joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f2482c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
test eax, eax
je 0x6f248370
mov ebp, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
mov edi, eax
sub esp, 0x18
lea edx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6f24835e
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x18
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x6f248740
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, edx
push ebx
sub esp, 0x34
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x6f24879b
mov ebx, eax
mov dword [esp + 0xc], 1
lea eax, [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionMCI_Extensions
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x6f2487b0
test byte [0x6f266160], 8
jne 0x6f24880c
mov eax, 0x119
add esp, 0x34
pop ebx
pop esi
ret
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
lea eax, [ebx + 2]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov esi, eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
sub esp, 4
test esi, esi
je 0x6f2487a0
test byte [0x6f266160], 8
je 0x6f24879b
mov eax, ebx
call fcn.6f248400
mov dword [esp + 0xc], str.No_...MCI_Extensions_entry_for__s_found._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MCI_GetDevTypeFromFileName
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
mov eax, 0x119
jmp 0x6f2487a0
Function at 0x6f248a50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym.winmm.dll_CloseDriver
mov eax, dword [ebx + 0x14]
sub esp, 0xc
test eax, eax
je 0x6f248a8a
test byte [0x6f266160], 4
jne 0x6f248b50
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6f27a510]
sub esp, 4
test eax, eax
je 0x6f248ac1
cmp ebx, eax
jne 0x6f248ab8
jmp 0x6f248b79
cmp ebx, eax
je 0x6f248b40
mov edx, eax
mov eax, dword [eax + 0x2c]
test eax, eax
jne 0x6f248ab0
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 8]
sub esp, 4
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov edi, dword fs:[0x18]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
add esp, 0x10
pop ebx
pop esi
pop edi
ret
add edx, 0x2c
mov eax, dword [ebx + 0x2c]
mov dword [edx], eax
jmp 0x6f248ac1
mov dword [esp + 0xc], str.Unloading_mci_driver_with_non_nul_dwPrivate_field_n
mov dword [esp + 8], str.MCI_UnLoadMciDriver
mov dword [esp + 4], 0x6f266160
mov dword [esp], 2
call fcn.6f2486f0
jmp 0x6f248a8a
mov edx, 0x6f27a510
jmp 0x6f248b43
Function at 0x6f248f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push edi
push esi
mov esi, eax
mov eax, 0x6f27a380
push ebx
xor ebx, ebx
sub esp, 0x60
nop
mov edx, dword [eax + 8]
test edx, edx
je 0x6f248f9f
cmp dword [eax], esi
je 0x6f24905d
add ebx, 1
add eax, 0x14
cmp ebx, 0x14
jne 0x6f248f90
lea eax, [esi - 0x201]
cmp eax, 0xa
jbe 0x6f249020
test esi, esi
jne 0x6f24904d
mov edi, str.CORE
mov eax, dword [0x6f27af44]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x6f2490a8
mov dword [esp + 4], eax
mov eax, dword [0x6f27af44]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x6f2490a8
mov edx, esi
call fcn.6f248b80
mov ebx, eax
movzx eax, byte [0x6f266160]
jmp 0x6f249059
mov eax, dword [0x6f27af44]
lea edi, [esp + 0x20]
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x6f248fc2
movzx eax, byte [0x6f266160]
mov ebx, 0xffff
test al, 8
jne 0x6f249070
add esp, 0x60
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.___d_n
mov dword [esp + 8], str.MCI_GetCommandTable
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
add esp, 0x60
mov eax, ebx
pop ebx
pop esi
pop edi
ret
movzx eax, byte [0x6f266160]
mov ebx, 0xffff
test al, 4
je 0x6f249059
mov eax, edi
call fcn.6f248400
mov dword [esp + 0xc], str.No_command_table_found_in_resource__p__s__n
mov dword [esp + 0x14], eax
mov eax, dword [0x6f27af44]
mov dword [esp + 8], str.MCI_GetCommandTable
mov dword [esp + 4], 0x6f266160
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.6f2486f0
movzx eax, byte [0x6f266160]
