joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10106d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013a0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx], edi
mov eax, dword [edi]
mov dword [ebx + 8], eax
mov edx, dword [edi]
mov eax, dword [edx]
test eax, eax
je 0x10106d78
test eax, 0xffff0000
je 0x10106d78
mov eax, dword [edx + ecx*4 + 4]
inc ecx
test eax, eax
jne 0x10106d68
lea eax, [ecx + 1]
mov dword [ebx + 0xc], ecx
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101158d6
mov ecx, dword [ebx + 0xc]
shl ecx, 2
push ecx
push dword [ebx + 8]
mov dword [ebx + 4], eax
add eax, 4
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 8]
add esp, 0x10
mov ecx, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebx + 4]
add eax, 4
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.101153b6
mov esp, ebp
pop ebp
ret 4
Function at 0x4877d3
Capabilities:
Query environment variable

Disassembly:
jmp 0x57b682
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x57b696
xor edi, edi
jmp 0x57b6da
push ebx
push esi
call fcn.0057b57b
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.004895dd
mov edi, eax
add esp, 0x14
test edi, edi
je 0x57b6c7
push ebx
push esi
push edi
call fcn.004897fe
add esp, 0xc
push 2
push 0
call fcn.00488f89
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x4890dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x594d70
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x5e0d10], 1
jge 0x594ddf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x594db5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x594db5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x594d92
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x594dcb
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x594dd2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x594ecf
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x594ea0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x594e95
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x594e89
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x594e90
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x594ecf
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x594eca
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x594eb3
mov eax, dword [ebx + 8]
jmp 0x594ecf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x594ec1
xor eax, eax
jmp 0x594ecf
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x594dff
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x73643cbb
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x736460e1
Capabilities:
Parse url

Disassembly:
push 0x40
mov eax, 0x7367111c
call fcn.73662f29
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.73660bd0
add esp, 0xc
push 0x64
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], esi
mov edi, dword [eax - 0xc]
mov ebx, 0x73683e48
push eax
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.73641d87
xor eax, eax
lea ecx, [ebp - 0x4c]
push ecx
push eax
push eax
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x7364615f
call dword [int.736751a8]
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.736424ba
mov eax, esi
call fcn.73663001
ret
push dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov ecx, ebx
lea esi, [ebp - 0x10]
call fcn.73641d87
mov edi, dword [ebp + 0x14]
mov eax, esi
mov byte [ebp - 4], 1
call fcn.736418e7
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.736424ba
push dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov ecx, ebx
lea esi, [ebp - 0x10]
call fcn.73641d87
mov edi, dword [ebp + 0x18]
mov eax, esi
mov byte [ebp - 4], 2
call fcn.736418e7
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.736424ba
cmp dword [ebp - 0x30], 0
je 0x736461ec
push dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov ecx, ebx
lea esi, [ebp - 0x10]
call fcn.73641d87
mov edi, dword [ebp + 0x1c]
mov eax, esi
mov byte [ebp - 4], 3
call fcn.736418e7
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.736424ba
cmp dword [ebp - 0x28], 0
je 0x7364621f
push dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov ecx, ebx
lea esi, [ebp - 0x10]
call fcn.73641d87
mov edi, dword [ebp + 0x20]
mov eax, esi
mov byte [ebp - 4], 4
call fcn.736418e7
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.736424ba
cmp dword [ebp - 0x18], 0
je 0x7364624e
push dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov ecx, ebx
lea esi, [ebp - 0x10]
call fcn.73641d87
mov edi, dword [ebp + 0x24]
mov eax, esi
mov byte [ebp - 4], 5
call fcn.736418e7
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.736424ba
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ax, word [ebp - 0x34]
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
xor esi, esi
jmp 0x7364614c
Function at 0x73647127
Capabilities:
Query remote server for available data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push dword [edi + 0x68]
lea ebx, [edi + 0x44]
mov byte [ebx], 0
call dword [fcn.73675118]
push 0
push 0
push dword [esp + 0x1c]
mov byte [edi + 0x4d], 0
push dword [esp + 0x1c]
mov dword [edi + 0x40], 8
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x736471bb
call dword [int.736751a8]
cmp eax, 0x3e5
jne 0x736471bd
jmp 0x73647197
call dword [int.736751a8]
cmp eax, 0x3e5
jne 0x7364719c
lea esi, [edi + 4]
push ebx
call fcn.73648425
mov eax, esi
call fcn.7364840e
test al, al
jne 0x736471a7
push 0xa
push dword [edi + 0x68]
call dword [0x73675080]
cmp byte [ebx], 0
je 0x7364716b
cmp dword [edi + 0x3c], 0
jne 0x736471ae
mov eax, dword [edi + 0x38]
jmp 0x736471bd
mov eax, 0xe0000008
jmp 0x736471bd
mov edi, dword [edi + 0x38]
test edi, edi
jle 0x736471bb
mov eax, dword [esp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x73647e86
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.73660bd0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x73647ec3
call dword [int.736751a8]
jmp 0x73647ee6
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 3
je 0x73647ee4
cmp eax, 4
je 0x73647ee4
cmp eax, 1
je 0x73647ee4
cmp eax, 2
je 0x73647ee4
push 2
pop eax
jmp 0x73647ee6
xor eax, eax
leave
ret 8

