joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180153410
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov edx, dword [rcx]
mov r9d, 0x138
mov r10, rcx
xorps xmm1, xmm1
cmp edx, r9d
jne 0x180153482
lea r8, [rcx + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x180153440
mov edx, dword [r10]
jmp 0x180153583
cmp edx, 0x270
jb 0x180153583
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [rcx + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x1801534b0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x180153500
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
xor edx, edx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], edx
mov eax, edx
xorps xmm0, xmm0
mov rcx, qword [r10 + rax*8 + 8]
lea eax, [rdx + 1]
mov dword [r10], eax
movabs rdx, 0x38eb3ffff6d3
mov rax, rcx
shr rax, 0x1d
and rax, qword [r10 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x1801535de
cvtsi2sd xmm0, rdx
jmp 0x1801535f3
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
subsd xmm0, xmm1
addsd xmm0, xmm1
mulsd xmm0, qword [0x18016a518]
add rsp, 8
ret
Function at 0x180154a90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xa0
mov rbx, rdx
mov rbp, rcx
lea rdx, [0x18018880c]
mov ecx, 0xb0
mov rdi, r9
mov r14d, r8d
call fcn.18015c9e4
mov rsi, rax
test rax, rax
je 0x180154c81
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0xaf
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsi + 8]
mov byte [rsi], 1
mov edx, 2
call sub.MSVCP140.dll__Mtx_init_in_situ
lea rcx, [rsi + 0x58]
call sub.MSVCP140.dll__Cnd_init_in_situ
mov qword [0x1801f36b8], rsi
xorps xmm0, xmm0
movups xmmword [rsi + 0xa0], xmm0
test r14d, r14d
je 0x180154b38
test rdi, rdi
je 0x180154b2e
cmp byte [rdi], 0
je 0x180154b2e
mov rdx, rdi
mov rcx, rbp
call fcn.180155220
jmp 0x180154b38
xor edx, edx
mov rcx, rbp
call fcn.180155180
call sub.KERNEL32.dll_GetCurrentProcessId
lea rcx, [0x1801ce120]
mov dword [0x1801ef4a8], eax
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x180154cb7
test rbx, rbx
je 0x180154b77
movups xmm0, xmmword [rbx]
movups xmmword [0x1801ef230], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1801ef240], xmm1
movups xmm0, xmmword [rbx + 0x20]
jmp 0x180154b97
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [0x1801ef230], xmm0
movups xmmword [0x1801ef240], xmm0
movups xmmword [0x1801ef250], xmm0
lea rcx, [0x1801ce120]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [0x1801ef260], xmm0
movups xmmword [0x1801ef270], xmm0
movups xmmword [0x1801ef280], xmm0
call sub.MSVCP140.dll__Mtx_unlock
cmp qword [0x1801cf1d8], 0
jne 0x180154c8a
mov rcx, rbp
call fcn.18015a050
mov qword [0x1801cf1d8], rax
lea rcx, [0x180153270]
mov qword [rax + 0x10], rcx
lea rcx, [0x180153280]
mov rax, qword [0x1801cf1d8]
mov qword [rax + 0x18], rcx
mov eax, 1
mov rdi, qword [0x1801f36b8]
mov ecx, 8
xchg byte [rdi], al
call fcn.18015c100
xor ebx, ebx
test rax, rax
je 0x180154c35
mov qword [rax], rdi
jmp 0x180154c38
mov rax, rbx
lea rcx, [rsp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1801532d0]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180154ca8
cmp dword [rdi + 0xa8], ebx
jne 0x180154c7a
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 0xa0], xmm1
jmp 0x180154c8a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor ebx, ebx
mov qword [0x1801f36b8], rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov ecx, 6
mov dword [rsp + 0x38], ebx
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x180155220
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x1801c85c0]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1801552d3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x18015539a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x180155388
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x180155388
shr ecx, 1
je 0x180155346
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
cmp word [rax], 0x2f
jne 0x18015533c
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x180155333
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.1801550b0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.180154d50
jmp 0x1801553a2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.18001d6b0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.18015b9a0
add rsp, 0xae0
pop rbx
ret
Function at 0x180155410
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1801c85c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x18016a770]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x18016a774]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x18016a758]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x18016a768]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x180155514
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1801554c8
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x180155537
inc ax
mov word [rsp + 0x6a], ax
jmp 0x1801554e3
cmp eax, 0xe7
jne 0x180155537
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x180155537
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1801554a8
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18015b9a0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x180155519

Function at 0x180155540
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x180155601
test rcx, rcx
je 0x180155601
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x180155601
xor ebp, ebp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1801555ec
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x180155601
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1801555d5
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.1801553c0
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180155610
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
test r8, r8
jne 0x180155626
mov al, 1
add rsp, 0x30
pop rbx
ret
test rcx, rcx
je 0x18015565b
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18015565b
test rdx, rdx
je 0x18015565b
xor eax, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18015565b
cmp dword [rsp + 0x50], ebx
