joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62d932f0
Capabilities:
Get storage device properties

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbx, [rsp + 0x70]
mov rdi, rdx
mov ebp, ecx
xor edx, edx
mov rcx, rdi
mov rsi, r8
call fcn.62e01e18
mov rcx, rbx
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
call qword [0x62e24558]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [0x62e24270]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x62d933dc
lea r12, [0x62e1b240]
xor edx, edx
mov r8d, 0x2710
mov dword [rsp + 0x60], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x64], 0
mov rcx, r12
mov dword [rsp + 0x6c], 0
call fcn.62e01e18
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2710
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, rbx
call qword [0x62e24288]
test eax, eax
jne 0x62d93404
mov rcx, rbx
call qword [0x62e24268]
cmp rsi, 0x13
jbe 0x62d935b0
mov rdx, rdi
mov ecx, ebp
call fcn.62d92f40
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x62e1b258]
test eax, eax
je 0x62d933d3
add rax, r12
mov r15, qword [0x62e244a8]
mov r13d, 0x64
mov qword [rsp + 0x58], rax
mov r12, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov r14, rax
test r13d, r13d
movzx edx, byte [r12]
je 0x62d934e0
test dl, dl
je 0x62d934e0
movsx ecx, dl
mov byte [rsp + 0x4e], dl
call r15
test eax, eax
je 0x62d93580
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x39
jg 0x62d93560
sub edx, 0x30
movsx ecx, byte [r12 + 1]
shl edx, 4
mov byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], cl
call r15
test eax, eax
je 0x62d93580
movzx edx, byte [rsp + 0x4f]
cmp dl, 0x39
jg 0x62d93570
sub edx, 0x30
or dl, byte [rsp + 0x4e]
add r12, 2
movzx ecx, dl
mov byte [rsp + 0x4e], dl
call qword [0x62e244a0]
test eax, eax
je 0x62d93580
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x20
je 0x62d93436
sub r13d, 1
mov byte [r14], dl
add r14, 1
test r13d, r13d
movzx edx, byte [r12]
jne 0x62d93444
mov r8, qword [rsp + 0x50]
mov byte [r14], 0
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x62d934e9
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
sbb r8, 3
sub r8, qword [rsp + 0x50]
cmp r8d, esi
mov r12d, r8d
jae 0x62d933d3
mov rdx, qword [rsp + 0x50]
add r8, 1
mov rcx, rdi
call fcn.62e01e28
mov rcx, rbx
call qword [0x62e24268]
test r12d, r12d
je 0x62d933dc
xor eax, eax
jmp 0x62d933f0
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x62d9346f
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x62d9349c
mov rcx, qword [rsp + 0x58]
call fcn.62e01dd0
cmp eax, esi
mov r12d, eax
jae 0x62d933d3
mov rdx, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, rdi
call fcn.62e01e28
jmp 0x62d93540
mov eax, 0xffffffff
jmp 0x62d933f0
Function at 0x62d93800
Capabilities:
Get storage device properties

Disassembly:
sub rsp, 0x28
test r9, r9
mov eax, ecx
mov rcx, rdx
jne 0x62d93832
test eax, eax
je 0x62d93850
cmp eax, 1
je 0x62d93870
cmp eax, 2
je 0x62d93880
cmp eax, 3
je 0x62d93890
cmp eax, 4
jne 0x62d9389a
mov edx, r8d
add rsp, 0x28
jmp fcn.62d931f0
test eax, eax
je 0x62d93860
cmp eax, 1
jne 0x62d938b9
cmp byte [r9], 0x2a
mov edx, r8d
jne 0x62d93890
add rsp, 0x28
jmp fcn.62d92a70
mov edx, r8d
add rsp, 0x28
jmp fcn.62d935c0
mov r8d, r8d
mov rcx, r9
add rsp, 0x28
jmp fcn.62d93690
mov edx, r8d
add rsp, 0x28
jmp fcn.62d92c60
mov edx, r8d
add rsp, 0x28
jmp fcn.62d92df0
mov eax, 0xffffffff
add rsp, 0x28
ret
lea r8, str.Unsupported_hardware_type
lea rcx, str..._src_hdinfo.c
mov edx, 0x89
call fcn.62d841f0
mov eax, 0xffffffff
jmp 0x62d93895