jmp 0x6f249059
Function at 0x6f249520
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x1c
and ecx, 0x400
jne 0x6f249618
mov eax, esi
and eax, 0xa00
cmp eax, 0x200
je 0x6f249588
test esi, 0x2000
je 0x6f249590
mov ebp, dword [ebx + 8]
test ebp, ebp
je 0x6f249590
mov dword [esp + 4], 0x6f26a35c
mov dword [esp], ebp
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x6f24957a
mov eax, ebp
call fcn.6f248380
test eax, eax
je 0x6f249643
mov eax, 0x109
jmp 0x6f249609
mov ebp, dword [edx + 0xc]
test ebp, ebp
jne 0x6f249556
nop
mov ebp, dword [ebx]
mov dword [edi + 4], ebp
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x6f27a510]
sub esp, 4
test ebx, ebx
jne 0x6f2495c3
jmp 0x6f2496c0
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
je 0x6f2496c0
cmp ebp, dword [ebx]
jne 0x6f2495b8
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0x20]
mov eax, 0x107
sub esp, 4
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
jne 0x6f249609
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x801
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym.winmm.dll_DrvSendMessage
sub esp, 0x10
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [edx + 0x10]
test ebp, ebp
je 0x6f249590
mov dword [esp + 4], 0x6f26a35c
mov dword [esp], ebp
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x6f2496b0
mov eax, ebp
call fcn.6f248380
test eax, eax
jne 0x6f2496b0
cmp word [ebp], 0
je 0x6f2496dd
mov eax, ebp
add eax, 2
cmp word [eax], 0
jne 0x6f249650
sub eax, ebp
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [ebx + 0xc], eax
test eax, eax
je 0x6f2496e7
xor edx, edx
lea esi, [esi]
movzx ecx, word [ebp + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x6f249690
jmp 0x6f249590
add esp, 0x1c
mov eax, 0x121
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, 0x101
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x6f24965e
mov eax, 0x108
jmp 0x6f249609
Function at 0x6f24ab50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x6f266160], 8
jne 0x6f24ac68
mov dword [esp + 8], 0xa
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x6f24abe0
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x6f24abe0
mov edx, edi
call fcn.6f248b80
mov dword [esp], ebx
mov edi, eax
call dword [sym.imp.kernel32.dll_FreeResource]
movzx eax, byte [0x6f266160]
sub esp, 4
test al, 8
jne 0x6f24ac2a
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
movzx eax, byte [0x6f266160]
mov edi, 0xffff
test al, 4
je 0x6f24abc7
mov eax, esi
call fcn.6f248400
mov dword [esp + 0xc], str.No_command_table_found_in_module_for__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.mciLoadCommandResource
mov dword [esp + 4], 0x6f266160
mov dword [esp], 2
call fcn.6f2486f0
movzx eax, byte [0x6f266160]
test al, 8
je 0x6f24abcb
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.___04x_n
mov dword [esp + 8], str.mciLoadCommandResource
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, esi
call fcn.6f248400
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___s___d___n
mov dword [esp + 8], str.mciLoadCommandResource
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f24ab79

Function at 0x6f24acb0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
test byte [0x6f266160], 8
jne 0x6f24ad60
xor eax, eax
cmp ebx, 0x13
ja 0x6f24ad52
lea ebx, [ebx + ebx*4]
shl ebx, 2
mov edx, dword [ebx + 0x6f27a388]
test edx, edx
je 0x6f24ad52
mov eax, dword [ebx + 0x6f27a384]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeResource]
mov edx, dword [ebx + 0x6f27a390]
mov dword [ebx + 0x6f27a384], 0
mov dword [ebx + 0x6f27a388], 0
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 1
mov dword [ebx + 0x6f27a390], 0
mov dword [ebx + 0x6f27a38c], 0
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__08x___n
mov dword [esp + 8], str.mciFreeCommandResource
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f24acd2
Function at 0x6f24d080