je 0x18015561e
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x18015ab10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rbx
push rdi
sub rsp, 0xe0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1801c85c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov eax, dword [0x1801c8574]
mov rbx, r8
shr eax, 5
mov rdi, rcx
test al, 1
je 0x18015ac5e
cmp rbx, 0x100
jb 0x18015ac5e
movdqa xmm6, xmmword [0x18016b5b0]
and ebx, 0x1f
vmovdqu ymm5, ymmword [0x18016b5e0]
vmovdqu ymm7, ymmword [0x18016b600]
movsx eax, r9b
vpxor xmm8, xmm8, xmm8
vmovd xmm0, eax
movsx eax, byte [rsp + 0x120]
vpbroadcastb ymm3, xmm0
vmovdqu ymmword [rbp + 0x40], ymm3
vmovd xmm0, eax
lea rax, [r8 + rcx]
vpbroadcastb ymm4, xmm0
vmovdqu ymmword [rbp + 0x20], ymm4
add rcx, rbx
nop dword [rax]
nop dword [rax + rax]
vmovd xmm0, dword [rdx]
sub rax, 0x20
vpshufb xmm0, xmm0, xmm6
add rdx, 4
vpermd ymm1, ymm5, ymm0
vpand ymm2, ymm7, ymm1
vpcmpeqb ymm0, ymm8, ymm2
vpblendvb ymm1, ymm4, ymm3, ymm0
vmovdqu ymmword [rax], ymm1
cmp rax, rcx
jne 0x18015abc0
test rbx, rbx
vzeroupper
je 0x18015ad38
lea r8, [rbx + 7]
mov dword [rbp], 0
shr r8, 3
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memcpy
movd xmm0, dword [rbp]
lea rdx, [rbp + 0x60]
vmovdqu ymm1, ymmword [0x18016b5e0]
vpshufb xmm0, xmm0, xmm6
vpxor xmm3, xmm3, xmm3
sub rdx, rbx
mov r8, rbx
mov rcx, rdi
vpermd ymm1, ymm1, ymm0
vpand ymm2, ymm1, ymmword [0x18016b600]
vmovdqu ymm0, ymmword [rbp + 0x20]
vpcmpeqb ymm3, ymm2, ymm3
vpblendvb ymm0, ymm0, ymmword [rbp + 0x40], ymm3
vmovdqu ymmword [rbp + 0x40], ymm0
vzeroupper
jmp 0x18015ad33
movsx ecx, byte [rsp + 0x120]
movdqa xmm5, xmmword [0x18016b5c0]
xor r9b, cl
movsx eax, r9b
movd xmm4, ecx
punpcklbw xmm4, xmm4
movd xmm3, eax
punpcklbw xmm3, xmm3
punpcklwd xmm3, xmm3
punpcklwd xmm4, xmm4
pshufd xmm3, xmm3, 0
pshufd xmm4, xmm4, 0
cmp rbx, 0x10
jb 0x18015acea
and ebx, 0xf
lea rcx, [r8 + rdi]
xorps xmm2, xmm2
lea r8, [rbx + rdi]
nop dword [rax + rax]
movzx eax, word [rdx]
sub rcx, 0x10
movdqa xmm1, xmm5
add rdx, 2
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklbw xmm0, xmm0
pshufd xmm0, xmm0, 5
andps xmm1, xmm0
movdqa xmm0, xmm2
pcmpeqb xmm0, xmm1
andps xmm0, xmm3
xorps xmm0, xmm4
movdqu xmmword [rcx], xmm0
cmp rcx, r8
jne 0x18015acb0
test rbx, rbx
je 0x18015ad38
cmp rbx, 8
jbe 0x18015acfa
movzx eax, word [rdx]
jmp 0x18015acfd
movzx eax, byte [rdx]
movzx eax, ax
lea rdx, [rbp + 0x30]
xorps xmm0, xmm0
sub rdx, rbx
mov r8, rbx
mov rcx, rdi
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklbw xmm1, xmm1
pshufd xmm2, xmm1, 5
andps xmm2, xmm5
pcmpeqb xmm2, xmm0
andps xmm2, xmm3
xorps xmm2, xmm4
movdqu xmmword [rbp + 0x20], xmm2
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.18015b9a0
lea r11, [rsp + 0xe0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rdi
pop rbx
pop rbp
ret
Function at 0x18015af94
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18015afce
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18015afd3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18015b01c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1801886e0]
cmp byte [rcx + rax], 0
je 0x18015b01c
dec r8
sub rdx, 1
jne 0x18015b002
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x2fc4d8160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d8b62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4d8bfa
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4d8bde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8bd2
cmp qword [rbp - 0x10], 0
je 0x2fc4d8bd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8b98
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d8bfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8d00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8d28
mov eax, 0
jmp 0x2fc4d8d76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8d51
mov eax, 0
jmp 0x2fc4d8d76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8d71
mov eax, 0
jmp 0x2fc4d8d76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d8d7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d8dfa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d8df1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d8df1
mov rax, qword [rbp - 8]
jmp 0x2fc4d8e0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d8dc4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9e50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4da852
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ff108]
test eax, eax
je 0x2fc4da8ea
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ff110]
mov qword [rbp - 8], rax
jmp 0x2fc4da8ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da8c2
cmp qword [rbp - 0x10], 0
je 0x2fc4da8c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da888
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da8eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da9f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4daa18
mov eax, 0
jmp 0x2fc4daa66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4daa41
mov eax, 0
jmp 0x2fc4daa66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4daa61
mov eax, 0
jmp 0x2fc4daa66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4daac0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4db4c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc500108]
test eax, eax
je 0x2fc4db55a
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc500110]
mov qword [rbp - 8], rax
jmp 0x2fc4db53e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4db532
cmp qword [rbp - 0x10], 0
je 0x2fc4db532
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4db4f8
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4db55b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4db660
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4db688
mov eax, 0
jmp 0x2fc4db6d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4db6b1
mov eax, 0
jmp 0x2fc4db6d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4db6d1
mov eax, 0
jmp 0x2fc4db6d6
mov eax, 1
add rsp, 0x20
pop rbp
ret