joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ac43630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x6c], 0
mov eax, dword [edi]
mov dword [esp + 4], ecx
mov dword [esp], edi
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac43748
mov ecx, dword [edi]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [ecx + 0x190]
mov dword [ebp - 0x7c], eax
mov eax, dword [edi]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
mov edi, dword [ebp - 0x7c]
sub esp, 8
test edi, edi
je 0x6ac43716
lea esi, [ebp - 0x6c]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x5415
mov dword [esp], edi
call fcn.6ac4c4a0
cmp bl, 1
mov edx, dword [ebp - 0x6c]
je 0x6ac43743
and edx, 0xfffffffd
mov dword [esp + 8], esi
movzx ebx, bl
mov dword [esp], edi
mov dword [esp + 4], 0x5418
mov dword [ebp - 0x6c], edx
call fcn.6ac4c4a0
lea eax, [ebp - 0x68]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.setDTR___i___n
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac436b9
or edx, 2
jmp 0x6ac436db
mov eax, dword [edi]
mov dword [esp], edi
lea esi, [esi]
call dword [eax + 0x40]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], edi
call dword [eax + 0x44]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], edi
xor edi, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac436b9
Function at 0x6ac456b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac45760
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac45735
mov dword [esp], ebx
call fcn.6ac4ceb0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac45723
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac45723

Function at 0x6ac45790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac45850
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac45824
lea edx, [ebp - 0x54]
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.6ac4b3d0
test eax, eax
js 0x6ac45880
movzx eax, byte [ebp - 0x40]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac45803
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac45803
mov eax, 0xffffffff
jmp 0x6ac4581a

Function at 0x6ac45890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
jmp loc.6ac7a450
Function at 0x6ac45980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac45a40
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac45a12
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.6ac4c2c0
test eax, eax
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac459f3
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac459f3

