joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005300
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180034008]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx], 0
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
jne 0x18000533a
xor r8d, r8d
jmp 0x18000534a
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x180005340
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.180003f20
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
cmp rdi, 0x10
mov r8d, 0x20
cmovae rcx, rbx
cmp qword [rsp + 0x40], r8
cmovb r8, qword [rsp + 0x40]
test r8, r8
je 0x180005394
lea rdx, str.llccxnETPyDrgoAfpKsMMUqDKnalcNCd
call fcn.180023580
test eax, eax
jne 0x1800053ca
cmp qword [rsp + 0x40], 0x20
jne 0x1800053ca
mov qword [rsp + 0x28], 0
lea r8, [0x1800052d0]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.18000cdb4
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
cmp rdi, 0x10
jb 0x180005406
lea rax, [rdi + 1]
cmp rax, 0x1000
jb 0x1800053fe
test byte [rsp + 0x30], 0x1f
jne 0x18000541e
mov rax, qword [rbx - 8]
cmp rax, rbx
jae 0x180005424
sub rbx, rax
cmp rbx, 8
jb 0x18000542a
cmp rbx, 0x27
ja 0x180005430
mov rbx, rax
mov rcx, rbx
call fcn.1800086f8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180008690
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.180010f74
int3
call fcn.180010f74
int3
call fcn.180010f74
int3
call fcn.180010f74
int3
Function at 0x180006190
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x298
mov rax, qword [0x180034008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x258
call fcn.18000bfa0
lea rdx, str._shellexContextMenuHandlersEasyPdfReader64
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.1BFA6B3E_7441_4E72_B865_8363000E40F2
lea rdx, str.CLSID_sInprocServer32
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.1BFA6B3E_7441_4E72_B865_8363000E40F2
lea rdx, str.CLSID_sSettings
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.1BFA6B3E_7441_4E72_B865_8363000E40F2
lea rdx, str.CLSID_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180008690
add rsp, 0x298
ret
Function at 0x2fc4d4270
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d5350
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d4c72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f7108]
test eax, eax
je 0x2fc4d4d0a
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f7110]
mov qword [rbp - 8], rax
jmp 0x2fc4d4cee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4ce2
cmp qword [rbp - 0x10], 0
je 0x2fc4d4ce2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d4ca8
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d4d0b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4e10
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4e38
mov eax, 0
jmp 0x2fc4d4e86
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4e61
mov eax, 0
jmp 0x2fc4d4e86
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4e81
mov eax, 0
jmp 0x2fc4d4e86
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d4e8c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d4f0a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4f01
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4f01
mov rax, qword [rbp - 8]
jmp 0x2fc4d4f1f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4ed4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d3dc0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4ea0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d47c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f7108]
test eax, eax
je 0x2fc4d485a
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f7110]
mov qword [rbp - 8], rax
jmp 0x2fc4d483e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4832
cmp qword [rbp - 0x10], 0
je 0x2fc4d4832
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d47f8
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d485b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4960
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4988
mov eax, 0
jmp 0x2fc4d49d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d49b1
mov eax, 0
jmp 0x2fc4d49d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d49d1
mov eax, 0
jmp 0x2fc4d49d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d49dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d4a5a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4a51
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4a51
