
and r11w, word [rsp + 0x36]
mov word [rsp + 0x30], 0xa6a
mov byte [rsp + 0x30], 0x33
movzx r11w, r11b
call fcn.140d79994
in eax, dx
mov esp, 0xd425845
and bh, ch
lahf
jp 0x140750bc6
invalid
add byte [rbx + 0x1c7b1fdd], al
scasd eax, dword [rdi]
mov ecx, 0x844e26b5
mov edx, 0xbae31d9
in al, 0x9f
insd dword [rdi], dx
add byte [rsi], bh
ret 0x1963
setge dl
add r11b, 0xbc
sete byte [rsp + 0x30]
movsx r11, byte [rsp + 0x30]
test r11b, 0x95
mov rdi, qword [rsp + 0x48]
movzx r11w, byte [rsp + 0x33]
cmovo edx, r9d
xor r11w, 0x16af
setg r9b
bswap r9d
neg r8
jae 0x1407131b7
bswap r11d
add qword [rsp + 8], 0xffffffffffa6bf3e
neg dword [rsp + 0x30]
and r8d, 0x32bf0270
lea rdx, [r9 + rdx*4 + 0x50fa2d0a]
neg r8d
xor dword [rsp + 0x30], 0x6c84670
or r8, 0x7d774363
sub byte [rsp + 0x30], 0x30
ja 0x14071315f
Function at 0x140d805e7
Capabilities:
Encode data using xor

Disassembly:
not dword [rsp + 0x58]
sub byte [rsp + 0x40], r14b
add word [rsp + 0x58], 0x49c8
xor r9, r14
mov r9, qword [rsp + 0x98]
xor word [rsp + 0x70], 0x72ee
and r14w, r14w
sub r14, 0x3a434e04
cmp si, word [rsp + 0x69]
lea rsp, [rsp + 0x18]
ret 8
setge r12b
je fcn.140cac4f3
test dword [rsp + 0x60], 0x599c5b48
mov rdi, qword [rsp + 0x90]
cmova r9, r14
add qword [rsp + 0x20], 0xfffffffffffdeca2
or dword [rsp + 0x60], r9d
call fcn.140c9eb54
setns r9b
or dword [rsp + 0x60], esi
mov word [rsp + 0x30], 0x1cac
xor word [rsp + 0x30], 0x6667
xor qword [rsp + 0x68], 0x48e1e0e
add esi, 0x3f6d6fca
cmp r14, rsi
call fcn.1406f53b7
mov edx, 0x10669a1c
invalid
jo 0x14072cd1f
sub r9, rdi
call fcn.14072cd09
jl 0x14077eeb1
cmp word [rsp + 0x38], 0x3429
call fcn.1406fd14e
seto byte [rsp + 0xa0]
sub dword [rsp + 0x38], 0x7b3a0929
and word [rsp + 0xa0], 0x32cf
bswap rsi
call fcn.140752fb0
call fcn.140713f36
bswap r9d
sub r12, r12
or byte [rsp + 0x40], r9b
add qword [rsp], 0xffffffffbf84bbc8
cmp byte [rsp + 0x38], r12b
jb 0x140dc2835
mov dword [rsp + 0x58], edi
jns 0x140cb6b23
jns 0x1406f53db
and qword [rsp + 0x58], 0x76811d6e
not dword [rsp + 0x38]
test di, 0x785c
bswap edx
lea rdx, [rdi + rdx*8 + 0x439c1876]
not qword [rsp + 0x38]
jae 0x140d75463
cmpsd dword [rsi], dword [rdi]
punpcklbw mm1, dword [rsp + rbp*2]
movabs byte [0xb389e45878f39da6], al
invalid

Function at 0x140d8d2ba
Capabilities:
Encode data using xor

Disassembly:
jae 0x14074d6c1
cmp dword [rsp + 0x48], 0x119c107e
cmovo r12w, r13w
lea r12, [r13 + r13*8 + 0x2a2c5bbb]
neg r13d
setbe r13b
bswap r12
movzx r12d, word [rsp + 0x4a]
not r12b
jg 0x140da698f
jne 0x140c72993
mov rbx, qword [rsp + 8]
neg byte [rsp + 0x20]
jbe 0x140d03a8a
stc
xchg edx, eax
bt dword [rsi - 0x80], edx
outsd dx, dword ds:[rsi]
hlt
and r13w, word [rsp + 0x4c]
sete r12b
add qword [rsp], 0xffffffffbf268fe1
neg r12d
xor dword [rsp + 0x48], 0x41bc05ef
cmovs r12w, r13w
and r13d, 0x303b71e5
not r12d
jne 0x14078c052
Function at 0x140d97635
Capabilities:
Encode data using xor

