joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180038600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
lea r13d, [rdx + 0x144]
mov r14, r9
mov r15, r8
mov ebp, edx
mov rsi, rcx
cmp edx, r13d
jae 0x1800386fb
mov r12, qword [rsp + 0x38]
xor ebx, ebx
mov edi, dword [rsp + 0x98]
lea eax, [rbp - 0x6a]
lea rdx, [0x180000000]
cmp eax, 0xb4
ja case.0x18003866f.115
movzx eax, byte [rdx + rax + 0x38888]
mov ecx, dword [rdx + rax*4 + 0x38860]
add rcx, rdx
jmp rcx
mov edi, 1
mov ebp, 0xfa
jmp case.0x18003866f.115
mov r15, qword [0x180070460]
mov r14d, dword [rsi]
test r15, r15
je 0x1800386df
mov esi, 0xcb
cmp esi, 0xcb
je 0x1800386c5
cmp esi, 0xd47
je 0x1800386d7
cmp esi, 0x51ad
jne 0x1800386c9
mov r8, r15
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x30]
mov ecx, 0x12b
call fcn.18003da20
jmp 0x1800386c9
mov dword [r12], r14d
add esi, 0x50e2
cmp esi, 0x14388
jbe 0x180038691
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xa0]
add ebp, 0x24
cmp ebp, r13d
jb 0x180038648
mov rax, qword [rsp + 0x30]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x38]
mov r9d, 0xf9
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call fcn.1800186e0
mov byte [rsi], al
jmp case.0x18003866f.115
mov qword [rsp + 0x38], r14
mov edi, ebx
mov dword [rsp + 0x98], ebx
jmp case.0x18003866f.115
mov eax, dword [r15]
lea r9, [rsp + 0x98]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov r8d, 0x4d
mov dword [rsp + 0x30], eax
call fcn.180017180
mov rcx, qword [rsp + 0x38]
mov rdi, rax
movsxd rdx, dword [rsp + 0x98]
cdqe
add rcx, rax
movsxd rax, dword [r15]
sub rdx, rcx
mov qword [rsp + 0x38], rcx
add rdx, r14
cmp rdx, rax
jle case.0x18003866f.115
mov ebp, 0xfa
jmp case.0x18003866f.115
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x38]
mov r9d, 0xf9
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call fcn.1800186e0
cmp al, 1
je case.0x18003866f.115
mov ebp, 0xfa
jmp case.0x18003866f.115
mov ecx, dword [rsi]
mov edx, 0x4000
mov eax, ecx
test ecx, ecx
je 0x180038841
sub eax, 1
je 0x180038834
cmp eax, 1
je 0x180038827
cmp ecx, 0x8000
ja 0x18003881e
mov r8d, 0x8001
sub r8d, ecx
nop word [rax + rax]
lea ecx, [rdx + rdx]
xor ecx, edx
shr edx, 1
mov eax, edx
and ecx, 2
shl ecx, 0xd
and eax, 0x3fff
mov edx, ecx
or edx, eax
sub r8, 1
jne 0x180038800
mov dword [rsp + 0x30], edx
jmp 0x1800386fb
mov dword [rsp + 0x30], 0x10003
jmp 0x1800386fb
mov dword [rsp + 0x30], 0x18003
jmp 0x1800386fb
mov dword [rsp + 0x30], 0xffffffff
jmp 0x1800386fb
mov dword [rsp + 0x30], edi
jmp 0x1800386fb
mov rax, rbx
jmp 0x180038700
Function at 0x18003fda0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
imul eax, r8d, 0x86e
mov rbp, r9
mov r12d, r8d
mov rdi, rdx
mov r15, rcx
mov esi, r8d
mov dword [rsp + 0x68], eax
cmp r8d, eax
ja 0x180040028
mov r14, qword [rsp + 0x78]
xor ebx, ebx
mov r13, qword [rsp + 0x78]
mov r8d, 0x1010
cmp esi, 0x3021
ja 0x18003fefe
je 0x18003fef0
cmp esi, 0xa9
ja 0x18003fe91
je 0x18003fe65
cmp esi, 0x25
je 0x18003fe35
cmp esi, 0x3f
je 0x180040003
cmp esi, 0x44
jne 0x18003ffee
