joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ac90
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2b8], rbx
mov rax, qword [0x004f1230]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea r8d, [rdi + 0xd]
lea rdx, str.AdobeCommon_
lea rcx, [rsp + 0x60]
call qword [sym.imp.dvacore.dll_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_dvacore::utility::SmallBlockAllocator::STLAllocator_unsigned_short_int_____cdecl_dvacore::utility::AsciiToUTF16_char_const____ptr64__unsigned_long_long_unsigned___int64__]
nop
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
cmp word [rsp + 0x80], di
jne 0x45ad34
mov r8d, edi
jmp 0x45ad4b
lea rax, [rsp + 0x80]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x45ad40
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.0045bbb0
nop
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ASLFoundation.dll_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_dvacore::utility::SmallBlockAllocator::STLAllocator_unsigned_short_int_____cdecl_ASL::PathUtils::AddTrailingSlash_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_dvacore::utility::SmallBlockAllocator::STLAllocator_unsigned_short_int___const____ptr64_]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x45ad8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.dvacore.dll_void___cdecl_dvacore::utility::SmallBlockAllocator::Dispose_void____ptr64__unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x45adbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.dvacore.dll_void___cdecl_dvacore::utility::SmallBlockAllocator::Dispose_void____ptr64__unsigned_long_long_unsigned___int64__]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.0047f350
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rdi
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, 0x8c223045
pop rsi
outsb dx, byte [rsi]
sbb dword [rcx - 0x31], 0xffffffa9
sal dword [rcx + 0x14], cl
jno 0x14003f5da
adc cl, ah
sub bl, cl
jp 0x14003f5c4
or dword [rax + 0x7a6de11e], 0x593fe252
or dword [rdx + 0x4f08ef8a], edi
or byte [rdi + 0x7e], cl
invalid
out dx, eax
or byte [rdi + 0x7e], cl
or dword [rdx], ebx
movabs al, byte [0x286d4467dc2f0336]
insd dword [edi], dx
sub ah, ch
sbb ah, byte [rax - 0x23d0fcca]
insd dword [edi], dx
sub ah, ch
xor eax, 0x5891c4d7
xor dword [rbp + 0x2990f3ab], 0x64
cmc
loope 0x14003f5ff
mov ch, al
add byte [rcx - 0x19], 0xc2
xor eax, dword [rbx + 0x255d7257]
push rdi
jb 0x14003f661
invalid
jbe str.5E0_
pushfq
movsb byte [rdi], byte [rsi]
pop rbp
jo 0x14003f65b
xchg esi, eax
mov dl, 0x8b
std
popfq
invalid
jrcxz 0x14003f646
invalid
cmp al, 0x5e
cld
mov ebx, 0x391f5357
pop rsp
xchg ebp, eax
pop rcx
push 0xffffffffffffff89
mov esi, 0x542b241b
mov bh, 0x61
movsd dword [rdi], dword [rsi]
and al, 2
scasd eax, dword [rdi]
adc dword [rsi - 0x7464650], ecx
mov ecx, 0x498ef8b9
invalid
mov ecx, 0x498ef8b9
ret 0x4acc
mov ecx, 0xc2498ef8
int3
adc al, 0x59
invalid
mov eax, 0x77996d16
invalid
xchg ebx, eax
ja 0x14003f5fb
invalid
test dl, 0x74
out dx, eax
invalid
invalid
xchg dh, ah
jle 0x14003f651
adc dword [rdi - 0x4b], ebx
xchg esp, eax
in al, dx
in al, 0xa6
cmpsb byte [rsi], byte [rdi]
invalid
Function at 0x180003460
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov rbp, rdx
mov r14, rcx
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x180003506
movzx ebx, word [rdi + 0x58]
xor eax, eax
shr rbx, 1
je 0x1800034f5
mov r10, qword [rdi + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r10]
movsx r11d, byte [rax + rbp]
movzx r9d, r11w
lea ecx, [rdx - 0x61]
cmp cx, 0x19
lea r8d, [rdx - 0x20]
lea ecx, [r9 - 0x61]
cmova r8w, dx
cmp cx, 0x19
lea edx, [r9 - 0x20]
cmova dx, r11w
cmp r8w, dx
jne 0x1800034fe
test r11b, r11b
je 0x1800034fe
inc rax
add r10, 2
cmp rax, rbx
jb 0x1800034b0
mov rax, qword [rdi + 0x30]
mov qword [r14], rax
jmp 0x18000350d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180003495
mov qword [r14], 0
mov rbx, qword [rsp + 0x10]
mov rax, r14
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret

Function at 0x180007200
Capabilities:
Parse pe header

Disassembly:
push rbx
push r13
sub rsp, 0x18
mov r11, qword [rcx]
xor r9d, r9d
mov r13, r8
mov rbx, rdx
test r11, r11
je 0x180007339
mov qword [rsp + 0x30], rbp
mov eax, 0x5a4d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r14
mov qword [rsp], r15
cmp word [r11], ax