lea r8, str.Unsupported_hardware_type_with_name
lea rcx, str..._src_hdinfo.c
mov edx, 0x74
call fcn.62d841f0
mov eax, 0xffffffff
jmp 0x62d93895
Function at 0x62d990f0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x62d9912a
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x62e0e2f1]
mov r8d, 0xe9
call fcn.62d9e090
nop
nop
nop word cs:[rax + rax]
Function at 0x62d99150
Capabilities:
Hash data with md5

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x62d99360
test rdx, rdx
je 0x62d99379
mov edx, dword [rcx + 0x18]
mov eax, 0x10
cmp edx, 0x3f
jbe 0x62d99184
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r8d, [rdx*8]
add r8, qword [rcx]
mov eax, edx
mov qword [rcx], r8
lea ecx, [rdx + 1]
cmp ecx, 0x38
mov dword [rbx + 0x18], ecx
mov byte [rbx + rax + 0x1c], pe_nt_image_headers64
ja 0x62d992e0
cmp ecx, 0x38
lea rdi, [rbx + 0x1c]
je 0x62d992a9
mov edx, ecx
lea r9d, [rcx + 1]
mov eax, ecx
not edx
mov byte [rbx + rax + 0x1c], 0
and edx, 7
cmp r9d, 0x38
je 0x62d992a2
test edx, edx
je 0x62d9924d
cmp edx, 1
je 0x62d9923b
cmp edx, 2
je 0x62d9922f
cmp edx, 3
je 0x62d99223
cmp edx, 4
je 0x62d99216
cmp edx, 5
je 0x62d99209
cmp edx, 6
je 0x62d991fd
mov byte [rbx + r9 + 0x1c], 0
lea r9d, [rcx + 2]
mov ecx, r9d
add r9d, 1
mov byte [rbx + rcx + 0x1c], 0
mov r10d, r9d
add r9d, 1
mov byte [rbx + r10 + 0x1c], 0
mov r11d, r9d
add r9d, 1
mov byte [rbx + r11 + 0x1c], 0
mov edx, r9d
add r9d, 1
mov byte [rbx + rdx + 0x1c], 0
mov eax, r9d
add r9d, 1
mov byte [rbx + rax + 0x1c], 0
mov ecx, r9d
add r9d, 1
cmp r9d, 0x38
mov byte [rbx + rcx + 0x1c], 0
je 0x62d992a2
lea r11d, [r9 + 1]
lea edx, [r9 + 2]
mov r10d, r9d
mov byte [rbx + r10 + 0x1c], 0
lea eax, [r9 + 3]
lea ecx, [r9 + 4]
mov byte [rbx + r11 + 0x1c], 0
lea r10d, [r9 + 5]
mov byte [rbx + rdx + 0x1c], 0
lea r11d, [r9 + 6]
lea edx, [r9 + 7]
add r9d, 8
cmp r9d, 0x38
mov byte [rbx + rax + 0x1c], 0
mov byte [rbx + rcx + 0x1c], 0
mov byte [rbx + r10 + 0x1c], 0
mov byte [rbx + r11 + 0x1c], 0
mov byte [rbx + rdx + 0x1c], 0
jne 0x62d9924d
mov dword [rbx + 0x18], 0x38
mov qword [rbx + 0x54], r8
mov rdx, rdi
mov rcx, rbx
call fcn.62d988b0
mov r9d, dword [rbx + 8]
xor eax, eax
mov dword [rsi], r9d
mov edi, dword [rbx + 0xc]
mov dword [rsi + 4], edi
mov r8d, dword [rbx + 0x10]
mov dword [rsi + 8], r8d
mov ebx, dword [rbx + 0x14]
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp ecx, 0x40
je 0x62d99347
lea edi, [rdx + 2]
mov byte [rbx + rcx + 0x1c], 0
cmp edi, 0x40
je 0x62d99340
lea r8d, [rdx + 3]
mov byte [rbx + rdi + 0x1c], 0
cmp r8d, 0x40
je 0x62d99340
lea r9d, [rdx + 4]
mov byte [rbx + r8 + 0x1c], 0
cmp r9d, 0x40
je 0x62d99340
lea r10d, [rdx + 5]
mov byte [rbx + r9 + 0x1c], 0
cmp r10d, 0x40
je 0x62d99340
lea r11d, [rdx + 6]
mov byte [rbx + r10 + 0x1c], 0
cmp r11d, 0x40
je 0x62d99340
cmp edx, 0x38
mov byte [rbx + r11 + 0x1c], 0
jne 0x62d99340
mov byte [rbx + 0x5b], 0
mov dword [rbx + 0x18], 0x40
lea rdi, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rdi
call fcn.62d988b0
mov r8, qword [rbx]
xor ecx, ecx
jmp 0x62d991b5
lea rdx, str.src_hashes_md5.c
lea rcx, [0x62e0e2f1]
mov r8d, 0x106
call fcn.62d9e090
lea rdx, str.src_hashes_md5.c
lea rcx, [0x62e0e2fc]
mov r8d, 0x107
call fcn.62d9e090
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x62de14d0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x62de1510
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x62de1502
test byte [rcx + 0xd], 0x10
jne 0x62de1502
cmp qword [rdx + 0x28], 0
jne 0x62de1502
cmp qword [rcx + 0x28], rdx
je 0x62de1513
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x62de1502