Disassembly:
fbld tbyte [rsi + 0x32]
std
clc
or esp, dword [rax + 0x5b788204]
invalid
sub r9w, r14w
add qword [rsp + 0x10], 0xfffffffffffeb40d
sub r12d, 0x59257ca1
sub esp, 0x59257ca1
in al, dx
movabs eax, dword [0x748b4c514159257c]
and al, 0x10
push r9
mov r14, qword [rsp + 0x10]
call fcn.140c87c28
mov bh, byte [rsi - 0xaa1d72]
push rbx
jns 0x140d9767b
ror dword [rcx + 0x741d6423], cl
and eax, 0xa51d7fa9
adc al, 0xa4
mov ecx, 0x69a67ce2
cwde
loop 0x140d975f6
jns 0x140d97682
sbb eax, 0x6734359f
sbb eax, 0x83e518f9
loop 0x140d976fa
add dword [rbx - 0x77], edi
loop 0x140d9768d
invalid
ja 0x140d976ad
cmpsd dword [rsi], dword [rdi]
sbb eax, 0xc1e28f3b
cmp ecx, dword [rbx - 0x6e]
loop 0x140d97650
ror dword [r9 - 0x3341631e], 0x4f
sbb eax, 0x6e01440e
sbb eax, 0xb165ab31
loop 0x140d97644
scasd eax, dword [rdi]
pop rsp
xchg ecx, eax
loop 0x140d9771c
jp 0x140d97643
jne 0x140d976d5
mov cl, 0x88
leave
mov cl, cl
xor rax, 0x26e465cc
cmp eax, 0x3868333c
jbe 0x140d976b9
cmp ch, byte [rdi + 0x1d]
sub eax, 0x3b11e91f
cmp byte [0x1134faa39], cl
in al, 0x25
ror byte [rsp + riz*8 + 0x25], cl
invalid
sti
or byte [rax + 0x199b6b80], dh
stosd dword [rdi], eax
stosb byte [edi], al
orps xmm5, xmm1
pop rdi
sbb eax, dword [rbx + 0x53bb9d6]
sahf
in eax, 0x6b
ja 0x140d97707
mov edi, dword ds:[rcx - 0x57]
pop rsp
xchg esp, eax
jmp 0xea5a9c06
sub dword [rcx + 0x59a8afe], 0xc7cd7290
sub eax, 0x4e975b92
push rdi
mov byte fs:[rsi + 0x31], 0x89
jmp 0x14e4905f4

Function at 0x140dbd5e5
Capabilities:
Encode data using xor

Disassembly:
or qword [rsp + 0x28], 0x7e467797
add qword [rsp], 0xfffffffffffcc3b8
mov rbp, qword [rsp + 8]
bswap r9
not dword [rsp + 0x28]
call fcn.140753d1c
test ebp, ebx
movzx r10, byte [rsp + 0x28]
je 0x14078c2f9
or bl, sil
jno 0x140c77f86
sub r10w, 0x415c
lea r8, [r10 + r8*2 + 0x484b3bbc]
pop rsp
lea r8, [r10 + r8*2 + 0x484b3bbc]
neg r8w
and r8b, 0xb9
not r10w
xor r8d, 0x4d3119cd
and r10w, 0x2646
push r10
movabs r10, 0x7115602969c75ccc
push rsi
xor qword [rsp + 8], 0x16a071bb
call fcn.140da1e92
sub r9, r9
lea r9, [r9*8 + 0x15986a15]
movzx r9d, r9w
push rbp
push rdx
call fcn.140cb9109
stosd dword [rdi], eax
and edi, edi
jge 0x140dbd600
in eax, dx
push 0xffffffffffffffd8
mov cl, 0xed
push rcx
fild dword [rax - 0x33]
invalid
Function at 0x2fc4d0330
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d0d32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d0dca
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d0dae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d0da2
cmp qword [rbp - 0x10], 0
je 0x2fc4d0da2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0d68
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d0dcb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d0ed0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0ef8
mov eax, 0
jmp 0x2fc4d0f46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0f21
mov eax, 0
jmp 0x2fc4d0f46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0f41
mov eax, 0
jmp 0x2fc4d0f46
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0f4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d0fca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0fc1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0fc1
mov rax, qword [rbp - 8]
jmp 0x2fc4d0fdf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0f94
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc51bbf0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc51c5f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc53f108]
test eax, eax
je 0x2fc51c68a
lea rax, [0x2fc53f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc53f110]
mov qword [rbp - 8], rax
jmp 0x2fc51c66e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc51c662
cmp qword [rbp - 0x10], 0
je 0x2fc51c662
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc51c628
lea rax, [0x2fc53f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc51c68b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc51c790
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc51c7b8
mov eax, 0
jmp 0x2fc51c806
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc51c7e1
mov eax, 0
jmp 0x2fc51c806
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc51c801
mov eax, 0
jmp 0x2fc51c806
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc51c80c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc51c88a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc51c881
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc51c881
mov rax, qword [rbp - 8]
jmp 0x2fc51c89f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc51c854
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d4820
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d5222
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f7108]
test eax, eax
je 0x2fc4d52ba
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f7110]
mov qword [rbp - 8], rax
jmp 0x2fc4d529e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5292
cmp qword [rbp - 0x10], 0
je 0x2fc4d5292
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5258
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d52bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d53c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d53e8
mov eax, 0
jmp 0x2fc4d5436
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5411
mov eax, 0
jmp 0x2fc4d5436
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5431
mov eax, 0
jmp 0x2fc4d5436
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d543c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d54ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d54b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d54b1
mov rax, qword [rbp - 8]
jmp 0x2fc4d54cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5484
mov eax, 0
add rsp, 0x20
pop rbp
ret