Function at 0x7364c02f
Capabilities:
Hash data using fnv

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x7364c03a
mov ecx, dword [eax + 4]
jmp 0x7364c03d
lea ecx, [eax + 4]
mov edx, dword [eax + 0x14]
push esi
mov eax, 0x811c9dc5
lea edx, [ecx + edx*2]
jmp 0x7364c058
movzx esi, word [ecx]
imul eax, eax, 0x1000193
xor eax, esi
inc ecx
inc ecx
cmp ecx, edx
jne 0x7364c04b
mov esi, 0x7fffffff
and eax, esi
push 0x1f31d
push eax
call fcn.7366201a
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
pop ecx
sub edx, eax
pop ecx
mov eax, edx
jns 0x7364c084
add eax, esi
pop esi
ret
Function at 0x736597cc
Capabilities:
Reference sql statements

Disassembly:
push 0x70
mov eax, 0x736734df
call fcn.73662f92
mov eax, dword [ebp + 8]
push dword [eax]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x78], eax
call fcn.7365aec1
pop ecx
xor edi, edi
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.7365c912
mov ebx, 0x73678f0c
push ebx
call fcn.73660d18
pop ecx
push eax
mov eax, ebx
call fcn.7364b6ca
push ebx
push 0x73678ef0
push 0x73678efc
push 0x73678ee4
push 0x7367aee0
lea ebx, [ebp - 0x48]
call fcn.736500a2
add esp, 0x14
mov eax, esi
mov esi, dword [ebp - 0x78]
push eax
mov byte [ebp - 4], 1
push dword [esi]
lea eax, [ebp - 0x74]
push eax
call fcn.73657dbf
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x2c]
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.73658eaf
test al, al
jne 0x73659882
mov esi, 0x3ee
lea eax, [ebp - 0x74]
call fcn.73652d7a
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.73648661
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.73648661
mov eax, esi
call fcn.73663015
ret 4
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x7365988e
lea eax, [ebp - 0x28]
push eax
push 0x73678f44
push dword [esi]
call fcn.736602fc
xor esi, esi
jmp 0x7365985a
Function at 0x7366cbca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.73665ad4
and dword [ebp - 4], 0
cmp dword [0x73684940], 0
mov ebx, eax
jne 0x7366cc7b
push 0x73676f70
call dword [0x73675238]
mov edi, eax
test edi, edi
je 0x7366cd2c
mov esi, dword [fcn.736751b0]
push 0x73676f64
push edi
call esi
test eax, eax
je 0x7366cd2c
push eax
call fcn.73665a62
mov dword [esp], 0x73676f54
push edi
mov dword [0x73684940], eax
call esi
push eax
call fcn.73665a62
mov dword [esp], 0x73676f40
push edi
mov dword [0x73684944], eax
call esi
push eax
call fcn.73665a62
mov dword [esp], 0x73676f24
push edi
mov dword [0x73684948], eax
call esi
push eax
call fcn.73665a62
pop ecx
mov dword [0x73684950], eax
test eax, eax
je 0x7366cc7b
push 0x73676f0c
push edi
call esi
push eax
call fcn.73665a62
pop ecx
mov dword [0x7368494c], eax
mov eax, dword [0x7368494c]
cmp eax, ebx
je 0x7366ccd3
cmp dword [0x73684950], ebx
je 0x7366ccd3
push eax
call fcn.73665add
push dword [0x73684950]
mov esi, eax
call fcn.73665add
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x7366ccd3
test edi, edi
je 0x7366ccd3
call esi
test eax, eax
je 0x7366ccca
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x7366ccca
test byte [ebp - 0xc], 1
jne 0x7366ccd3
or dword [ebp + 0x10], 0x200000
jmp 0x7366cd0c
mov eax, dword [0x73684944]
cmp eax, ebx
je 0x7366cd0c
push eax
call fcn.73665add
pop ecx
test eax, eax
je 0x7366cd0c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x7366cd0c
mov eax, dword [0x73684948]
cmp eax, ebx
je 0x7366cd0c
push eax
call fcn.73665add
pop ecx
test eax, eax
je 0x7366cd0c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x73684940]
call fcn.73665add
pop ecx
test eax, eax
je 0x7366cd2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x7366cd2e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f721
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000f730
pop dword [ebp - 0x50]
mov eax, 0x1000f730
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x599c7149
sub dword [ebp - 0x60], 0xb4a2bfe
mov dword [ebp - 0x5c], 0xda0edf96
add dword [ebp - 0x5c], 0x58246caf
mov dword [ebp - 0x58], 0x68edf135
add dword [ebp - 0x58], 0xe35e52f9
mov dword [ebp - 0x54], 0xc2eb4cfa
sub dword [ebp - 0x54], 0xc2eb4cfa
lea eax, [ebp - 0x60]
push eax
mov eax, 0xb67d75a9
sub eax, 0xa67c35b9
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2a72143b
sub dword [ebp - 0x60], 0xb5ffaae5
mov dword [ebp - 0x5c], 0xf55fe61a
add dword [ebp - 0x5c], 0x4c0c7b5b
mov dword [ebp - 0x58], 0x38dd78b3
add dword [ebp - 0x58], 0x2a91f3b9
mov dword [ebp - 0x54], 0xcd164722
add dword [ebp - 0x54], 0x32e9b8de
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xdf36f9fe
add eax, 0x30ca45fa
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38902
push 0
call eax
mov ecx, 0x4ffe
xor edx, edx
add edx, eax
mov ebx, 0x10019a00
add ebx, dword [ebp - 0x50]
mov esi, 0x2bbd6a86
xor dword [ebp - 0x10], 0x317872c0
mov edi, dword [ebx]
add edi, esi
add dword [ebp - 0xc], 0x5e931cbb
mov dword [edx], edi
sub dword [ebp - 0x24], 0x2186726a
add edx, 0x6de2ed6d
sub edx, 0x6de2ed69
add ebx, 0xa598f209
sub ebx, 0xa598f205
loop 0x1000f83d
add eax, 0x49f365db
sub eax, 0x49f23310
xor ebx, ebx
add ebx, eax
add eax, 0x520850bb
sub eax, 0x520850b6
mov ecx, 0x326e259c
sub ecx, 0x226e259c
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x6aac13aa
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0
call sym._OpenClipboard_4
sub esp, 4
test eax, eax
setne al
test al, al
je 0x6aac1445
call sym._EmptyClipboard_0
mov ecx, dword [ebp + 8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.size___const
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 2
call sym._GlobalAlloc_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6aac1440
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GlobalLock_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GlobalUnlock_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._SetClipboardData_8
sub esp, 8
call sym._CloseClipboard_0
nop
leave
ret