Function at 0x6ac46990
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x6ac59020]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
test eax, eax
jne 0x6ac469b1
jmp 0x6ac46a05
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x6ac469d6
cmp dword [eax], edx
jne 0x6ac469a7
mov ebx, dword [esp + 0x2c]
movzx ecx, cl
mov dword [eax + ebx*4 + 4], ecx
add eax, 4
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.6ac48a70
add esp, 0x18
pop ebx
ret 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.nativeSetEventFlag__fd_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
add esp, 0x18
pop ebx
ret 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 1
mov dword [esp], str.nativeSetEventFlag__index_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac469cf
Function at 0x6ac46bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebx]
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [eax + 0x7c]
mov ecx, dword [ebp + 0x10]
mov edi, eax
sub esp, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac46cc2
mov edi, 0x6ac5417c
mov ecx, 2
mov edx, dword [ebx]
repe cmpsb byte [esi], byte es:[edi]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
je 0x6ac46c83
call dword [edx + 0x190]
sub esp, 0xc
mov edx, dword [ebx]
mov esi, 0x6ac54128
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [edx + 0x5c]
mov edi, dword [ebp + 0x10]
mov ecx, 2
mov eax, dword [ebp - 0x20]
mov ebx, eax
sub esp, 8
repe cmpsb byte [esi], byte es:[edi]
seta cl
setb dl
cmp cl, dl
jne 0x6ac46c79
test eax, eax
je 0x6ac46c90
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [edx + 0x194]
sub esp, 0xc
jmp 0x6ac46c42
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
mov esi, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac46c79
Function at 0x6ac47020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xbc
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0x6ac54064
lea ebx, [ebp - 0x68]
mov dword [esp + 8], 0x6ac54128
lea esi, [ebp - 0xa8]
mov byte [ebp - 0xa8], al
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6ac46bd0
mov edi, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0xac], eax
movzx eax, byte [ebp - 0xa8]
mov dword [esp + 4], str.writeByte__c___n
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.6ac4a300
test eax, eax
js 0x6ac470c1
mov dword [esp + 8], eax
mov dword [esp + 4], str.RXTXPort:writeByte__i_n
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp - 0xac]
mov dword [esp + 8], 0x15
mov dword [esp + 4], 1
mov dword [esp], str.Write_action_failed_
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov edx, dword [ebp - 0xac]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fputs
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x6ac47070
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], str.java_io_IOException
mov dword [esp], ecx
call dword [eax + 0x18]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x6ac471a0
mov dword [esp + 8], esi
lea esi, [ebp - 0xa4]
mov dword [esp], esi
mov dword [esp + 0xc], str.writeByte
mov dword [esp + 4], str._s_in__s
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ecx
call dword [eax + 0x38]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], ecx
call dword [eax + 0x5c]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], ecx
call dword [eax + 0x40]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], ecx
call dword [eax + 0x44]
sub esp, 4
jmp 0x6ac470b7
Function at 0x6ac471d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.6ac46bd0
mov esi, dword [ebp + 0x10]
mov edi, eax
mov eax, dword [ebx]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], 0
call dword [eax + 0x2e0]
mov esi, dword [ebp + 0x14]
mov dword [ebp + 8], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x5c], eax
add esi, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
sub esp, 0xc
add eax, 0x40
mov dword [ebp - 0x60], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.6ac4a300
test eax, eax
js 0x6ac47278
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call dword [eax + 0x300]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], 0x15
mov dword [esp + 4], 1
mov dword [esp], str.Write_action_failed_
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov edx, dword [ebp - 0x60]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fputs
test ebx, ebx
jle 0x6ac472cb
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x6ac47233
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov edi, eax
mov eax, dword [ebx]
mov dword [esp + 4], str.java_io_IOException
mov dword [esp], ebx
call dword [eax + 0x18]
sub esp, 8
test eax, eax
mov esi, eax
je 0x6ac47343
mov dword [esp + 8], edi
lea edi, [ebp - 0x54]
mov dword [esp], edi
mov dword [esp + 0xc], str.writeArray
mov dword [esp + 4], str._s_in__s
call sub.msvcrt.dll_sprintf
mov eax, dword [ebx]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x38]
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x5c]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
sub esp, 4
jmp 0x6ac4726e
Function at 0x6ac47550
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 0x6ac5417c
mov ebp, dword [esp + 0x48]
mov dword [esp + 8], 0x6ac5417e
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.6ac46bd0
mov ecx, dword [esp + 0x54]
test ecx, ecx
mov edx, dword [eax + 8]
mov dword [esp + 0x18], eax
mov dword [eax + 8], 0
mov dword [esp + 0x1c], edx
js 0x6ac4767e
call sub.kernel32.dll_GetTickCount
mov edi, dword [esp + 0x50]
jmp loc.6ac79708
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x6ac47635
nop
call sub.msvcrt.dll__errno
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
add esp, 0x2c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
cmp dword [esp + 0x50], 0
jle 0x6ac47610
mov edi, dword [esp + 0x50]
mov esi, 0x14
xor ebx, ebx
jmp 0x6ac476ab
add ebx, eax
sub edi, eax
cmp dword [esp + 0x50], ebx
jle 0x6ac47610
sub esi, 1
je 0x6ac47610
mov eax, dword [esp + 0x4c]
mov dword [esp + 8], edi
mov dword [esp], ebp
add eax, ebx
mov dword [esp + 4], eax
call fcn.6ac4a580
test eax, eax
js 0x6ac47625
jne 0x6ac47694
mov dword [esp], 0x3e8
call fcn.6ac48ca0
jmp 0x6ac47698
Function at 0x6ac483e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call fcn.6ac46bd0
mov edx, dword [ebp - 0x1c]
mov edi, eax
mov eax, dword [esi]
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp], esi
call dword [eax + 0x2a4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [eax + 0x7c]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54085
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [ebp - 0x20], eax
call fcn.6ac46bd0
test eax, eax
je 0x6ac48530
test edi, edi
jle 0x6ac484f8
mov dword [esp + 4], 2
mov ebx, 0xa
mov dword [esp], edi
call fcn.6ac4c2c0
mov dword [esp], edi
call fcn.6ac49560
nop
test eax, eax
jns 0x6ac484f8
call sub.msvcrt.dll__errno
cmp dword [eax], 4
jne 0x6ac484f8
mov dword [esp], edi
call fcn.6ac49560
sub ebx, 1
jne 0x6ac48490
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str._nnativeClose__:_Close_failed_10_times_
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fputs
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], ecx
call dword [eax + 0x5c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [esi]
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [eax + 0x2a8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0x40]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], esi
call dword [eax + 0x44]
mov eax, dword [esi]
mov edx, dword [ebp - 0x20]
sub esp, 4
mov dword [esp + 4], edx
mov dword [esp], esi
call dword [eax + 0x5c]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
sub esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.nativeClose__:_Close_not_detecting_thread_pid
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x6ac4d0f0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x6ac54c90
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6ac4d140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x6ac4d20b
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x6ac4d191
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x6ac4d179
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x6ac4d189
cmp ecx, 0x40
je 0x6ac4d189
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6ac4d0f0
lea esi, [esi]
lea edi, [edi]
Function at 0x100bf7f
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 2
xor esi, esi
push esi
push 0x1001a04
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c016
push ebx
push edi
push 0x104
mov ebx, 0x103e920
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, ebx
dec edi
cmp dword [0x102c91c], esi
je 0x100bfda
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100bfc9
mov esi, 0x10019fc
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x100bfe8
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100bfda
mov esi, 0x10019f8
movsd dword es:[edi], dword [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bfed
sub eax, edx
inc eax
push eax
push ebx
xor esi, esi
inc esi
push esi
push 0
push 0x10019ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
pop ebx
jne 0x100c016
mov dword [ebp - 8], esi
cmp dword [ebp - 4], 0
pop esi
je 0x100c026
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x100c030
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 2
xor esi, esi
push esi
jmp loc.0109c898
Function at 0x101439a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102c22c]
jne 0x10143ab
jmp loc.0109dc20
jmp fcn.010143b5