mov rax, qword [rbp - 8]
jmp 0x2fc4d4a6f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4a24
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14001080d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shrd eax, r10d, 0x8d
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
dec rdi
push r14
movsxd rsi, ebx
cmp rbx, rbp
push r15
cmp r9, rax
btc si, dx
mov rbp, rsp
sub rsp, 0x60
mov eax, dword [0x1400094e8]
mov rdi, rdx
cmp r13, rsp
mov rsi, rcx
jmp 0x140010852
test al, 1
jmp 0x140010859
jne 0x14001094c
or eax, 1
jmp 0x140010867
mov dword [rbp - 0x40], 0xafada3a5
jmp 0x140010873
mov dword [0x1400094e8], eax
jmp 0x14001087e
xorps xmm0, xmm0
sub eax, eax
cqo
neg edx
mov dword [rbp - 0x3c], 0xa7a5a3ad
dec dh
rcr cl, 0x10
shr dh, 0x97
mov dword [rbp - 0xc], eax
xor r8d, r8d
movsxd rdx, r14d
btc dx, 0xee
mov word [rbp - 8], ax
movzx dx, ch
mov dl, sil
mov dword [rbp - 0x38], 0x968083a5
or dx, dx
cmp r14b, dil
and cl, r15b
mov dword [rbp - 0x34], 0xf0f2e784
inc cl
mov dword [rbp - 0x30], 0xedecfce5
shl rdx, cl
mov dword [rbp - 0x2c], 0xfae6e5eb
rcr rdx, cl
sub cl, 0x6e
mov dword [rbp - 0x28], 0xe4f1fafa
cdq
mov dword [rbp - 0x24], 0xe8efe9f8
mov dword [rbp - 0x20], 0x33e0e0fd
rcr dl, cl
movups xmmword [rbp - 0x1c], xmm0
sub al, 0x5e
mov cl, byte [rbp + r8 - 0x40]
lea edx, [r8 - 0x4d]
dec al
mov al, dl
and al, cl
cmp r12w, r12w
add al, al
sub dl, al
add dl, 0x1b
clc
add dl, cl
mov byte [rbp + r8 - 0x40], dl
jmp 0x140010924
inc r8
cmp r8, 0x3a
jmp 0x140010930
jb 0x1400108fd
lea rax, [rbp - 0x40]
sub r15b, 0xde
not r15b
bsr r15d, edx
mov qword [0x1400094f0], rax
cmp dword [0x1400094dc], 0
seto r15b
movzx r15w, bl
mov r15b, r8b
lea r15, section..data
jmp 0x14001096b
jne 0x140010a2a
movabs rax, 0xfffff78000000014
movzx rbx, r13w
mov r14d, 2
setl bl
movzx rcx, r12w
mov rax, qword [rax]
seta bh
cmovno cx, dx
mov qword [0x1400094e0], rax
bswap cx
cmovp ecx, r11d
mov dword [0x1400094dc], eax
jmp 0x1400109af
mov rax, qword [0x140009358]
lea rcx, [0x1400094dc]
mov bl, bpl
movzx bx, r12b
mov rbx, qword [0x1400094f0]
jmp 0x1400109d1
call rax
mov r8d, eax
mov eax, 0xd41d41d5
shld edx, esp, 0x8e
bts cx, r11w
mul r8d
xor al, bpl
mov ecx, r8d
sub ecx, edx
and al, al
sar al, 7
shr ecx, 1
sar al, cl
add ecx, edx
shr ecx, 5
test r14w, si
imul ecx, ecx, 0x23
sub r8d, ecx
mov al, byte [rbx + r8]
jmp 0x140010a10
mov byte [r14 + r15], al
inc r14
clc
cmp r14, 0xff
jmp 0x140010a24
jl 0x1400109af
test rsi, rsi
jmp 0x140010a32
je 0x140010a97
test rdi, rdi
jmp 0x140010a40
jne 0x140010a5f
or rdi, 0xffffffffffffffff
inc rdi
test r10d, 0x35b66151
cmc
cmp byte [rsi + rdi], 0
jne 0x140010a4a
mov eax, 0x100
cmc
test sil, 0xbf
cmp rdi, rax
cmova rdi, rax
clc
cmc
test rdi, rdi
jmp 0x140010a7a
je 0x140010a97
mov r8, rdi
mov dx, r15w
mov rdx, r15
mov rcx, rsi
jmp 0x140010a92
call fcn.1400189e4
lea r11, [rsp + 0x60]
bswap ebp
xchg bpl, r15b
jmp 0x140010aa6
mov rax, rsi
mov rbx, qword [r11 + 0x20]
seta bpl
movzx edi, r8w
mov rsi, qword [r11 + 0x28]
movsx r15, dx
xchg r15b, bpl
mov rdi, qword [r11 + 0x30]
cmove rbp, r15
not r15w
movsx r15d, r12w
mov rsp, r11
cmovge r15, rax
mov bp, 0x3e16
pop r15
mov r14b, 0x6c
bswap r14w
pop r14
bswap rbp
mov ebp, r8d
movsxd rbp, r15d
pop rbp
jmp 0x140010af5
ret
Function at 0x140014aff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor dil, 5
push rbp
shl di, 0x19
mov rbp, rsp
sar ebx, 0x78
bsf ebx, eax
sub rsp, 0x60
mov edi, edx
inc bx
mov rbx, rcx
clc
test r10b, spl
lea rdi, [rdi + rcx]
cmc
sub eax, eax
mov dword [rbp - 0x40], 0x8b8a8d0f
xorps xmm0, xmm0
mov dword [rbp - 0x2c], eax
movups xmmword [rbp - 0x3c], xmm0
not dl
movsx rcx, sp
sar cl, cl
xor r9d, r9d
rol r8b, cl
mov r8b, byte [rbp + r9 - 0x40]
cmc
sar cl, cl
lea edx, [r9 + 0x42]
mov cl, bpl
mov al, dl
sal rcx, cl
and ch, 0x62
inc cl
mov ecx, 0x19
cmp r15d, ebp
and al, r8b
test r12w, bx
cmp rsi, r14
sub cl, al
cmc
add cl, cl
cmp r9b, 0x77
test r12b, r13b
cmc
add cl, dl
cmc
add cl, r8b
jmp 0x140014b94
mov byte [rbp + r9 - 0x40], cl
jmp 0x140014b9e
inc r9
cmp r14b, 1
cmp r9, 0x18
jmp 0x140014bae
jb 0x140014b51
movzx eax, byte [rbx]
cmp eax, dword [rbp - 0x40]
jmp 0x140014bbf
jne 0x140014c4e
sub eax, eax
jmp 0x140014bcc
mov dword [rbp - 0x28], 0xc3c4c5ca
jmp 0x140014bd8
xorps xmm0, xmm0
mov qword [rbp - 0x14], rax
rol al, cl
movups xmmword [rbp - 0x24], xmm0
xor r8d, r8d
adc dh, bh
mov cl, byte [rbp + r8 - 0x28]
lea edx, [r8 - 0x1f]
jmp 0x140014bf8
