joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008acdc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14008acf2
mov al, 1
jmp 0x14008ad52
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14008ad03
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008ad50
mov ecx, dword [rcx + 0x18]
nop
call fcn.14008e020
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008ad50
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14008ad50
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14008ad50
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14008ad52
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14008e130
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140082494
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140082494
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14008e280
cmp rax, 0xffffffffffffffff
je 0x14008e280
xor edi, edi
test rbp, rbp
jle 0x14008e22b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14008779c
mov rbx, rax
test rax, rax
jne 0x14008e1b8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14008e221
mov edx, 0x8000
mov ecx, r14d
call fcn.140083cdc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140086c68
cmp eax, 0xffffffff
je 0x14008e201
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14008e1c8
mov edx, r15d
mov ecx, r14d
call fcn.140083cdc
jmp 0x14008e221
cmp byte [rsi + 0x38], dil
je 0x14008e218
cmp dword [rsi + 0x34], 5
jne 0x14008e218
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x14008e221
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140087814
jmp 0x14008e294
jns 0x14008e294
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140082494
cmp rax, 0xffffffffffffffff
jne 0x14008e24c
cmp byte [rsi + 0x30], dil
je 0x14008e294
mov edi, dword [rsi + 0x2c]
jmp 0x14008e294
mov ecx, r14d
call fcn.14008e020
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14008e294
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x14008e294
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14008e28d
mov eax, dword [rsi + 0x2c]
jmp 0x14008e292
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140082494
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140090004
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140090034
xor eax, eax
jmp 0x1400900f7
mov rbp, rbx
cmp word [rax], si
je 0x140090059
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140090040
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14009003c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14008cd00
movsxd r14, eax
test eax, eax
jne 0x140090097
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14009002d
mov rcx, r14
call fcn.140087850
mov rdi, rax
test rax, rax
jne 0x1400900b0
xor ecx, ecx
call fcn.140087814
jmp 0x14009008c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14008cd00
test eax, eax
jne 0x1400900e1
mov rcx, rdi
call fcn.140087814
jmp 0x1400900eb
xor ecx, ecx
call fcn.140087814
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140090114
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14009019b
mov rsi, rbx
cmp word [rax], bp
je 0x14009015a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140090144
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140090140
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140087850
mov rdi, rax
test rax, rax
je 0x140090188
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400688f0
mov rbp, rdi
xor ecx, ecx
call fcn.140087814
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14009320c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140087fec
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400932ad
cmp ebx, dword [rsp + 0x30]
je 0x1400932a6
test esi, esi
je 0x1400932a6
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140093281
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14009328e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14009326b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140093292
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400932af
mov eax, 1
jmp 0x1400932af
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400935c0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400935e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140074c50
or eax, 0xffffffff
jmp 0x1400935e2
xor eax, eax
add rsp, 0x28
ret

Function at 0x140095dc4
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400c3078]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140095e0e
call fcn.140074cbc
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.140074cdc
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.140072ffc
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400670c0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140095e19
lea eax, [rbx + 1]
jmp 0x140095dfb
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140095df9
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140095dfb
Function at 0x140096220
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140070bfc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400962aa
cmp byte [rbp - 0x21], r15b
je 0x1400962a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400962e0
call fcn.14008866c
test eax, eax
jne 0x1400962cc
cmp byte [rbp - 0x21], r15b
je 0x1400962c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400962e0
cmp byte [rbp - 0x21], r15b
je 0x1400962dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14007a010
test eax, eax
jne 0x140096380
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140070bfc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14009631f
cmp byte [rbp - 0x21], r15b
je 0x140096354
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140096354
call fcn.14008866c
test eax, eax
jne 0x140096340
cmp byte [rbp - 0x21], r15b
je 0x140096339
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140096354
cmp byte [rbp - 0x21], r15b
je 0x140096351
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14007a010
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140096380
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140096383
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140096391
mov rcx, rdi
call fcn.140087814
cmp byte [rbp + 0x3f], r15b
je 0x1400963a0
mov rcx, qword [rbp + 0x27]
call fcn.140087814
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x2fc4d7760
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d8162
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d81fa
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d81de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d81d2
cmp qword [rbp - 0x10], 0
je 0x2fc4d81d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8198
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d81fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8300
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8328
mov eax, 0
jmp 0x2fc4d8376
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8351
mov eax, 0
jmp 0x2fc4d8376
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8371
mov eax, 0
jmp 0x2fc4d8376
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d837c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d83fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d83f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d83f1
mov rax, qword [rbp - 8]
jmp 0x2fc4d840f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d83c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c57c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c61c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e8108]
test eax, eax
je 0x2fc4c625a
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e8110]
mov qword [rbp - 8], rax
jmp 0x2fc4c623e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6232
cmp qword [rbp - 0x10], 0
je 0x2fc4c6232
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c61f8
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c625b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c6360
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c6388
mov eax, 0
jmp 0x2fc4c63d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c63b1
mov eax, 0
jmp 0x2fc4c63d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c63d1
mov eax, 0
jmp 0x2fc4c63d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c63dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c645a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c6451
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c6451
mov rax, qword [rbp - 8]
jmp 0x2fc4c646f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c6424
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c56a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c60a2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e8108]
test eax, eax
je 0x2fc4c613a
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e8110]
mov qword [rbp - 8], rax
jmp 0x2fc4c611e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6112
cmp qword [rbp - 0x10], 0
je 0x2fc4c6112
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c60d8
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c613b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c6240
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c6268
mov eax, 0
jmp 0x2fc4c62b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c6291
mov eax, 0
jmp 0x2fc4c62b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c62b1
mov eax, 0
jmp 0x2fc4c62b6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c62bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c633a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c6331
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c6331
mov rax, qword [rbp - 8]
jmp 0x2fc4c634f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c6304
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0xa0b0fc
Capabilities:
Encode data using base64