mov qword [rsp + 0x70], rbx
jmp 0x18003ffee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xffffffff
mov eax, SHSetFolderPathA
cmp word [rdi], ax
ja 0x18004001c
mov r13, qword [0x180074e00]
mov r8d, 0x1010
lea r14, [r13 + 9]
jmp 0x18003ffee
test rdi, rdi
je 0x18003ffee
mov rcx, qword [r15]
cmp rcx, qword [rdi + 8]
je 0x180040017
jae 0x18003fe83
mov rdi, qword [rdi + 0x10]
jmp 0x18003fe87
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x18003fe71
jmp 0x18003ffee
cmp esi, 0x1823
je 0x18003fea4
cmp esi, 0x2c5c
jmp 0x18003ffec
mov dword [rsp + 0x58], 8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rbx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rdx, r14
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0xfc
mov qword [rsp + 0x20], rax
call fcn.180018150
mov r14, rax
mov r8d, 0x1010
jmp 0x18003ffee
movzx eax, word [rdi]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
jmp 0x18003feb1
cmp esi, 0x781b
ja 0x18003ffde
je 0x18003ffd5
cmp esi, 0x481f
je 0x18003ff4d
cmp esi, 0x601d
je 0x18003ff36
cmp esi, 0x6e3f
jne 0x18003ffee
mov qword [rsp + 0x70], rbx
jmp 0x18003ffee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rsp + 0x78]
mov r8d, 0x1010
mov dword [rax], ecx
jmp 0x18003ffee
movzx eax, word [rdi]
movzx edx, bx
cmp bx, ax
jae 0x18003ff78
nop dword [rax + rax]
movzx eax, dx
inc dx
movzx ecx, byte [rax + rbp]
mov byte [r14], cl
inc r14
movzx eax, word [rdi]
cmp dx, ax
jb 0x18003ff60
add al, 8
mov word [rsp + 0x50], r8w
lea r8, [rsp + 0x50]
mov byte [rsp + 0xc0], al
mov r9, r13
lea rdx, [rsp + 0xc0]
mov ecx, 0x7d
call fcn.18002e300
mov eax, 0x1010
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
mov word [rsp + 0xc0], ax
mov r8d, 0x5d
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call fcn.180022f70
mov r8d, 0x1010
jmp 0x18003ffee
mov eax, dword [rsp + 0x7c]
mov dword [r15], eax
jmp 0x18003ffee
cmp esi, 0x9019
je 0x18004001c
cmp esi, 0xdbd5
je 0x180040028
imul eax, r12d, 0xa6
add esi, eax
cmp esi, dword [rsp + 0x68]
jbe 0x18003fdf4
jmp 0x180040028
cmp dword [r15], 0x71
je 0x18004000e
mov rax, rbx
jmp 0x18004002d
lea rax, [0x18006d8f8]
jmp 0x18004002d
mov rax, rdi
jmp 0x18004002d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
mov dword [rsp + 0x70], ecx
mov rax, qword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800403f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
lea esi, [rdx - 5]
mov rbp, r9
mov ebx, edx
mov rdi, rcx
cmp edx, esi
jbe 0x180040494
mov rdx, qword [rsp + 0x30]
xor r14d, r14d
mov eax, ebx
sub eax, 0xa9
je 0x180040494
sub eax, 1
je 0x18004047b
sub eax, 3
je 0x180040488
sub eax, 1
je 0x18004046f
cmp eax, 1
jne 0x180040480
mov qword [0x180070418], rdi
lea r8, [0x180023a60]
mov qword [rsp + 0x28], r14
mov r9, rdi
xor edx, edx
mov qword [rdi + 0x80], rbp
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
jmp 0x180040480
test rdx, rdx
jne 0x180040480
mov byte [rsp + 0x30], r14b
jmp 0x180040494
mov qword [rsp + 0x30], r14
dec ebx
cmp ebx, esi
ja 0x180040421
jmp 0x180040494
xchg qword [0x180070420], rdx