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov esi, dword [ecx + 0xc]
mov edi, dword [ecx]
mov eax, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov ecx, eax
sub esp, 0x18
lea edx, [ecx + ecx]
mov dword [ebp - 0x24], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov edx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov dword [ebp - 0x2c], edx
call edx
mov ecx, dword [ebp - 0x24]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov eax, dword [ebp - 0x20]
sub esp, 0x18
test eax, eax
je 0x6f24d258
test ebx, ebx
mov edx, dword [ebp - 0x2c]
jne 0x6f24d200
lea eax, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6f24d282
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.winmm.dll_mciSendStringW
sub esp, 0x10
mov edi, eax
test eax, eax
je 0x6f24d210
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov byte [eax], 0
jmp 0x6f24d150
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp + 0x10], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
jmp 0x6f24d1a1
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], ebx
xor esi, esi
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.winmm.dll_mciSendStringW
sub esp, 0x10
mov edi, eax
jmp 0x6f24d1a1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov edi, 0x108
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6f24d1eb
Function at 0x6f24e4c0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
mov esi, 0x108
push ebx
push ecx
sub esp, 0x1c
mov eax, dword [ecx]
call fcn.6f2482c0
test eax, eax
je 0x6f24e52c
mov ebx, eax
mov dword [esp], eax
mov esi, 0xffffffff
mov dword [esp + 4], 0x6f26a35c
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x6f24e508
mov eax, ebx
call fcn.6f248380
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4

Function at 0x6f24e690
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
call fcn.6f2482c0
test eax, eax
je 0x6f24e6e0
mov ebx, eax
test byte [0x6f266160], 1
jne 0x6f24e6f0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
call fcn.6f248400
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__lu___s__stub_n
mov dword [esp + 8], str.mciGetDeviceIDFromElementIDW
mov dword [esp + 4], 0x6f266160
mov dword [esp], 0
call fcn.6f2486f0
jmp 0x6f24e6bc

Function at 0x6f24edf0
Capabilities:
Get process heap flags

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [0x6f27a524]
sub esp, 4
test edx, edx
je 0x6f24ee2d
cmp ebx, edx
jne 0x6f24ee24
jmp 0x6f24ee76
cmp ebx, edx
je 0x6f24ee48
mov eax, edx
mov edx, dword [edx + 0x48]
test edx, edx
jne 0x6f24ee20
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x18
pop ebx
ret
add eax, 0x48
mov edx, dword [edx + 0x48]
mov dword [eax], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6f24ee2d
mov eax, 0x6f27a524
jmp 0x6f24ee4b
Function at 0x6f24f150
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
test byte [0x6f2661c8], 8
jne 0x6f24f1f0
cmp edi, 0xffff
jle 0x6f24f17f
test byte [0x6f2661c8], 4
jne 0x6f24f290
xor edx, edx
mov eax, ebx
call fcn.6f24eff0
mov ebp, eax
test eax, eax
jne 0x6f24f280
test dword [ebx], 0x10000
jne 0x6f24f230
test esi, esi
je 0x6f24f26c
mov dword [ebx + 0x18], esi
mov eax, dword [ebx + 0x2c]
movd xmm0, esi
add esi, edi
mov dword [ebx + 0x14], edi
cmp dword [ebx + 4], 0x204d454d
punpckldq xmm0, xmm0
mov dword [ebx + 0x24], esi
movq qword [ebx + 0x1c], xmm0
mov dword [ebx + 0x28], eax
movzx eax, byte [ebx + 0x50]
sete dl
add edx, edx
and eax, 0xfffffffd
or eax, edx
mov byte [ebx + 0x50], al
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__ld__u__n
mov dword [esp + 0x1c], eax
mov dword [esp + 8], str.MMIO_SetBuffer
mov dword [esp + 4], 0x6f2661c8
mov dword [esp], 3
call fcn.6f24eee0
jmp 0x6f24f16a
mov edx, dword [ebx + 0x18]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 0x18], 0
and dword [ebx], 0xfffeffff
sub esp, 0xc
test esi, esi
jne 0x6f24f1a6
test edi, edi
jne 0x6f24f2c0
mov dword [ebx + 0x18], 0