Disassembly:
mov dword [rsp + 4], r12d
jmp 0xa8c60e
mov eax, 0x990c9cb7
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
push 0x5e843b0a
jmp 0x145174a
push 0x5db12c0c
not byte [rsp + 3]
cmp ebx, 3
push 0x18289922
call fcn.0144dfb0
mov ecx, 0x502c3539
lea rdx, [rcx*8 - 0x5d631668]
sar dx, 0x25
mov rdx, qword [rcx + rdi - 0x502c3539]
mov cx, word ss:[rdx + rcx - 0x502c3539]
call fcn.014468a7
je 0x144f788
adc r9b, dl
push 0xffffffffb43bfdb0
mov word [rdi], r9w
call fcn.00a7f337
ror r10b, cl
sal al, cl
mov qword [rsp + 0x18], r8
xadd ax, r8w
sar ax, 0x29
cbw
mov qword [rsp + 0x10], rdx
and al, 7
cdqe
xadd r8b, r10b
push rbx
push rbp
sar r8b, 8
sub ah, 0x2d
push rdi
stc
sar ah, cl
cwde
push r12
movsx edi, si
push r13
push r14
bsf r10, r12
movsx r10d, bp
push r15
movzx r12w, dl
btc r15w, r8w
sub rsp, 0x30
mov r15, qword [rcx + 0x10]
shld r10w, r12w, 0xa4
btr r8w, 0x3a
mov rax, rcx
rcr r8w, 0xa5
mov ecx, dword [rcx + 8]
or r10b, r10b
sub ebx, ebx
sub r12, r13
mov r8, rdx
sar dil, 0x33
ror r12b, 0x1d
rcl r14b, cl
mov r12d, 1
xor r14b, spl
mov edx, 1
btr r10w, r13w
bt r10w, si
bts r10w, r13w
mov edi, 1
xor r10b, 0x17
or bpl, 0x84
rcr r14b, 5
sub r11b, r11b
movsxd rbp, r8d
movzx bp, dl
btc bp, si
shl edx, cl
mov ecx, dword [rax + 4]
add r10w, 0x5e03
movzx r10, si
mov r14, rbx
cmc
shl edi, cl
inc r10w
mov rcx, qword [rsp + 0xa0]
cmovne r10w, r10w
movzx r10, r11w
movsx bp, r15b
dec edx
dec edi
or bpl, sil
mov ebp, ebx
movzx r10d, r11w
sbb r10b, sil
mov r10d, r12d
mov dword [rsp + 0xc], edi
bswap edi
mov edi, dword [rax]
cmp sil, 0x98
mov qword [r9], rbx
test r13b, bpl
test ax, 0x6339
mov qword [rcx], rbx
movsx ecx, bx
stc
sets cl
mov eax, dword [rax + 4]
mov dword [rsp + 0x10], edx
cmp dil, 0x25
lea ecx, [rdi + rax]
rcr eax, cl
mov eax, 0x300
stc
clc
test ax, ax
mov dword [rsp + 8], edi
test r13b, 0x8d
shl eax, cl
cmp r14b, r11b
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x80], r12d
cmc
add eax, 0x736
jmp 0xa0b0fc
jne 0xa12819
mov eax, 0x6d22ffbb
mov rax, qword [rbp + rax - 0x6d22ffbb]
call fcn.01466889
mov esi, dword [rdi]
mov cl, byte [rdi + 4]
jmp 0x145ea49
not ebp
mov dword [rdi], ebp
mov qword [rsp], 0x728ff1ac
cmp ebx, 2
lea rsp, [rsp + 8]
jne 0xa810a6
mov rdx, rax
jmp 0x144d06a
dec ebx
jmp 0xa82678
jmp 0x14626a0
call fcn.00a0b3a6
movabs al, byte [0xdf02d0243e470d3e]
stc
add dh, al
or eax, 0x730aa88b
leave
idiv qword [r10]
invalid
cmp ah, bl
invalid
add rdi, 2
call fcn.00a92333
jrcxz 0x145ea3f
mov bh, 0x1b
invalid
lea rsp, [rsp + 0x10]
je 0xa8cdf9
push rdi
mov r9d, 0x733afdb6
lea r9, [0x00a08020]
movzx edi, byte [rsi]
push 0x2736ed36
call fcn.014639e7
jmp 0x1462709
stosd dword [rdi], eax
in eax, dx
fisub word [rcx*2 - 0x5be664f1]
mov dl, 0x71
add edi, dword [rcx]
adc bh, al
invalid

Function at 0x14651d3
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
jmp fcn.00a8a0b5
mov rdi, qword [rsp + 0x10]
jmp 0xa87097