jne 0x18000730e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
cmp dword [rax], 0x4550
cmovne rax, r9
test rax, rax
je 0x18000730e
add rax, 0x18
mov ecx, 0x20b
cmp word [rax], cx
jne 0x18000730e
test rax, rax
je 0x18000730e
cmp dword [rax + 0x6c], r9d
jbe 0x18000730e
lea r14, [rax + 0x70]
test r14, r14
je 0x18000730e
mov r15d, dword [r14]
mov r10d, r9d
mov edi, dword [r11 + r15 + 0x18]
lea rsi, [r11 + r15]
test edi, edi
je 0x18000730e
mov r12d, dword [rsi + 0x20]
nop dword [rax]
mov ebp, r10d
mov r8, r13
lea rax, [r12 + rbp*4]
mov eax, dword [rax + r11]
add rax, r11
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800072d7
inc rax
test ecx, ecx
jne 0x1800072c4
test edx, edx
je 0x1800072e5
inc r10d
cmp r10d, edi
jb 0x1800072b0
jmp 0x18000730e
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + rbp*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r8d, dword [rcx + rdx*4]
cmp r8d, r15d
jb 0x18000730a
mov eax, r8d
sub eax, r15d
cmp eax, dword [r14 + 4]
jb 0x18000730e
lea r9, [r11 + r8]
mov qword [rbx], r9
mov rax, rbx
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x18
pop r13
pop rbx
ret
mov qword [rdx], r9
mov rax, rbx
add rsp, 0x18
pop r13
pop rbx
ret
Function at 0x180007750
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r10, qword [rcx]
xor r8d, r8d
test r10, r10
je 0x1800077e5
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x1800077c2
movsxd rcx, dword [r10 + 0x3c]
add rcx, r10
cmp dword [rcx], 0x4550
cmovne rcx, r8
test rcx, rcx
je 0x1800077c2
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8]
cmp rax, r9
je 0x1800077c2
nop dword [rax]
test dword [rax + 0x24], 0x40000000
je 0x1800077b9
cmp dword [rax], 0x6164722e
jne 0x1800077b9
cmp word [rax + 4], 0x6174
je 0x1800077d9
add rax, 0x28
cmp rax, r9
jne 0x1800077a0
mov qword [rdx + 8], r8
mov rcx, r8
mov eax, 8
mov qword [rdx], rcx
mov qword [rax + rdx], r8
mov rax, rdx
ret
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 8]
add rcx, r10
jmp 0x1800077c9
mov qword [rdx], r8
mov rax, rdx
mov qword [rdx + 8], r8
ret
Function at 0x180008bf0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x48
cmp qword [0x180012028], 0
jne 0x180008e24
mov qword [rsp + 0x60], rbx
lea rax, [0x180012468]
mov qword [rsp + 0x40], rbp
lea rdx, str.SDL3.dll
mov qword [0x180012030], rax
lea rcx, [rsp + 0x50]
lea rax, [0x180012030]
mov qword [rsp + 0x30], rdi
xor ebp, ebp
mov qword [0x180012028], rax
mov qword [rsp + 0x38], rsi
mov qword [0x180012468], 0xf4240
mov qword [0x180012470], rbp
mov byte [0x180012460], bpl
call fcn.180003460
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180008cd4
mov ecx, 0x5a4d
mov rax, rbx
cmp word [rbx], cx
cmovne rax, rbp
test rax, rax
je 0x180008cd4
movsxd rdx, dword [rax + 0x3c]
add rdx, rbx
cmp dword [rdx], 0x4550
cmovne rdx, rbp
test rdx, rdx
je 0x180008cd4
movzx ecx, word [rdx + 0x14]
movzx eax, word [rdx + 6]
add rcx, 0x18
add rcx, rdx
lea rax, [rax + rax*4]
lea rdx, [rcx + rax*8]
cmp rcx, rdx
je 0x180008cd4
nop
test dword [rcx + 0x24], 0x20000000
je 0x180008ccb
cmp dword [rcx], 0x7865742e
jne 0x180008ccb
cmp byte [rcx + 4], 0x74
je 0x180008df1
add rcx, 0x28
cmp rcx, rdx
jne 0x180008cb0
mov rdi, rbp
mov rsi, rbp
lea rcx, [0x180012038]
call fcn.180005540
lea r8, str.SDL_PeepEvents
mov byte [0x180012460], 0xff
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x50]
call fcn.180007200
mov rbx, qword [rsp + 0x60]
mov word [rsp + 0x20], 0xff48
mov byte [rsp + 0x22], 0x25
mov rdx, qword [rax]
xor eax, eax
mov dword [rsp + 0x23], eax
mov byte [rsp + 0x27], al
mov qword [rsp + 0x28], 3
cmp rdx, rdi
jb 0x180008e03
cmp rsi, 3
jb 0x180008e03
mov rcx, rdx
lea rax, [rsi - 3]
sub rcx, rdi
cmp rcx, rax
ja 0x180008e03
lea rax, [rsp + 0x20]
mov r9, rdx
sub r9, rax
mov rcx, rbp
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x20]
add rax, rcx
movzx r8d, byte [rax]
cmp byte [rax + r9], r8b
je 0x180008d88
cmp r8b, 0x3f
jne 0x180008dff
inc rcx
cmp rcx, 3
jb 0x180008d70
mov al, 1
test al, al
je 0x180008e03
test rdx, rdx
je 0x180008daf
add rdx, 3
test rdx, rdx
je 0x180008daf
movsxd rax, dword [rdx]
add rdx, 4
add rdx, rax
mov qword [0x180012038], rdx
mov qword [0x180012040], rbp
mov byte [0x180012460], 1
test rdx, rdx
je 0x180008e15
mov rax, qword [rdx]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
mov qword [0x180012040], rax
lea rax, [0x18000c0c3]
mov qword [rdx], rax