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x62de1593
ja 0x62de15b0
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x62de1502
mov rcx, rbp
call fcn.62de10c0
test al, 4
jne 0x62de1502
mov edx, eax
and edx, 3
cmp edx, 3
je 0x62de1630
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x62de1660
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x62de1686
mov rbx, qword [rcx]
test rbx, rbx
je 0x62de1502
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x62de1534
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x62de15c3
mov rcx, rbx
jmp 0x62de157f
cmp edx, 0xcd
jne 0x62de153e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x62de1502
cmp qword [rbx + 0x18], rdi
jne 0x62de1502
cmp rcx, rbx
mov rax, qword [rbx]
je 0x62de16c0
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x62de157f
test al, 8
je 0x62de16a0
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x62de1502
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x62de1558
jmp 0x62de1502
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x62de1502
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x62de157f
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x62de157f
jmp 0x62de1502
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x62de1558
jmp 0x62de1502
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x62de15e7
Function at 0x62dff9f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
cmp dword [rcx + 0x244], 0x10
ja 0x62dffa70
mov rbx, rcx
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov edi, r8d
call fcn.62d9e0d0
test eax, eax
mov r14d, eax
jne 0x62dffa76
mov eax, dword [rbx + 0x240]
test eax, eax
jne 0x62dffa61
movsxd rcx, dword [rbx + 0x244]
test ecx, ecx
jne 0x62dffa90
cmp qword [rbx + 0x248], 0
je 0x62dffc80
lea r13, [rbx + 0x228]
lea r12, [rbx + 0x1f8]
jmp 0x62dffb0a
cmp eax, 1
je 0x62dffc90
nop word [rax + rax]
mov r14d, 0x10
lea rsp, [rbp - 0x38]
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbx + 0x23c]
lea r13, [rbx + 0x228]
test eax, eax
jne 0x62dffad0
cmp ecx, 0xc
jne 0x62dffad0
mov rax, qword [rbx + 0x228]
mov qword [rbx + 0x208], rax
mov eax, dword [r13 + 8]
mov dword [rbx + 0x214], 0x1000000
mov dword [rbx + 0x210], eax
jmp 0x62dffb75
lea eax, [rcx - 1]
lea r12, [rbx + 0x1f8]
lea r8, [rbx + rax + 0x1f9]
mov rdx, r12
movzx eax, byte [rdx + 0x30]
xor byte [rdx], al
add rdx, 1
cmp rdx, r8
jne 0x62dffae5
shl rcx, 3
add qword [rbx + 0x248], rcx
mov rdx, r12
mov rcx, rbx
call fcn.62d981f0
mov edx, 8
mov rcx, r13
call fcn.62d9ebd0
mov rax, qword [rbx + 0x248]
mov rdx, r12
bswap rax
mov qword [rbx + 0x230], rax
lea rax, [rbx + 0x208]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rax, rdx
jne 0x62dffb32
mov rdx, r12
mov rcx, rbx
call fcn.62d981f0
mov rdx, qword [rbx + 0x200]
mov rax, qword [rbx + 0x1f8]
mov rcx, r12
mov qword [rbx + 0x210], rdx
mov qword [rbx + 0x208], rax
mov edx, 0x10
call fcn.62d9ebd0
mov rdx, qword [rbx + 0x210]
mov rax, qword [rbx + 0x208]
mov rcx, r13
mov qword [rbx + 0x220], rdx
mov qword [rbx + 0x218], rax
mov edx, 0x10
call fcn.62d9ebd0
mov qword [rbx + 0x240], 1
mov qword [rbx + 0x248], 0
mov r13d, edi
and r13d, 0xfffffff0
je 0x62dffcb0
lea r15, [rbx + 0x1f8]
xor r12d, r12d
nop dword [rax + rax]
mov eax, r12d
mov rdx, r15
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [r12 + 8]
add r12d, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.62d981f0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12d, r13d
jb 0x62dffbd0
mov eax, r12d
add rsi, rax
cmp edi, r12d
jbe 0x62dffa76
sub edi, 1
sub edi, r12d