jmp 0x6f24f1a9
add esp, 0x2c
mov ebp, 0x106
pop ebx
mov eax, ebp
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Untested_handling_of_huge_mmio_buffers___ld___64k__n
mov dword [esp + 8], str.MMIO_SetBuffer
mov dword [esp + 4], 0x6f2661c8
mov dword [esp], 2
call fcn.6f24eee0
jmp 0x6f24f17f
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov dword [ebx + 0x18], eax
test eax, eax
je 0x6f24f2f8
or dword [ebx], 0x10000
jmp 0x6f24f1a9
mov ebp, 0x102
jmp 0x6f24f1dc
Function at 0x6f24f310
Capabilities:
Get process heap flags

Disassembly:
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
mov ebx, ecx
sub esp, 0x20
test byte [0x6f2661c8], 8
je 0x6f24f36c
mov eax, dword [esp + 0x30]
mov edx, str.unicode
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__08lx___p___08lX___s__n
test eax, eax
mov eax, str.ansi
mov dword [esp + 8], str.MMIO_InstallIOProc
cmovne eax, edx
mov dword [esp + 4], 0x6f2661c8
mov dword [esp], 3
mov dword [esp + 0x1c], eax
call fcn.6f24eee0
test ebx, 0x10000000
je 0x6f24f381
test byte [0x6f2661c8], 1
jne 0x6f24f4e0
and ebx, 0x70000
cmp ebx, 0x20000
je 0x6f24f440
cmp ebx, 0x40000
je 0x6f24f408
cmp ebx, 0x10000
jne 0x6f24f519
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6f24f519
mov edx, dword [0x6f266180]
mov dword [eax + 4], esi
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], edi
mov dword [eax + 0x10], 0
mov dword [0x6f266180], eax
mov dword [eax], edx
mov dword [eax + 0xc], ecx
add esp, 0x20
mov eax, edi
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x6f266180]
test eax, eax
jne 0x6f24f42a
jmp 0x6f24f519
mov eax, dword [eax]
test eax, eax
je 0x6f24f519
cmp esi, dword [eax + 4]
jne 0x6f24f420
mov edi, dword [eax + 8]
add esp, 0x20
pop ebx
pop esi
mov eax, edi
pop edi
ret
mov eax, dword [0x6f266180]
test eax, eax
je 0x6f24f519
mov edx, 0x6f266180
test esi, esi
jne 0x6f24f4d0
cmp dword [eax + 8], edi
je 0x6f24f471
lea esi, [esi]
nop
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x6f24f519
cmp dword [eax + 8], edi
jne 0x6f24f460
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x6f24f510
cmp eax, 0x6f2661c8
jae 0x6f24f48e
cmp eax, 0x6f2661a0
jae 0x6f24f54b
mov ecx, dword [eax]
mov edi, dword [eax + 8]
mov dword [edx], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
sub esp, 0xc
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x6f24f519
cmp dword [eax + 4], esi
jne 0x6f24f4c8
jmp 0x6f24f471
mov dword [esp + 0xc], str.Global_procedures_not_implemented_n
mov dword [esp + 8], str.MMIO_InstallIOProc
mov dword [esp + 4], 0x6f2661c8
mov dword [esp], 0
call fcn.6f24eee0
jmp 0x6f24f381
test byte [0x6f2661c8], 2
jne 0x6f24f520
xor edi, edi
jmp 0x6f24f3f8
mov dword [esp + 0xc], str.Cannot_remove_a_mmIOProc_while_in_use_n
xor edi, edi
mov dword [esp + 8], str.MMIO_InstallIOProc
mov dword [esp + 4], 0x6f2661c8
mov dword [esp], 1
call fcn.6f24eee0
jmp 0x6f24f3f8
test byte [0x6f2661c8], 4
je 0x6f24f519
mov dword [esp + 0xc], str.Tried_to_remove_built_in_mmio_proc._Skipping_n
xor edi, edi
mov dword [esp + 8], str.MMIO_InstallIOProc
mov dword [esp + 4], 0x6f2661c8
mov dword [esp], 2
call fcn.6f24eee0
jmp 0x6f24f3f8
Function at 0x6f251340
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
test edx, edx
je 0x6f251478
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 8], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [ebp - 0x24], edx
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x20], ecx
call ecx
mov esi, eax
mov eax, 0x104
sub esp, 0x20
cmp esi, eax
mov dword [esp + 4], 0
cmovl esi, eax
mov eax, dword fs:[0x18]
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6f25147c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x20]
call ecx
sub esp, 0x20
mov dword [esp], 1
mov edx, dword [ebp - 0x1c]
mov ecx, edi
mov eax, ebx
call fcn.6f250cd0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
xor ebx, ebx
jmp 0x6f25142b
xor esi, esi
jmp 0x6f251464