add rsp, 0x48
ret
mov edi, dword [rcx + 0xc]
mov esi, dword [rcx + 8]
add rdi, rbx
jmp 0x180008cda
xor al, al
jmp 0x180008d93
xorps xmm0, xmm0
mov byte [0x180012460], 1
movdqu xmmword [0x180012038], xmm0
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x2fc4d5190
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d5b92
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d5c2a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5c0e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5c02
cmp qword [rbp - 0x10], 0
je 0x2fc4d5c02
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5bc8
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5c2b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5d30
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5d58
mov eax, 0
jmp 0x2fc4d5da6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5d81
mov eax, 0
jmp 0x2fc4d5da6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5da1
mov eax, 0
jmp 0x2fc4d5da6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5dac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d5e2a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5e21
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5e21
mov rax, qword [rbp - 8]
jmp 0x2fc4d5e3f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5df4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
xor esi, esi
mov rbp, r8
mov r14, rdx
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [rsi + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
test rax, rax
je 0x1400010e8
mov qword [rsp + 0x38], rsi
lea rdx, str.tmnwsn.com
mov dword [rsp + 0x30], esi
mov r8d, 0x1bb
mov dword [rsp + 0x28], 3
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x50], rbx
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rbx, rax
test rax, rax
je 0x1400010da
mov qword [rsp + 0x38], rsi
lea r8, str.login
mov dword [rsp + 0x30], 0x80800000
lea rdx, str.POST
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov rsi, rax
test rax, rax
je 0x1400010d1
mov r9, r14
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x2fc4d16c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d20c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d215a
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d213e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d2132
cmp qword [rbp - 0x10], 0
je 0x2fc4d2132
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d20f8
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d215b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d2260
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d2288
mov eax, 0
jmp 0x2fc4d22d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d22b1
mov eax, 0
jmp 0x2fc4d22d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d22d1
mov eax, 0
jmp 0x2fc4d22d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d22dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d235a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d2351
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d2351
mov rax, qword [rbp - 8]
jmp 0x2fc4d236f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d2324
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d2840
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d3242
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f5108]
test eax, eax
je 0x2fc4d32da
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f5110]
mov qword [rbp - 8], rax
jmp 0x2fc4d32be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d32b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d32b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d3278
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d32db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d33e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d3408
mov eax, 0
jmp 0x2fc4d3456
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d3431
mov eax, 0
jmp 0x2fc4d3456
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3451
mov eax, 0
jmp 0x2fc4d3456
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d345c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d34da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d34d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d34d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d34ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d34a4
mov eax, 0
add rsp, 0x20
pop rbp
ret