lea r12, [rsi + rdi + 1]
lea rdi, [rbx + 0x1f8]
jmp 0x62dffc39
cmp rsi, r12
je 0x62dffa76
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
movzx ecx, byte [rsi - 1]
lea eax, [rdx + 1]
mov dword [rbx + 0x244], eax
xor byte [rbx + rdx + 0x1f8], cl
cmp eax, 0x10
jne 0x62dffc30
mov rdx, rdi
mov rcx, rbx
call fcn.62d981f0
mov dword [rbx + 0x244], 0
sub qword [rbx + 0x248], 0xffffffffffffff80
jmp 0x62dffc30
mov r14d, 1
jmp 0x62dffa76
mov eax, dword [rbx + 0x244]
cmp eax, 0xf
jg 0x62dffa70
xor r12d, r12d
test eax, eax
jne 0x62dffc10
jmp 0x62dffbb4
xor r12d, r12d
jmp 0x62dffc10
Function at 0x62e000e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
mov ebp, 0x10
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x240]
test eax, eax
jne 0x62e00221
cmp dword [rcx + 0x244], 0xf
mov rbx, rcx
ja 0x62e00221
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov r12d, r8d
call fcn.62d9e0d0
test eax, eax
mov ebp, eax
jne 0x62e00221
mov eax, dword [rbx + 0x244]
lea edx, [rax + r12]
cmp edx, 0xc
jbe 0x62e00142
or dword [rbx + 0x23c], 1
xor edi, edi
test eax, eax
jne 0x62e0019b
mov r13d, r12d
and r13d, 0xfffffff0
je 0x62e00232
lea r14, [rbx + 0x1f8]
nop dword [rax]
mov eax, edi
mov rdx, r14
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [rdi + 8]
add edi, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.62d981f0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp edi, r13d
jb 0x62e00160
mov eax, edi
add rsi, rax
cmp r12d, edi
jbe 0x62e00221
sub r12d, 1
lea r13, [rbx + 0x1f8]
sub r12d, edi
lea rdi, [rbx + 0x208]
lea r12, [rsi + r12 + 1]
jmp 0x62e001c5
cmp r12, rsi
je 0x62e00221
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
lea ecx, [rdx + 1]
mov dword [rbx + 0x244], ecx
movzx eax, byte [rsi - 1]
cmp ecx, 0x10
mov byte [rbx + rdx + 0x228], al
jne 0x62e001c0
mov rdx, r13
nop dword [rax]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rdi, rdx
jne 0x62e001f0
mov rdx, r13
mov rcx, rbx
call fcn.62d981f0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12, rsi
mov dword [rbx + 0x244], 0
jne 0x62e001c5
add rsp, 0x20
mov eax, ebp
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, eax
jmp 0x62e0019b
Function at 0x2fc4dbb50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dc552
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc501108]
test eax, eax
je 0x2fc4dc5ea
lea rax, [0x2fc5010e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc501110]
mov qword [rbp - 8], rax
jmp 0x2fc4dc5ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dc5c2
cmp qword [rbp - 0x10], 0
je 0x2fc4dc5c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dc588
lea rax, [0x2fc5010e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dc5eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dc6f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dc718
mov eax, 0
jmp 0x2fc4dc766
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dc741
mov eax, 0
jmp 0x2fc4dc766
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dc761
mov eax, 0
jmp 0x2fc4dc766
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dc76c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dc7ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dc7e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dc7e1
mov rax, qword [rbp - 8]
jmp 0x2fc4dc7ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dc7b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140035710
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov rcx, rdx
call qword [0x140164580]
mov rdi, rax
mov rcx, rsi
call qword [0x1401641e0]
lea r9d, [rbx - 1]