Function at 0x6aac15ec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
seta al
leave
ret

Function at 0x6aac160f
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x50], 0x40
lea eax, [ebp - 0x50]
mov dword [esp], eax
call sym._GlobalMemoryStatusEx_4
sub esp, 4
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7ff
seta al
leave
ret

Function at 0x6aacb340
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6abea050
call sym._EnterCriticalSection_4
mov ebx, dword [0x6abea048]
sub esp, 4
test ebx, ebx
je 0x6aacb38b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6aacb384
test esi, esi
je 0x6aacb384
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6aacb360
mov dword [esp], 0x6abea050
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6aacb570
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6ab9011c
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x6aacb5c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6aacb698
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6aacb5fe
cmp eax, 4
jne 0x6aacb620
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6aacb60e
cmp edx, 4
je 0x6aacb60e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6aacb570

Function at 0x6aacbba0
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x6aacbbd0
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp sym.___mingwthr_key_dtor
add esp, 4
pop ebx
pop esi
jmp sym._GetLastError_0

Function at 0x6aacbc10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym._GetLastError_0
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sym._SetLastError_4
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6aacbc40
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x6aacbc64
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0
Function at 0x6aadbf10
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fread
test eax, eax
jle 0x6aadbf50
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8
mov dword [ebx + 0x24], 0xffffffff
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x6aadbf60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret 8

Function at 0x6aadcae0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x6ab8bb5c], 0
jne 0x6aadcbb4
mov byte [0x6ab8bb5c], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x6aadcc4e
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x6aadcbaa
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x6ab8cb8d
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x6aadcbe1
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x6aadcb7b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x6aadcba5
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x6aadcc49
Function at 0x6aae2e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIcEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb1EEPKNSt6locale5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x6aae2ee0
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20

Function at 0x6aae2f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIcEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb0EEPKNSt6locale5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x6aae2f80
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20