mov al, dl
and al, cl
stc
test eax, esp
cmp bl, r10b
add al, al
sub dl, al
sub dl, 0x27
test bx, 0x1439
add dl, cl
mov byte [rbp + r8 - 0x28], dl
jmp 0x140014c1a
inc r8
test rax, 0x48e353a2
cmp r8, 0x1c
jmp 0x140014c2c
jb 0x140014bea
movzx eax, byte [rbx + 1]
test r11b, 0xb7
stc
jmp 0x140014c40
cmp eax, dword [rbp - 0x28]
jmp 0x140014c48
je 0x140014cb0
mov rcx, rbx
call fcn.140012c97
movzx eax, byte [rbx + 1]
not dl
shr dh, 0x3f
add rax, rbx
bswap edx
cdq
mov rbx, rax
mov dh, 0xfb
movsxd rdx, ebp
jmp 0x140014c73
lea rdx, [rax + 1]
jmp 0x140014c7c
mov al, byte [rax]
jmp 0x140014c83
jmp 0x140014c95
mov rbx, rdx
inc rdx
xor al, 0xa1
test r10b, r14b
mov al, byte [rbx]
or al, byte [rdx]
jmp 0x140014c9c
jne 0x140014c88
add rbx, 2
stc
cmp rbx, rdi
jb 0x140014b30
mov rbx, qword [rsp + 0x70]
cmc
sar rbp, cl
mov rdi, qword [rsp + 0x78]
movzx bp, al
add rsp, 0x60
movzx rbp, r10w
movzx bp, r8b
pop rbp
jmp 0x140014cd5
ret
Function at 0x2fc4d5350
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6430
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5d52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d5dea
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5dce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5dc2
cmp qword [rbp - 0x10], 0
je 0x2fc4d5dc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5d88
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5deb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5ef0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5f18
mov eax, 0
jmp 0x2fc4d5f66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5f41
mov eax, 0
jmp 0x2fc4d5f66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5f61
mov eax, 0
jmp 0x2fc4d5f66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5f6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d5fea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5fe1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5fe1
mov rax, qword [rbp - 8]
jmp 0x2fc4d5fff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5fb4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000f0e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f12a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f12a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f12a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f12a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f12a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f12c
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d4d10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d5df0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5712
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d57aa
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d578e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5782
cmp qword [rbp - 0x10], 0
je 0x2fc4d5782
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5748
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d57ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d58b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d58d8
mov eax, 0
jmp 0x2fc4d5926
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5901
mov eax, 0
jmp 0x2fc4d5926
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5921
mov eax, 0
jmp 0x2fc4d5926
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d592c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d59aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d59a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d59a1
mov rax, qword [rbp - 8]
jmp 0x2fc4d59bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5974
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400fe480
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.140102bc0
sub rsp, rax
mov rax, qword [0x140144428]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x1400fe542
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400fe4ed
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400fe4e0
cmp rcx, 1
jb 0x1400fe59a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400fe510
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140111cd4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400fe4d0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400fe573
lea rcx, [rsp + 0x80]
call fcn.140114b14
jmp 0x1400fe575
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1401028f0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140106aa8
int3