mov r8, rdi
mov rdx, rax
mov rcx, rbp
call qword [0x1401640d0]
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [0x1401646e0]
cmp rax, 8
jl 0x1400357a8
lea esi, [rbx + 4]
nop word [rax + rax]
mov rdx, rbx
mov rcx, rbp
call qword [0x140163f18]
movzx edi, byte [rax]
lea rdx, [rbx + 4]
mov rcx, rbp
call qword [0x140163f18]
xor byte [rax], dil
inc rbx
sub rsi, 1
jne 0x140035780
mov rax, rbp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14011e650
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.14011ebe0
mov qword [rsp + 0x28], 0
cmp qword [0x14026d8b8], 0
jne 0x14011e698
cmp qword [0x14026d8b0], 0
je 0x14011e698
mov rax, qword [0x14026d8b0]
mov qword [0x14026d8b8], rax
cmp qword [0x14026d8b8], 0
je 0x14011e73e
mov rax, qword [0x14026d8b8]
cmp qword [rax + 0x10], 0
je 0x14011e73e
mov rax, qword [0x14026d8b8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x14011e73e
mov rax, qword [0x14026d8b8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x14011e73e
mov rax, qword [0x14026d8b8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x14011e704
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x14011e70b
xor eax, eax
jmp 0x14011e8b5
mov rax, qword [0x14026d8b8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.14014d5fc
mov rax, qword [rsp + 0x28]
jmp 0x14011e8b5
mov rax, qword [0x14026d8b0]
mov qword [0x14026d8b8], rax
jmp 0x14011e760
mov rax, qword [0x14026d8b8]
mov rax, qword [rax + 8]
mov qword [0x14026d8b8], rax
cmp qword [0x14026d8b8], 0
je 0x14011e7ad
cmp qword [0x14026d8b8], 0
je 0x14011e7ab
mov rax, qword [0x14026d8b8]
cmp qword [rax + 0x10], 0
je 0x14011e7ab
mov rax, qword [0x14026d8b8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x14011e7ab
mov rax, qword [0x14026d8b8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x14011e7ab
jmp 0x14011e6dc
jmp 0x14011e74e
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.14011e8c0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14011e8b3
mov rax, qword [rsp + 0x48]
mov qword [0x14026d8b8], rax
mov rax, qword [0x14026d8b8]
mov dword [rax], 0x52727464
mov rax, qword [0x14026d8b8]
mov qword [rax + 0x10], 0
mov rax, qword [0x14026d8b8]
mov rcx, qword [0x14026d8b0]
mov qword [rax + 8], rcx
mov rax, qword [0x14026d8b8]
mov qword [0x14026d8b0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x14026d8b8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x14011e864
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x14011e89e
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x14011e85a
mov rax, qword [0x14026d8b8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x14011e6dc
xor eax, eax
add rsp, 0x58
ret
Function at 0x14011f5d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.14014d5b4
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14011f617
xor al, al
jmp 0x14011f6b9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14011f641
xor al, al
jmp 0x14011f6b9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x14011f6b1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x14011f6b1
mov al, 1
jmp 0x14011f6b9
jmp 0x14011f6b7
xor al, al
add rsp, 0x78
ret

Function at 0x14014d30c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140163138]
test rax, rax
je 0x14014d356
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014d356
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014d356
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014d356
cmp dword [rcx + 0x84], 0xe
jbe 0x14014d356
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14014d358
xor al, al
add rsp, 0x28
ret