mov byte [rsp + 0x30], 1
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800485f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x180070338]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea edi, [r8 + 0x3c]
mov rsi, r9
mov r14, rdx
mov r13, rcx
cmp r8d, edi
jae case.0x18004866e.4
mov r15, qword [rsp + 0x48]
lea ebx, [r8 - 0x25]
mov r12d, dword [rsp + 0x38]
lea rdx, [0x180000000]
mov rbp, qword [rsp + 0x48]
xor r8d, r8d
nop dword [rax]
cmp ebx, 0xd1
ja case.0x18004866e.8
movzx eax, byte [rdx + rbx + 0x487c4]
mov ecx, dword [rdx + rax*4 + 0x487a0]
add rcx, rdx
jmp rcx
movsd xmm0, qword [r14 + 8]
movsd qword [rsp + 0x30], xmm0
jmp case.0x18004866e.8
mov dword [rsi + 0x18], 8
mov eax, dword [rsi + 4]
and eax, 0xf8
mov dword [rsp + 0x30], eax
jmp case.0x18004866e.8
mov r15, r8
mov r12d, 0x36
jmp case.0x18004866e.8
test rbp, rbp
je 0x1800486c8
xor edx, edx
mov r9, rbp
xor r8d, r8d
lea ecx, [rdx + 0x19]
call fcn.180045820
cmp eax, 1
je 0x180048761
xor r8d, r8d
mov r9d, dword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov edx, r12d
mov qword [rsp + 0x20], r8
mov rcx, r15
mov r8, qword [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18004866e.8
mov eax, dword [rsi + 8]
mov byte [r14], al
cmp byte [r13], 1
jne 0x18004870e
mov dword [rsi], 4
jmp case.0x18004866e.8
mov dword [rsi + 0x18], 4
jmp case.0x18004866e.8
mov eax, dword [r14]
lea rcx, [rsi + 0x48]
xor r9d, r9d
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x40]
lea edx, [r9 + 0x79]
call fcn.180046370
xor r8d, r8d
lea rdx, [0x180000000]
mov qword [rsp + 0x48], r8
mov rbp, rax
mov dword [rsp + 0x38], r8d
jmp case.0x18004866e.8
mov qword [rsp + 0x30], r8
add ebx, 5
lea eax, [rbx + 0x25]
cmp eax, edi
jb 0x180048650
jmp case.0x18004866e.4
movsd xmm0, qword [0x180067480]
movsd qword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180058e50
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800505f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
lea esi, [r8 - 4]
mov edi, r8d
mov r14, rdx
mov rbp, rcx
cmp r8d, esi
jbe 0x180050659
mov ebx, dword [rsp + 0x60]
nop dword [rax + rax]
mov eax, edi
sub eax, 0xc5
je 0x1800506d4
sub eax, 4
je 0x180050641
sub eax, 3
je 0x180050671
cmp eax, 1
jne 0x180050653
lea ebx, [rax + 0xf]
jmp 0x180050653
mov r9d, 0xa5
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000ae10
dec edi
cmp edi, esi
ja 0x180050620
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, dword [r14]
mov eax, ecx
test ecx, ecx
je 0x1800506ca
sub eax, 1
je 0x1800506c0
cmp eax, 1
je 0x1800506b6
cmp ecx, 0x20
ja 0x1800506b0
mov edx, 0x21
sub edx, ecx
lea ecx, [rbx*4]
xor ecx, ebx
shr ebx, 1
mov eax, ebx
and ecx, 4
shl ecx, 2
and eax, 0xf
mov ebx, ecx
or ebx, eax
sub rdx, 1
jne 0x180050690
mov dword [rsp + 0x20], ebx
jmp 0x180050659
mov dword [rsp + 0x20], 0x42
jmp 0x180050659
mov dword [rsp + 0x20], 0x62
jmp 0x180050659
mov dword [rsp + 0x20], 0xffffffff
jmp 0x180050659
cmp dword [rbp], 0x71
je 0x1800506de
xor eax, eax
jmp 0x18005065e
lea rax, [0x18006e2a8]
jmp 0x18005065e

