joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c78c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, 1
test edx, edx
mov rbx, rcx
cmovg esi, edx
cmp edx, 0x3ffffff
jg 0x6c7938
movsxd rdx, dword [rcx]
movsxd r8, esi
shl r8, 3
test edx, edx
je 0x6c7918
mov rax, qword [0x0074e080]
shl rdx, 3
mov rcx, qword [rcx + 8]
call qword [rax]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx + 4]
sar edx, 0x1f
xor ecx, edx
sub ecx, edx
cmp ecx, esi
jg 0x6c7968
mov qword [rbx + 8], rax
mov dword [rbx], esi
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [0x0074e040]
mov rcx, r8
call qword [rax]
mov qword [rbx + 8], rax
mov dword [rbx], esi
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 2
call qword [fcn.006ead20]
lea rcx, str.gmp:_overflow_in_mpz_type_n
mov r9, rax
mov r8d, 0x1a
mov edx, 1
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop word [rax + rax]
mov dword [rbx + 4], 0
jmp 0x6c790b

Function at 0x6e2f60
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.006ead20
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.006ead20
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x6e2fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00781a74]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x6e3178
mov rax, qword [0x00781a78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x6e301c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x6e30a7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x6e3000
mov rcx, r12
call fcn.006e3d30
mov rbp, rax
test rax, rax
je 0x6e31b2
mov rax, qword [0x00781a78]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.006e3e60
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00781a78]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6e31c1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x6e30a0
sub eax, 4
and eax, 0xfffffffb
jne 0x6e3130
add dword [0x00781a74], 1
cmp ebx, 8
jae 0x6e30d8
test bl, 4
jne 0x6e3180
test ebx, ebx
je 0x6e30c9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x6e31a0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x6e30c9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x6e310a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00781a78]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6e30a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.006e2f60
nop dword [rax]
xor edi, edi
jmp 0x6e3027
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x6e30c9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x6e30c9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.006e2f60
mov rax, qword [0x00781a78]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.006e2f60
nop
nop dword [rax]
Function at 0x6e39a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00781d60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00781d40]
test rbx, rbx
je 0x6e39f4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x6e39eb
test r12, r12
je 0x6e39eb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6e39d0
lea rcx, [0x00781d60]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6e3d30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0074e0b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x6e3da9
mov rcx, r10
call fcn.006e3c00
test eax, eax
je 0x6e3da9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x6e3da6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6e3d9d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x6e3da9
add r8, 0x28
cmp r8, r9
jne 0x6e3d88
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140e90220
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e9022a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e90253
pop rbp
sub rbp, 0x33
sub rbp, 0xe90220
sub rsp, 0x20
jmp 0x140e90272
mov rax, 0xe90220
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffef38e4b1
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e90291
jmp 0x140e902a8
stc
cmp byte [rax + 0x3a], bl
cmp byte [rbp - 0x64e4e4f], cl
xor byte [rax - 0x47], dh
mov al, 0xb1
mov cl, 0xf9
mov al, 0x58
stc
jbe 0x140e9032f
mov ecx, 0xf9b1b1b1
jbe 0x140e90338
cdq
mov cl, 0xb1
mov cl, 0xf9
push rbx
stc
mov al, 0x70
cmp dh, byte [rax]
mov ebp, 0xf9b1b1b1
mov al, 0x59
loope 0x140e902bb
stc
or ecx, ebp
lodsb al, byte [rsi]
cwde
mov cl, 0xb1
mov cl, 0xb1
mov cl, 0xf9
or byte [rbp + rdx*2 + 0xe], dh
mov cl, 0xb1
mov cl, 0xb1
mov cl, 0xf9
mov al, 0x58
stc
or edx, dword [rbp - 0x45]
invalid
mov cl, 0xb1
mov cl, 0xb1
stc
mov al, 0x58
pop rcx
mov ah, 0xb1
mov cl, 0xb1
pop rax
mov cl, 0xb1
mov cl, 0x58
cmp al, 0xb3
mov cl, 0xb1
jrcxz 0x140e9039b
int3
mov ch, 0xb1
mov cl, 0xb1
pop rax
mov cl, 0xb1
mov cl, 0x58
add byte [rsi + 0x4e], cl
cdqe
in eax, 0x88
mov bl, 0xf9
xor byte [rax - 0x49], dh
mov cl, 0xb1
mov cl, 0xf9
xor byte [rbx - 0x4b], bl
mov cl, 0xb1
mov cl, 0xf9
xor byte [rcx - 0x4c], bl
mov cl, 0xb1
mov cl, 0x58
and cl, byte [rsi + 0x4e]
out dx, al
out dx, al
jb 0x140e903ab
out 0xe4, al
jrcxz 0x140e903c1
cmp byte [rsi - 7], ah
cmp byte [rdi + 0x4d], bh
add esi, dword [rcx]
cmp esi, dword [rdi - 0x4f88cf07]
mov cl, 0xb1
mov cl, 0x39
mov dh, 0xf9
xor byte [rsi - 0x50], dh
mov cl, 0xb1
mov cl, 0xf9
jbe 0x140e90457
mov bl, 0xb1
mov cl, 0xb1
mov bl, 0x63
mov esi, 0xb1b1b634
mov cl, 0x3b
cmpsd dword [rsi], dword [rdi]
stc
ja 0x140e9039a
invalid
cmp esp, dword [rdi - 0x5c88b107]
invalid
Function at 0x6d7d2500
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d7f35e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d7d2688
mov rax, qword [0x6d7f35e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d7d254c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d7d25d5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d7d2530
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d7d26bd
mov rax, qword [0x6d7f35e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d7f35e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d7d26a0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d7d25ce
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d7d2630
add dword [0x6d7f35e4], 1
cmp edi, 8
jae 0x6d7d2603
test dil, 4
jne 0x6d7d2674
test edi, edi
je 0x6d7d25f8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d7d268f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d7d25f8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d7d261c
jmp 0x6d7d25f8
add rsi, qword [0x6d7f35e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d7d25ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d7d25f8
xor esi, esi
jmp 0x6d7d2557
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d7d25f8
mov rax, qword [0x6d7f35e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d7d2e10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d7f38c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d7f38a0]
test rbx, rbx
je 0x6d7d2e64
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d7d2e5b
test rsi, rsi
je 0x6d7d2e5b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d7d2e40
lea rcx, [0x6d7f38c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d7d30a0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d7d30b0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d7d30c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d7d3101
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d7d30f8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d7d3103
add rax, 0x28
cmp rax, r9
jne 0x6d7d30e4
xor eax, eax
ret