Function at 0x1800506f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [rsp]
lea r9d, [rdx + 4]
cmp edx, r9d
jae 0x1800507cc
mov r8d, edx
sub r8d, 0xe3
je 0x1800507cc
sub r8d, 4
je 0x180050794
sub r8d, 1
je 0x1800507cc
cmp r8d, 3
jne 0x18005079a
mov ecx, dword [rcx]
lea edx, [r8 + 0x7d]
mov eax, ecx
test ecx, ecx
je 0x1800507c1
sub eax, 1
je 0x1800507b1
cmp eax, 1
je 0x1800507a1
cmp ecx, 0x100
ja 0x180050788
mov r8d, 0x101
sub r8d, ecx
nop word [rax + rax]
lea ecx, [rdx*4]
xor ecx, edx
add ecx, ecx
xor ecx, edx
add ecx, ecx
xor ecx, edx
shr edx, 1
mov eax, edx
and ecx, 0x10
shl ecx, 3
and eax, 0x7f
mov edx, ecx
or edx, eax
sub r8, 1
jne 0x180050760
mov dword [rsp], edx
mov rax, qword [rsp]
add rsp, 0x18
ret
xor eax, eax
mov qword [rsp], rax
inc edx
jmp 0x1800506fc
mov dword [rsp], 0x202
mov rax, qword [rsp]
add rsp, 0x18
ret
mov dword [rsp], 0x302
mov rax, qword [rsp]
add rsp, 0x18
ret
mov dword [rsp], 0xffffffff
mov rax, qword [rsp]
add rsp, 0x18
ret
Function at 0x180053a80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
lea ebp, [r8 + 4]
mov r14, r9
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp r8d, ebp
jae 0x180053baa
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xd7
je 0x180053b7b
sub eax, 1
je 0x180053adb
sub eax, 3
je 0x180053b8c
cmp eax, 4
jne 0x180053b80
xor eax, eax
jmp 0x180053baf
movzx eax, byte [r14]
cmp al, 0x1e
jne 0x180053b04
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rsi]
mov edx, 1
mov r9, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180053b80
cmp al, 0x1f
jne 0x180053b0f
mov ecx, 2
jmp 0x180053ae8
cmp al, 0xd
je 0x180053b39
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rsi]
mov edx, 1
mov r9, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 1
jmp 0x180053b5d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rsi]
mov edx, 1
mov r9, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edx, 1
lea rcx, [rsp + 0x60]
mov r8d, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180053b80
mov byte [rsp + 0x60], 0xa
inc ebx
cmp ebx, ebp
jb 0x180053ab0
jmp 0x180053baa
mov rdx, qword [r14]
test rdx, rdx
je 0x180053ba2
cmp dword [rdx], 1
jne 0x180053ba2
mov eax, dword [rdx + 0x14]
mov dword [rsp + 0x20], eax
jmp 0x180053baa
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1800563f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
imul r15d, r8d, 0x93
mov rsi, r9
mov r14d, r8d
mov rbp, rdx
mov r13, rcx
mov edi, r8d
cmp r8d, r15d
ja 0x180056547
mov r12d, dword [rsp + 0x90]
xor ebx, ebx
nop word [rax + rax]
cmp edi, 0xe2
ja 0x1800564de
je 0x1800564c0
mov eax, edi
sub eax, 0x85
je 0x18005652d
sub eax, 0x20
je 0x180056521
cmp eax, 0x34
jne 0x180056510
xor r9d, r9d
lea edx, [rax + 0x61]
xor r8d, r8d
xor ecx, ecx
call fcn.18001f6d0
mov qword [rsp + 0x38], rbx
mov r9, rsi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov r8d, 0xae
mov qword [rsp + 0x20], rbx
call fcn.18003a5a0
xor r9d, r9d
movzx r12d, al
xor r8d, r8d
mov dword [rsp + 0x20], 0x8d
xor edx, edx
xor ecx, ecx
call fcn.180030620
jmp 0x180056510
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1800564cf
mov qword [rax + 0x18], rbp
jmp 0x180056510
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x180056510
mov qword [rax + 0x28], rbp
jmp 0x180056510
cmp edi, 0x12a6
je 0x180056542
cmp edi, 0x136c
je 0x1800564fc
cmp edi, 0x25f6
jne 0x180056510
mov qword [rsi + 0x10], rbp
jmp 0x180056510
mov rax, qword [rsi + 0x10]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rsi
mov rax, qword [rsi + 0x30]
mov qword [rbp + 0x30], rax
imul eax, r14d, 0x15
add edi, eax
cmp edi, r15d
jbe 0x180056440
jmp 0x180056547
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [r13], 0x71
je 0x180056539
mov rax, rbx
jmp 0x18005654c
lea rax, [0x18006e2a8]
jmp 0x18005654c
mov dword [rsp + 0x40], r12d
mov rax, qword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x2fc542620
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc543022
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc565108]
test eax, eax
je 0x2fc5430ba
lea rax, [0x2fc5650e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc565110]
mov qword [rbp - 8], rax
jmp 0x2fc54309e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc543092
cmp qword [rbp - 0x10], 0
je 0x2fc543092
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc543058
lea rax, [0x2fc5650e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5430bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5431c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5431e8
mov eax, 0
jmp 0x2fc543236
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc543211
mov eax, 0
jmp 0x2fc543236
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc543231
mov eax, 0
jmp 0x2fc543236
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc54323c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5432ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5432b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5432b1
mov rax, qword [rbp - 8]
jmp 0x2fc5432cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc543284
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
lea r8, str.Shell_TrayWnd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x140003628], rax
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rcx, qword [0x140003628]
mov r8d, 1
mov rdx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_SetWindowRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000194c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001996
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001996
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001996
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001996
cmp dword [rcx + 0x84], 0xe
jbe 0x140001996
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001998
xor al, al
add rsp, 0x28
ret
Function at 0x140001ce0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x17]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x17
jb 0x140001ce6
mov rax, rcx
ret

Function at 0x140001cfc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x13]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x13
jb 0x140001d02
mov rax, rcx
ret

Function at 0x140001d18
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xe]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xe
jb 0x140001d1e
mov rax, rcx
ret

Function at 0x140001d34
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x12
jb 0x140001d3a
mov rax, rcx
ret

Function at 0x140001d50
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x11]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x11
jb 0x140001d56
mov rax, rcx
ret

Function at 0x140001d6c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x10]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x10
jb 0x140001d72
mov rax, rcx
ret

Function at 0x140001d88
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x15]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x15
jb 0x140001d8e
mov rax, rcx
ret

Function at 0x140001da4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x14]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x14
jb 0x140001daa
mov rax, rcx
ret

Function at 0x140001dc0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 9]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 9
jb 0x140001dc6
mov rax, rcx
ret

Function at 0x140001ddc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xc]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xc
jb 0x140001de2
mov rax, rcx
ret

Function at 0x140001df8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xd]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xd
jb 0x140001dfe
mov rax, rcx
ret

Function at 0x140001e14
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 9
jb 0x140001e1a
mov rax, rcx
ret

Function at 0x140001e38
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 2]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 2
jb 0x140001e3e
mov rax, rcx
ret

Function at 0x140003334
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 5]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 5
jb 0x14000333a
mov rax, rcx
ret

Function at 0x140003350
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x4a]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x25
jb 0x140003356
mov rax, rcx
ret