Function at 0x6d7d31a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f01f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d7d320d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d320d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d320d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d3204
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d320f
add rax, 0x28
cmp rax, r9
jne 0x6d7d31f0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d7d3310
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f01f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d7d3330
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d3328
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d338d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d3384
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d3394
add rax, 0x28
cmp rax, r9
jne 0x6d7d3370
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d7d33b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d7f01f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d7d341e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d341e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d7d341e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d7d341e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d7d3415
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d7d3425
add rcx, 0x28
cmp rcx, rax
jne 0x6d7d3400
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d7d3438
jmp 0x6d7d341e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d7d3446
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d7d341e
test r9d, r9d
jg 0x6d7d3430
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d7d3780
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6d7e67b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8075e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d7e6938
mov rax, qword [0x6d8075e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d7e67fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d7e6885
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d7e67e0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d7e696d
mov rax, qword [0x6d8075e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8075e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d7e6950
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d7e687e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d7e68e0
add dword [0x6d8075e4], 1
cmp edi, 8
jae 0x6d7e68b3
test dil, 4
jne 0x6d7e6924
test edi, edi
je 0x6d7e68a8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d7e693f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d7e68a8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d7e68cc
jmp 0x6d7e68a8
add rsi, qword [0x6d8075e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d7e687e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d7e68a8
xor esi, esi
jmp 0x6d7e6807
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d7e68a8
mov rax, qword [0x6d8075e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d7e70c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8078c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8078a0]
test rbx, rbx
je 0x6d7e7114
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d7e710b
test rsi, rsi
je 0x6d7e710b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d7e70f0
lea rcx, [0x6d8078c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d7e7350
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d7e7360
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d7e7370
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d7e73b1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d7e73a8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d7e73b3
add rax, 0x28
cmp rax, r9
jne 0x6d7e7394
xor eax, eax
ret

Function at 0x6d7e7450
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8041f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d7e74bd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7e74bd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7e74bd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7e74b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7e74bf
add rax, 0x28
cmp rax, r9
jne 0x6d7e74a0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d7e75c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8041f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d7e75e0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7e75d8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7e763d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7e7634
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7e7644
add rax, 0x28
cmp rax, r9
jne 0x6d7e7620
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d7e7660
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8041f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d7e76ce
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7e76ce
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d7e76ce
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d7e76ce
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d7e76c5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d7e76d5
add rcx, 0x28
cmp rcx, rax
jne 0x6d7e76b0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d7e76e8
jmp 0x6d7e76ce
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d7e76f6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d7e76ce
test r9d, r9d
jg 0x6d7e76e0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d7e7a50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001000
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140001081
mov rsi, rax
mov dword [rsp + 0x20], 0x130
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000109e
xor edi, edi
lea rbx, [rsp + 0x20]
nop
inc edi
mov rcx, rsi
mov rdx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140001040
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400446b0]
lea rdx, str.Total_number_of_running_processes:
call fcn.140001d80
mov rcx, rax
mov edx, edi
call fcn.140002240
mov rcx, rax
call fcn.140002170
jmp 0x1400010c7
lea rcx, [0x1400446b0]
lea rdx, [0x140030478]
call fcn.140001d80
mov rcx, rax
call fcn.140002170
jmp 0x1400010c2
lea rcx, [0x1400446b0]
lea rdx, str.Error:_Unable_to_retrieve_information_about_the_first_process.
call fcn.140001d80
mov rcx, rax
call fcn.140002170
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov eax, edi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret